Estimated Reading Time: 6 Minutes
A spear phishing attack is one of the most effective phishing techniques. Businesses, especially MSPs, need to be extra vigilant about this kind of phishing – because when it succeeds, it can be devastating.
Spear phishers often target MSPs, since they often handle hundreds of clients at any given time. Get access to an MSP, and you get access to a whole cluster of victims. Surveys reflect MSP and IT staff spending hours responding to email-borne threats, cutting down productivity and efficiency.
The victims of spear phishing attacks are numerous – from tech giants to government agencies and authorities. Spear phishers have managed to infiltrate some of the most recognized brands throughout the years – Google, Facebook, Twitter, and more.
It can be very hard to distinguish a spear phishing email from a harmless email, but there are tell-tale signs that you can learn to spot. The most important thing is for businesses like MSPs to be vigilant and train their employees on the ways to spot a spear phishing attack. Some of the best techniques to mitigate the threat of spear phishing scams is to always think before clicking links; implement exercises and drills that simulate spear phishing attempts; and deploy a ‘safety net’ through backup and archiving solutions.
Spear phishing is a targeted phishing campaign or attack.
Both regular and spear phishing rely on impersonation and are often done to steal either money or sensitive information, but the main difference between phishing and spear phishing is that the former relies more on numbers and will send out numerous email blasts to see if anyone takes the bait, while the latter is more meticulous. Spear phishing is often:
A 2022 report reveals that 79% of organizations experienced whaling and spear phishing attacks in 2021 – 20% higher than 2020. 37% of these organizations saw 11-50 attacks within the year.
Spear phishing attacks are potentially the deadliest and the most effective. They often target C-level executives or mid-level employees who have access to sensitive credentials, financial systems such as cash accounts or payroll systems, or other company financial software tools.
Attackers impersonate a senior executive at the company, either asking the employee to wire money, pay a fake vendor, or send employee or client information. Commonly, the requests from the cybercriminal will leverage urgency or even thinly veiled threats against the employee victim.
When a spear phishing attack succeeds, stolen usernames and passwords can be further used to compromise email systems or breach other software tools and financial systems.
MSPs are like candy stores for bad actors. They have control of terabytes of data from tens, hundreds, maybe even thousands of customers. Successfully pulling off a spear phishing attack on an MSP can grant threat groups access to massive amounts of sensitive data, or allow them to steal thousands, even millions of dollars’ worth of data.
IT and MSP staff members are constantly being inundated with phishing attacks, so it’s easier for bad actors to slip through due to sheer volume.
In most organizations, employees are trained to forward suspected attacks to an email alias for analysis by professionals. In practice, these emails require tedious, one-by-one scrutiny and research, and it often takes a long time to even locate where the issue stemmed, much less solve it.
Avanan reports that, on average, each email forwarded to the Security Operations Center (SOC) takes 7.7 minutes for analysis and action. With the volume of email-borne attacks, the amount of time spent responding to these incidents can grow exponentially, especially if IT or MSP staff are overburdened. The company also found that 22.9% of SOC time is spent responding to email-borne threats.
In addition to investigation tasks, SOC staff will often have to perform additional prevention tasks such as updating block and allow lists, changing mail-flow rules, and fine-tuning sensitivity and confidence settings.
To understand how spear phishing scams evolved into what they are now, let’s travel back in time and look at how hackers evolved this modern thievery and espionage.
While the regular type of phishing itself has been around since the 90s, spear phishing and its targeted form of attack is more recent.
The first recognized cases of spear phishing occurred in 2010. Researchers noticed that mass phishing declined between 2010-2011, with spam messages going from 300 billion a day to 40 billion.
The reason was simple: by this time, hackers had discovered the benefits of fewer but more targeted emails:
Between 2010 and 2011, these now-dubbed ‘spear phishing campaigns’ had grown by 300%. This new attack method made the news in 2011 when it was discovered that an attack was happening at RSA Security, the security division owned by Dell EMC, a multinational corporation selling data storage, information security, virtualization, analytics, and cloud computing solutions.
The attack was directed at only four people in the company. Another security company that investigated the incident discovered that one of the employees, under the behest of a convincingly legitimate email, downloaded a carefully crafted spreadsheet that served as a Trojan horse. This Trojan allowed the hackers access to the company’s network by leveraging a zero-day flaw in Adobe Flash.
The result? Administration credentials and sensitive info from the company’s Secure-ID customers like Northrop Grumman and Lockheed Martin were stolen.
“By obtaining employee credentials, they were able to target specific employees who had access to our account support tools. They then targeted 130 Twitter accounts – Tweeting from 45, accessing the DM inbox of 36, and downloading the Twitter Data of 7.”
“Since October 2021, ACTINIUM has targeted or compromised accounts at organizations critical to emergency response and ensuring the security of Ukrainian territory, as well as organizations that would be involved in coordinating the distribution of international and humanitarian aid to Ukraine in a crisis.”
There are three main variants of targeted phishing campaigns:
A spear phishing attack’s success hinges on three key things:
There are certain lines or qualities that are typical of a spear phishing attempt. Here are some of them:
For MSPs and their customers, there is hope yet to prevent spear phishing attacks or, at the very least, make it more difficult for bad actors to execute an attack.
MSPs need to think in terms of layers of defense to battle against a wide variety of cyber security challenges. With spear-phishing, protection starts with backing up your email and prevention starts with employee training and robust email security technologies and extends to additional levels of protection.
At Dropsuite, we arm MSPs with a cloud software platform to easily backup, recover and protect their important business information. We help form the first and last line of defense against hackers, phishers, and other cyber criminals.
© 2025 Dropsuite Limited. All Rights Reserved.
