TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

F5 Labs

Phishing for Information, Part 2: How Attackers Collect Data About Your Employees

2017-07-20 · Read original ↗

ATT&CK techniques detected

6 predictions
T1585.001Social Media Accounts
57%
"can observe the writing style of the people they want to impersonate. beyond that, they can also create detailed psychological profiles of victims. there are a number of tools and techniques available to do things like : - analyze sentiment to determine people ’ s opinions and po…"
T1591Gather Victim Org Information
46%
"##siers. the lesson here is think before you volunteer information about yourself and your work, and limit the number of websites where you do this. in part 3 of this series, we look at how attackers ( phishers ) gather up information about your organization."
T1598Phishing for Information
46%
"phishing for information, part 2 : how attackers collect data about your employees in part 1 of this blog series ( / content / f5 - labs / en / labs / articles / threat - intelligence / phishing - for - information - part - 1 - how - phishers - bait - their - hooks - with - infor…"
T1589Gather Victim Identity Information
44%
"there are numerous “ people search ” sites like pipl, spokeo, and zabasearch. many of these sites pull together profiles based on dozens of resources. sometimes they ’ re not very helpful, like this example for me, because i ’ m a paranoid security guy : however, different sites …"
T1598Phishing for Information
32%
"sites, it ’ s not hard for phishers to gather up a list of names of employees at a specific organization. social media and personal information despite the security team ’ s best efforts to prevent it, employees will share and spread information about themselves all over the inte…"
T1589Gather Victim Identity Information
32%
"sites, it ’ s not hard for phishers to gather up a list of names of employees at a specific organization. social media and personal information despite the security team ’ s best efforts to prevent it, employees will share and spread information about themselves all over the inte…"

Summary

The personal and job-related information that employees often innocently post on various websites makes it easy for phishers to pull off their scams.