Malicious actors will attempt to tailor their attacks to target groups of people that they think will provide a reliable payout after a successful attack. This means that a phishing attack can often be categorized by the group it is targeting. For example, a phishing attack is understood as a wide-net attack strategy that gets sent to as many people as possible, but a spear phishing attack targets a single individual with sophisticated and custom means of attack. Whale phishing, on the other hand, is a phishing campaign that specifically targets high value members of a company, such as those in the c-suite, hoping that their status will incentivize them to pay a ransom or provide access to sensitive information.
What is Whale Phishing?
Whale phishing can target CEOs, wealthy groups of people, or members of a company or organization that have influence or decision-making power. These attacks differ from wide-net phishing attacks in that they are sophisticated and sometimes do not try to encourage a user to download a malicious file or click on a suspicious link. This is because high value targets often have been provided with more phishing awareness training than regular employees and can identify low-level threats more easily. Whale phishing instead will use social engineering to try to get the victim to wire funds or divulge sensitive information, such as email addresses, phone numbers, or sensitive client information.
Whale Phishing vs Spear Phishing
On the surface, whale phishing can sound similar to spear phishing. However, spear phishing attempts to target a specific individual and custom tailor the attack strategy to that person. This often requires having information about the target and a long planning process to ensure the best chance of success. Whale phishing instead focuses on a group of people that are high value targets but still require more sophisticated phishing tactics to successfully attack. Spear and whale phishing often use similar attack strategies, such as spoofing or social engineering tactics, but whale phishing will cast a wider net and target multiple people that are likely to have the authority to pay a ransom or leak important data.
Mitigation Strategies
Preventing whale phishing attacks can be difficult because of their advanced attack strategies. Employees that suspect an email is malicious and part of a whale phishing campaign must pay attention to small details, such as the domain of an email address being slightly off or a heightened sense of urgency in an email’s request for information or funds. Aside from providing phishing awareness training that helps users look for detail-specific signs of a phishing attack, whale phishing emails can be blocked by DNS-layer security, endpoint protection, and email filtering services that can be provided by an MSP.
Summary
Whale phishing is an advanced form of a phishing attack that many users will not encounter unless they occupy a prominent, decision-making position in their medium or large-sized company. However, being aware of the different tactics hackers will use to trick companies can help even small businesses better protect their network. If you think your SMB’s phishing awareness training should include whale phishing and the best practices for preventing this attack, then our cybersecurity experts can help! Our team can provide the security services and training your company needs to stay one step ahead of bad actors, and we want to provide a complimentary consultation to see how we can help your business become more secure today!
