I’m proud to announce that our latest article pre-print has been published on arxiv! It has also been submitted to a journal, and hopefully be published in the next few months.
TL;DR: Cybercrime, a major cause of financial losses and intellectual property theft, often begins with email, the primary means of corporate communication. Spear phishing or Business Email Compromise are rare, damaging email threats. However, literature on targeted attacks is inconsistent, hindering security vendors and researchers from mitigating them. This study introduces targeted attacks, discusses targeted-attack-detection techniques, and presents text-based attacks, comparing non-targeted and targeted variants.
Why it matters
Ask ten people what spear phishing is and you will get ten definitions. Some say it requires research on the victim, some say it requires impersonation, some use it interchangeably with Business Email Compromise. That fuzziness is not just academic: if vendors and researchers do not agree on what they are detecting, they cannot compare detectors, share datasets, or even agree on what a miss is. In this paper, we propose a single umbrella term, targeted attacks, review the detection techniques and social-engineering tricks used against them, and focus on text-based attacks, where the text itself is the payload (no link, no attachment). Comparing targeted and non-targeted variants of these emails is what grounds the definition: it shows what actually changes when an attacker picks a specific victim.
🇬🇧 Targeted Attacks: Redefining Spear Phishing and Business Email Compromise. Sarah Wassermann, Maxime Meyer, Sébastien Goutal, Damien Riquet. Pre-print (arxiv), ongoing Journal submission. 🔗
