After gathering analysis of targeted attack data collected between February and September this year, Trend Micro found that 91 percent of targeted attacks involved spearphishing.
This finding reinforces the company’s stance that these attacks often begin at a very simple point of contact – an email message that is cleverly crafted to entice a specific individual to either open a malicious file attachment or to click a link to a malware- or an exploit-laden site, starting a compromise within the victim’s network.
Spearphishing – coined as a direct analogue to spearfishing – is a new breed of highly targeted phishing that makes the use of information about a target to make attacks more specific and “personal” to the target.
Spearphishing emails, for instance, may refer to their targets by their specific name, rank, or position instead of using generic titles as in broader phishing campaigns.
According to the report, “SpearPhishing Email: Most Favored APT Attack Bait,”94 percent of targeted emails use malicious file attachments as the payload or infection source. The remaining 6 six percent use alternative methods such as installing malware through malicious links that download malicious files.
The reason for this huge discrepancy is straightforward: Employees in large companies or government organisations normally share files (e.g., reports, business documents, and resumes) via email since downloading materials straight off the Internet is regarded as insecure.
Trend Micro offers the most comprehensive, “first line of defense” email security against spearphishing attacks
Based on Trend Micro’s on-going research surrounding APTs (advanced persistent threats), organisations must be able to detect and block spearphishing attempts as its first line of defence against targeted attacks.
As part of its Custom Defense against APTs launching October, Trend Micro bolstered its suite of email security solutions to not only stop traditional threats, but also to identify highly targeted, acute email attacks. By integrating with the new Trend Micro Deep Discovery hardware appliance, a solution that delivers network-wide threat detection, custom sandboxing, and advanced threat analysis into a single platform, Trend Micro provides leading capabilities in both traditional filtering and specialised threat detection in a single email security layer.
Unlike standard email security solutions that are unlikely to detect spearphishing emails associated with APTs, Trend Micro’s email security products automatically send suspicious attachments to Deep Discovery for analysis in customer-defined sandboxes and blocks spearphishing emails in-line.
Beyond email threat detection and protection, Deep Discovery automatically issues custom security updates to other security layers throughout the organisation’s network. Moreover, it correlates local findings with Trend Micro’s global threat intelligence to help security departments fight back against their attackers – offering detailed information about the specific attack and the attackers: the nature and extent of the attack, and who is behind it. This custom insight enables organisations to better respond and protect against further attack.
