More sophisticated spear-phishing and whaling attacks — attacks that focus on specific individuals — take more time to prepare and research, but they too can be very inexpensive to perform.
The nine Iranian hackers who were indicted last Friday for allegedly exfiltrating 31 terabytes of research documents and credentials from academics, companies and government agencies phished many of their targets using lures intended to trick them into thinking their library accounts were cancelled.
Researchers this month discovered a new spear phishing campaign targeting government agencies with an evolved version of Sanny malware, a five-year-old information-stealer that now features a multi-stage infection process, whereby each stage is downloaded from the attacker's server.
You don't have to be a rocket scientist to figure out that a recently observed spam campaign offering an $8 million prize to whoever can answer three questions about the late astrophysicist Stephen Hawking is a big-time scam.
Cyber-security executives and business decision makers question whether phishing emails or ransomware attacks are the most potent threats faced, but are businesses equipped to implement all-round risk mitigation strategies?
