SECURING YOUR BUSINESS ASSETS

Phishing Campaign - phishing.42

Social Engineering Attacks by Email

Phishing Attacks

Cybercriminals do not target a company's IT infrastructure exclusively through digital attacks. They also attempt to obtain information and access through employees, or trick them into unintentionally helping to execute malicious code. This type of attack is known as social engineering and is one of the most common causes of successful intrusions into IT infrastructures. The BSI's report “The State of IT Security in Germany 2019” also identifies these attacks as a significant threat.

Objective

The phishing.42 service simulates an email-based social engineering attack targeting all or selected employees of a company. The aim is to assess employees' awareness of emails containing malicious links (drive-by downloads), malicious content (malware), and phishing attempts. Many of our clients also use the campaign as part of their information security awareness activities.

The service comprises the following steps:

1 Providing Email Addresses

The client provides the email addresses of the intended recipients. These addresses are often also assigned to the client's organisational units.

2 Setting Up a Fake Website

Fake websites are set up in plan42's data centre. Depending on the chosen scenario, these may include voucher download pages, information services, or login pages for intranet or extranet sites.

3 Sending Emails

The intended recipients receive an email which, depending on the scenario, may inform them about an opportunity to download vouchers from a website or ask them to enter their login details.

The difficulty of recognising these emails as fraudulent is agreed with the client. This may range from professional phishing emails with a forged sender that are difficult to identify, to emails containing more or less obvious clues that they are fake.

4 Analysis and Reporting

Each email contains an individual HTTP link. This allows us to identify which recipients click the links or enter information on the phishing pages. The results can be analysed anonymously, by individual, or using other agreed groupings, such as the client's organisational units. We apply strict technical and organisational measures to protect the data entrusted to us. Once the engagement is complete, all personal information is deleted in accordance with data protection requirements.

The final step helps monitor progress, document results, and identify opportunities for further improvement.

Scenarios

The standard offering includes two attack scenarios, typically carried out four to eight weeks apart.

And what can we do for you?

Would you like to learn more about our phishing campaigns? Download our service description:

Or please feel free to contact us.