Agentless Backup is Not a Myth

The vast majority (91 per cent) of targeted attacks begin with a spear phishing email, according to a new study by Trend Micro.

Spear phishing is a form of phishing that makes use of information about a target to make attacks more specific and “personal”. These attacks may, for example, refer to their targets by their specific name, rank, or position at the organisation instead of using generic titles common in broader (consumer focused) phishing campaigns. The end goal is usually to trick prospective victims into opening a malicious file attachment (in 94 per cent of cases) or to follow links to an exploit-laden site.

Targeted attacks are often malware-based and designed to infect networks, stay resident, explore, further infect and steal information. This information can be anything from emails to technology blueprints, policy documents or research.

Aside from spear phishing, other tactics that have been noted in targeted attacks include the use of removable media (USB, CD etc), theft of credentials giving access to systems and networks (eg, VPNs).

Spear phishers most frequently target government and activist groups. Details of government agencies and appointed officials are often posted on public government websites.  Members of activist groups are often active in social media, and are also quick to provide member information in order to facilitate campaigning or recruit new members. As a result, three out of four of the targeted victims’ email addresses were easily found through web searches or using common email address formats.

The percentage of malicious attachments in emails has been in steady decline over recent years. But the researchers insist this trend is likely to reverse itself, bringing with it extra spam and the need to redesign corporate defences, according to Trend Micro.

"We fully expect to see a resurgence of malicious email as targeted attacks expand and evolve,” said Rik Ferguson, director of security research and communications at Trend Micro. “Experience has shown us that criminals continue to abuse tried and trusted methods to directly leverage intelligence gathered during the reconnaissance for targeted attacks."

"We have also seen that targeted attacks are evolving and expanding. The abundance of information on individuals and companies makes the job of creating extremely credible emails far too simple. It's a part of a custom defence that should not be ignored."

Trend's study can be found here (PDF). ®

Steps to Take Before Choosing a Business Continuity Partner