Spear-phishing

MITRE classes this phase as reconnaissance: phishing for information seeks to get credentials or other usable data disclosed, not to run malicious code⁴. The attacker can also exchange directly by email or instant messaging, posing as a source with a reason to ask, or sending several messages that seem urgent⁴.

MITRE gives examples of groups. Kimsuky sent tailored emails to collect information about its victims, including contact lists used to identify other targets⁴. ZIRCONIUM targeted staff of a presidential campaign with credential-harvesting emails⁴. Scattered Spider combined credential phishing and social engineering to capture one-time passcodes (OTP)⁴.

The NCSC describes what the attacker can exploit in internal operations: if working methods are known (how payments are made, for example), the attacker can imitate them to obtain a password or an unauthorised payment².

The sources cited here describe several forms.

With an attachment, the attacker attaches a file to the email and generally relies on the user to run it, posing as a trusted source⁵. The APT28 group sent emails containing malicious Microsoft Office and RAR attachments⁸.

With a link, the attacker avoids defences that inspect attachments⁶. Links can look harmless but imitate a legitimate site using special characters (an attack known as "IDN homograph"), or hide their address by taking advantage of quirks in URL syntax⁶. A link can also request OAuth 2.0 authorisation: if the user accepts, a malicious application gets access rights to the account and can act on the user's behalf⁶.

Through a third-party service, the message arrives outside the company mailbox: social networks, personal web mail. MITRE notes that these services more often have a looser security policy than a company does⁷. The attacker creates fake accounts and offers, for example, a job opening⁷. That gives them a plausible reason to ask questions about the software in use⁷. They can also gain the target's trust, then send a file to the personal mailbox the target checks on their work computer⁷. That file then bypasses restrictions of the work account⁷.

Other variants: the attacker inserts themselves into an existing discussion thread ("thread hijacking")¹, or the message invites the victim to call a number where they are guided to a malicious URL, malware or a remote administration tool¹. CISA also reports sender addresses that look like those of a known company by changing or omitting a few characters, and links whose displayed text does not match the destination on hover³.

Neutralised illustration, with no real link:

From: [first name of a known colleague or supplier] <name@example-company[.]invalid>
Subject: [mentions a real project of your department]
Body: [request to review a document; paraphrased]
Link: hxxps://company-login[.]invalid/[imitated login page]

Sender spoofing: the attacker can forge the sender's identity to fool both the recipient and automatic security tools¹. The countermeasures cited are SPF (validity of the sender's domain), DKIM (integrity of the message) and DMARC, which lets the organisation enforce these checks¹. The NCSC adds that DMARC stops phishers from spoofing an organisation's domain and that the organisation's legitimate emails are more likely to reach inboxes².

Lookalike domain: the sources mention addresses close to the original (characters changed or omitted)³ and special characters imitating a legitimate site⁶. An address that looks right to the eye may therefore not be.

Harvesting: the booby-trapped page is used to collect credentials, and the attachment or the link to install code¹⁴. In one test, an assessment team from CISA and the NSA got in by phishing an end-user account that had administrator rights and compromised a domain in less than one business day⁹.

Bypassing two-factor authentication: in another test, the team knew a user's credentials, but multifactor authentication blocked its logins. It posed as IT support and obtained the code by phone⁹. Some forms of multifactor authentication are vulnerable to phishing and to "push bombing"⁹.

2016: the Democratic National Committee

APT28 is said to have compromised the Hillary Clinton campaign, the Democratic National Committee (DNC) and the Democratic Congressional Campaign Committee (DCCC) in 2016, in an attempt to influence the US presidential election⁸. According to MITRE, the group used credentials stolen through a spear-phishing email to log in to the DCCC network, then used that access to compromise the DNC network⁸.

February 2024: APT29's cloud access

An advisory published on 26 February 2024 by the UK's NCSC and its partners describes the methods of the APT29 group, assessed as almost certainly part of Russia's SVR¹⁰. The advisory does not deal with spear-phishing itself, but with the next step, once a password is already known: it describes a bypass of multifactor authentication by "MFA bombing" or "MFA fatigue", where the actor repeatedly sends requests until the victim accepts¹⁰. It recommends limiting session lengths and allowing only authorised devices to enrol¹⁰.