New Whaling Campaign Targets High Level Execs, Calls Them by Name, and Distributes Ransomware

There is a newer term floating around related to phishing. We’ve heard of traditional phishing, which at a basic level usually involves a hacker sending email attempting to get a victim to click a malicious link or attachment. Then there’s spear-phishing, which is more targeted toward specific people or industries; usually banking, finance, and government agencies. Now, there is whaling. This is a type of phishing that targets high-level executives. Usually they have titles at the C-level, senior vice president, or director among others.

Recently, security company Proofpoint has observed a very special ransomware sent via email to high called level targets called TA530. What is significant about this is that it is customized to use the target’s name, job title, phone number, and company name. It isn’t known how the phishers got the details, but it could be a result of the massive amounts of data that has been stolen from the many data breaches that have occurred in recent times. However, another possibility is that often people will post such information on professional networking sites such as LinkedIn or Xing. In other cases, it’s on the company website.

While it is certainly valuable to use websites for professional reasons, use care with what information you post on them. If possible, use a description of your role, rather than a title.

Even more concerning about TA530 is that the campaigns don’t stop at the customization; they also target specific regions and industries. This one isn’t getting to the distribution levels like Locky and Dridex which are sent to massive numbers of random recipients, but is being seen going after tens of thousands of people located in the UK, Australia, and the U.S. The most affected vertical is financial services. Not far behind are retail, manufacturing, and healthcare.

Why target the high-ranking executives and managers? It’s because they typically have more and sensitive information about a company or agency stored on their computers, which means they may be more likely to pay a ransom to decrypt the information. Often, they also have access to the corporate online bank accounts and financial systems. Make sure all systems are backed up on a schedule that makes sense for the type of information stored on the computers. Then if ransomware strikes, it can be restored from a recent backup.

In addition, all users of a company network should be educated on how to identify all types of phishing and that everyone knows the steps to take should they accidently execute it on their system.

The ransomware seen in these whaling campaigns include the infamous CryptoWall and Ursnif/RecoLoad point of sale reconnaissance Trojan, which targets retail and hospitality organizations.