Examkin

Question

Difficulty: MediumSocial Engineering Attacks and Vectors

An organization's finance department receives an email requesting an immediate change to a trusted vendor's direct deposit bank account details before a scheduled wire transfer. The email features legitimate company logos, uses appropriate financial terminology, and references recent specific purchase order numbers, but originates from a slightly altered external domain. Which of the following social engineering attacks is depicted in this scenario?

  1. Spear phishingAnswer
  2. B
    Watering hole attack
  3. C
    Smishing
  4. D
    Pharming

Answer

Spear phishing is the correct answer because the attack specifically targets finance department personnel with tailored, context-specific information like genuine purchase order details to perform financial theft.
Spear phishing describes a social engineering attack that targets specific organizations or individuals using custom-tailored details—such as accurate contract references and specific financial context—to increase credibility and the likelihood of success.

Step-by-Step Solution

1
Analyze the attack medium and target specificity
The message was delivered via email specifically to the finance department rather than a broad broadcast or SMS.
Identifying the medium (email) and target specificity (finance department) narrows the vector down to email-based social engineering.
2
Examine the level of customization in the attack message
The email incorporates realistic logos, proper terminology, and valid internal purchase order numbers.
High contextual customization tailored to a specific organization or vendor relationship is the defining attribute of spear phishing.
3
Differentiate from general phishing and other social engineering variants
General phishing is sent en masse without customized context, while watering hole, smishing, and pharming rely on different mechanisms or media.
Matching customized email targeting against specific attack definitions confirms spear phishing.

Key Concept

Spear phishing involves crafted, highly targeted messages leveraging stolen or researched context to deceive specific targets.
Rate this question

Topics

Social Engineering Attacks and Vectors

More questions from this topic