Whaling phishing attacks

Welcome to the new year and another type of social attack whereby people are trying to scam money from organisations.

A whaling attack, also referred to as a whaling phishing attack, is a type of social engineering attack specifically targeting staff within an organisation that would have the ability to be able to transfer money or make changes in some way that would allow the scammer to fraudulently get money out of your organisation.

This is an example of how it can work (Mostly a true story some details changed to illustrate relevant points):

An attacker will visit your company website find out the name of the CEO or admin staff or even the wages person. They work out what that uses email addresses is, which they can usually pretty easily guess even if it's not displayed on the website itself. Let's call her Karen.

Then they find the name of another employee let's call him Tony. Then the scammer sends an email to Karen pretending to be Tony asking that they transfer money into a certain account or change the account that the wages are paid into or some version of this limited only by your imagination.

Once the wages person Karen receives the email she diligently processes it. Replies to say that it's been done (which of course goes back to the attacker) and a month later Tony can't understand why his wages haven't gone in.
Here is a couple of emails that illustrate this exact scenario except that the attacker sent the email to the office manager who then sent it on to the wages person adding more credibility to the claim because the wages person had legitimately received an emailed set of instructions from the actual office manager.

Here is more detail on the type of attack:
https://www.cisco.com/site/us/en/learn/topics/security/what-is-a-whaling-attack.html

These types of attacks can be very difficult to spot because the attacker has sometimes invested considerable amounts of time learning about staff within an organisation. Who the appropriate person to attack is and how to make their claim seam believable. It also doesn't require that they gain access to anybody's email because you can reasonably convincingly just send an email from Gmail as has been done in the images below.
Be on the lookout for this type of attack and if you are one of my customers and would like to discuss any more details please contact me.

In this instance the attacker even set a follow-up message to the second staff member.