The three constraints on Influence Operations - Digital Threat Digest
![Double circle designs part4](https://pgi.imgix.net/assets/uploads/images/Blog-posts/Double-circle-designs-part4.png?auto=compress%2Cformat&fit=crop&fm=webp&h=349&ixlib=php-3.1.0&upscale&w=349&tone=light)
More than 90% of breaches start with a phishing attack.
Hackers are adaptive and opportunistic, so it’s no surprise that some have adapted their phishing attempts so they can land the biggest fish—CEOs and executives—using a technique known as ‘whaling’.
Whaling is a type of phishing attack aimed at C-level or top-level executives with access to finances or sensitive data. A hacker uses social engineering and computer intrusion techniques to get as much information as they can on their targets. Just by scouring social media channels such as LinkedIn, they can collect personal data and information that can then be exploited to put their schemes into action. The attacker also collects information about how an organisation’s emails are structured in order to make them look as authentic and believable as possible.
Often the attacker will pretend to be a CEO, or senior executive, and send requests for money or data via email to another high-level executive. In the most serious cases, successful whaling attacks have resulted in millions of pounds of company funds being sent to accounts controlled by criminals.
A well-publicised example is that of European manufacturer Leoni AG, whose CFO was deceived into transferring £34 million into a bank account of the hacker’s choosing in 2016. In this case, the CFO received an email spoofed to look like it came from one of the company’s top German executives.
Why waste your time targeting lower level workers—or a business as a whole—when you can make significant criminal gains by targeting the big fish at the top. The scammer relies on workers’ desires to impress senior managers and uses this behaviour to their advantage.
As with many cyber threats, educating the final line of defence (us) is key to limiting the risks. Training employees and executives on what to look out for and how to avoid becoming a victim can reduce the threat dramatically:
Prepare your organisation for phishing attacks, contact us.
As I waited for my flight to be rescheduled during last week’s IT outage, I listened to fellow passengers wonder aloud how a company whose name has never hit their radar could have such an impact on such a spectrum of day-to-day matters.
If you don’t know who Nara Smith is, I’m sorry to say you may just be living under a rock. Nara Smith has simply taken over my Instagram and TikTok feed with her ‘what I cooked for my husband today’, ‘what my toddlers ate today’ or my favourite video format, ‘my husband was craving [insert insane request] so I made it from scratch’.
Explaining how digital incidents severely impact the real world can be difficult, but we are increasingly seeing cyber incidents that illustrate how malicious actors can impact our daily lives.