Examkin

Question

Difficulty: MediumSocial Engineering Attacks and Vectors

An accounts payable specialist receives an urgent email that appears to originate from the organization's Chief Financial Officer (CFO). The message references an undisclosed legal settlement and directs the specialist to immediately wire $45,000 to an external account, explicitly instructing them to bypass normal dual-authorization procedures to meet a strict deadline. Investigation reveals the message originated from an external domain registered to mimic the enterprise domain by substituting the letter 'o' with the number '0'. Which of the following attack types is best described in this scenario?

  1. Whaling combined with typosquattingAnswer
  2. B
    Watering hole attack combined with pretexting
  3. C
    Vishing combined with social proof
  4. D
    Quid pro quo combined with pharming

Answer

Whaling combined with typosquatting
Whaling is a specialized form of spear phishing that specifically targets or impersonates senior executives (such as a CFO) to authorize high-value transactions or release sensitive data. Typosquatting (also known as URL hijacking) involves registering domain names that closely resemble legitimate domains (such as replacing the letter 'o' with the digit '0') to deceive recipients into believing the sender is authentic.

Step-by-Step Solution

1
Analyze the target and impersonation role in the scenario
The attack impersonates high-level corporate leadership (CFO) to mandate financial transactions, which characterizes a whaling attack variant of spear phishing.
Whaling focuses on executive leadership roles or high-value targets.
2
Analyze the technical vector used to deceive the recipient
The attacker registered a fraudulent domain using character substitution ('0' for 'o') to trick users looking at sender addresses.
Typosquatting relies on subtle typographical variations of legitimate domain names.
3
Synthesize the attack elements to select the correct social engineering combination
The combination of executive impersonation (whaling) and deceptive domain registration (typosquatting) matches the scenario.
Both techniques work together to establish authority and bypass casual human verification.

Key Concept

Executive Impersonation (Whaling) and Deceptive Domain Registration (Typosquatting)
Rate this question

Topics

Social Engineering Attacks and Vectors

More questions from this topic