What is Target Selection in Phishing?

In the realm of phishing, target selection refers to the process by which attackers identify and choose individuals or organizations as potential victims for their phishing campaigns. This initial step is critical as it sets the foundation for the entire operation, determining both the strategy and potential success rate.

Target selection in phishing is the method attackers use to identify and prioritize individuals or organizations that are likely to yield high success rates for their campaigns.

Why It Matters

The importance of target selection in phishing cannot be overstated. It is a crucial component that directly impacts the effectiveness of a phishing campaign. Attackers aim to maximize the return on investment of their efforts, and selecting the right targets enhances their likelihood of success. By understanding the potential vulnerabilities and operational behaviors of their targets, attackers can craft more convincing lures and be more precise in their attacks.

Operators conducting authorized phishing simulations also recognize the importance of careful target selection. By emulating this essential step, they test an organization’s capability to identify and defend against threats. Effective target selection allows for the creation of realistic scenarios that test the human element of cybersecurity, which can reveal gaps in security awareness and training programs.

In Practice

Consider a scenario where attackers employ social media profiling as a method to select their target. By analyzing an individual’s online presence, job role, and interactions, attackers gather intelligence that guides their next move. For instance, they might discover that an employee frequently discusses their workplace environment on LinkedIn. This information becomes the foothold for crafting a spear-phishing email that appears as an internal memo, increasing the likelihood of engagement.

Another method for target selection involves data mining from breached databases. For example, utilizing stolen email lists, attackers can broaden their scope to target entire departments within an organization. To maximize success, they analyze the domain names associated with these emails to understand the structure and potential hierarchy, allowing them to tailor their lures with organizational mimicry. An email from a domain like

hr.companyxyz.com

containing a subject line “Important Update: HR Policy Changes — Action Required” capitalizes on the inferred trust in HR communications.

From: noreply@hr.companyxyz.com

To: john.smith@companyxyz.com

Subject: Important Update: HR Policy Changes - Action Required

Dear John,

Please review and acknowledge the changes to the HR policies by the end of the week. Click the link below to log in and confirm your understanding.

[Review HR Policy Updates]

Thank you for your prompt attention to this matter.

Best regards,  

HR Administration

Credential harvesting campaigns also benefit from precise target selection. By leveraging previously obtained information about user behaviors and activities, attackers can design landing pages that mimic familiar login portals. For example, a fraudulent login page for a popular password manager could be deployed using domains such as

secure-login.mypasswordsafe.com

, targeting users who have been identified as regular users of such services.

Related Terms

Understanding target selection in phishing involves familiarity with adjacent concepts like spear-phishing, which is the act of targeting a specific individual within an organization, often exploiting personal details to increase fidelity. Another related term is phishing pretext, where attackers develop a plausible story to persuade targets to interact with the phishing lure. A broad awareness of information gathering techniques, like open-source intelligence (OSINT), is also crucial as these methods are foundational to selecting and understanding the target.

References

For a deeper dive into how attackers select targets for phishing, refer to the insights shared in the SANS podcast on phishing. Furthermore, information on social engineering tactics can be explored in the Social-Engineer Toolkit, which provides a framework for simulating these attacks.