Advanced Persistent Threats (APT) almost always use spearphishing as the means of infiltration. An effective spearphishing email needs to be targeted to the victim. If the content doesn’t ring true, the intended victim won’t be deceived. Part of ringing true is crafting an email that uses the right jargon and writing style. This makes the reconnaissance phase of an APT critical.
Microphisher is a tool that analyzes published content (blogs, tweets, Facebook, etc.) and determines writing style and topics written about. This assists in writing a message that mimics the writing style of people in the organization. The ethical hackers at Trustwave who created Microphisher have made it available on GitHub so that firms can use it to test their own readiness.
eWeek quotes Joaquim Espinhara, one of the TrustWave researchers who created Microphisher:
You can’t really trust content from someone just because it’s someone you know. You can’t assume that just because it’s a message that looks legitimate, that it came from the right place.
What can you do? Espinhara recommends not clicking on links. Bad guys understand that, which is why bad guys overwhelming use evil attachments in APT. This graph from Trend Micro sums it up:
So, what can you do? You can fight deception by unmasking attackers using SP Guard from Iconix. With SP Guard, IT can determine a list of trusted senders and provide this information to staff in a simple and highly effective manner.
You can contact us at 408-727-6342,ext 3 or use our online contact form.