There is an alarming trend that is increasing with such ferocity that cyber security professionals must start taking action to protect their organisations.
Sophisticated spear phishing attacks using deepfake technology on Zoom and WhatsApp are on the increase – so much so that we work with people who have actively been targeted.
Surprisingly there is very little news on this topic, which highlights the need for more to be publicised on this subject. SC Media recently reported that a deepfake phishing scam cost a multinational 25 million pounds after an employee was tricked by an online meeting with supposed colleagues. Other than that a Google search reveals very little other than some news articles last year.
Why is this when spear phishing and deepfake are occurring at an alarming rate and becoming a heavily utilised way for businesses to be attacked by criminals utilising opportunities via this method? Businesses now need to be very aware of the risks involved with this practise, at any significant moments in an organisation’s existence. For example, more recently acquisitions have been a key flag for criminals to use spear phishing and deepfake. Take a moment to reflect on why; when an acquisition occurs, a business is dealing with multiple contacts and other businesses that they wouldn’t normally, so it is an easy gateway amidst this period of slightly chaotic processes for cyber criminals to take advantage.
Businesses now need to position their cyber security strategies to include any deepfake activities, but firstly let’s dive into what broad shape the attacks we are aware of seem to take:
What is the pattern of the spear phishing & deepfake attack?
So the attack could follow this pattern:
- Senior business leaders receive a Zoom meeting invite or a WhatsApp message from a “colleague” or trusted person.
- When the individual attended the Zoom meeting, deepfake technology was used to impersonate the trusted individual. Or in the case of WhatsApp messages, voice notes were sent of the trusted individual – both methods make the interactions completely plausible – note that the name of the trusted individual is even used on WhatsApp so that you wouldn’t even realise it is not the contact they have saved.
- The Senior leader is then instructed to help the trusted individual complete an action. For example on one occasion, the business leader was asked to support another acquisition and contact a law firm to sign an NDA.
- The senior leader reviews the law firm – looking at their presence on line and requests the NDA and their interactions with the 3rd party can seem all legitimated
- It is at that point that the attackers attempt to elicit sensitive information or authorise fraudulent financial transactions.
The new era: These attacks combine social engineering with AI Technology
This is incredibly dangerous – convincing your victim is paramount to the success of these Cyber attackers and we know that these deepfakes are incredibly believable. The deepfakes can replicate mannerisms voices and appearances of the trusted individual.
How can this spear phishing and deepfake threat be tackled?
Often cited as the biggest and weakest link in an organisations operational resilience, a human has identified that they were the target of a spear phishing/deepfake attack. It was their gut instinct – that “something doesn’t feel right” factor – that actually won and prevented the attack and it is a very timely reminder that whilst technology is paramount to monitoring your business ecosystem, never forget the human element and training your teams to identify when something feels off, or at least not feel stupid should they question something; ultimately, empowering people will be our strongest defence.
With that said, it is imperative now that organisations find ways to combat this exceedingly dangerous and worrying trend and CISO’s, cyber security and business leaders must act quickly to strengthen defences by combining education to their teams and technology to minimise the risk.
Right now a comprehensive approach is necessary to mitigate any risk of spear phishing and deepfake attacks that combines all these 10 elements.
- Employee Engagement & Training
- Educate your employees about spear phishing and deepfake attacks – how to recognise them and the reporting of any behaviour that is deemed suspicious.
- Implement simulated phishing campaigns to test team awareness.
- Multi–factor Authentication (MFA)
- Ensure you have MFA implemented for accessing any company systems for an extra layer of security.
- Regularly update MFA to ensure they are as robust as they should be.
- Communication channels that are secure
- Encrypt communication channels for any sensitive conversations and data exchanges.
- It is imperative that you establish protocols for verifying the identify of any individual you may be about to share sensitive information with.
- Email Security
- Ensure you have advanced spam filters or block malicious emails, implement email authentication protocols such as DKIM, DMARC and SPF to verify the legitimacy of any incoming emails. Scan attachments and links for any suspicious content.
- Monitor & Detect
- Continuous monitoring of your entire ecosystem should be implemented
- Advanced threat detection tools should be used to monitor network traffic and identify spear phishing and deepfake activity.
- Analyse behaviour to detect unusual patterns that might indicate a compromised account ecosystem.
- Protect your data
- Ensure your data is encrypted to protect it from unauthorised access and implement strict access controls so that only authorised personnel can access it.
- Plan for an incident
- Firstly ensure you have a plan!
- Ensure the incident response plan is comprehensive and specifically includes (spear) phishing and deepfake attacks.
- Perform tests so that teams are fully appraised of the protocols and can act quickly I the event of an attack.
- Third party risk
- Assess your vendors security to ensure they are not the weak link to your security.
- Specify security requirements and breach notification clauses in their contracts.
- How AI & Machine Learning can help
- Use AI and machine learning tools to detect and mitigate any attempts of spear phishing and deepfake attacks by analysing patterns and any anomalies.
- You can deploy deepfake tools that are specifically designed to detect deepfake content in images, audio and video.
- Complete security Updates and Audits regularly
- STAY UPDATED! Ensure all systems, security solutions and software are completely up to date with patching to ensure you have the highest level of protection against vulnerabilities.
- Conduct security audits to ensure you are identifying vulnerabilities and improving security measures.
It really is a combination of all of these things but, in a nutshell, empower and educate your teams, implement the right technology to ensure you are up to date and continuously monitor and, in equal measure, ensure you have the protocols in place to identify that you are dealing with the real trusted individual before you release sensitive information or funds.
