Targeting the top: how cybercriminals are getting personal

Although the C‑suite can be a tough nut to crack, the poten­tial pay­outs from a suc­cess­ful whal­ing attack – one that tar­gets top-lev­el exec­u­tives — can make crack­ing it well worth a fraudster’s time.

In a world where almost every­one has a dig­i­tal pres­ence, cyber­crim­i­nals have all the resources at their dis­pos­al to get to know their mark — and the ram­i­fi­ca­tions can be dev­as­tat­ing for senior exec­u­tives caught in the crosshairs.

Accord­ing to the UK government’s Cyber Secu­ri­ty Breach­es Sur­vey, phish­ing con­sti­tutes the most com­mon cyber threat vec­tor for busi­ness­es, with 83% of the organ­i­sa­tions that spot­ted attacks reg­is­ter­ing this as the scammer’s cho­sen method. And with the wealth of infor­ma­tion that is shared pub­licly across var­i­ous online spaces, whal­ing attacks are becom­ing a seri­ous cause for con­cern.

Kraig Rut­land, VP for cyber secu­ri­ty at Aon’s Cyber Solu­tions, explains: “A lot of the time, senior exec­u­tives have an impor­tant pub­lic pro­file and dig­i­tal pres­ence. The evo­lu­tion of an individual’s dig­i­tal foot­print has accel­er­at­ed rapid­ly over the last decade with social media, online plat­forms and con­tent – not just per­son­al but pro­fes­sion­al­ly too.”

The moti­va­tion behind tac­ti­cal whal­ing attacks is almost always finan­cial, but the fall­out can be rep­u­ta­tion­al­ly and legal­ly dev­as­tat­ing. In one well-pub­li­cised instance, an Aus­tri­an aero­space man­u­fac­tur­er lost €50m from a tar­get­ed email attack which result­ed in the fir­ing of sev­er­al employ­ees, includ­ing the company’s CEO.

And pos­si­bly the most nefar­i­ous aspect of such whal­ing attacks is how attack­ers gain access. Fre­quent­ly, they exploit infor­ma­tion in the pub­lic domain – social media posts from friends and fam­i­ly, their hob­bies and inter­ests, or their loca­tion.

“They’re tar­get­ing down. One organ­i­sa­tion in the States was the vic­tim of a mas­sive ran­somware attack,” says Kate Kuehn, chief trust offi­cer at Aon. “When they did the foren­sics, they found out they got in through the CEO’s wife’s phone. He’d bor­rowed it and sent a few things over text when it was com­pro­mised. The attack put the com­pa­ny out of busi­ness,” she says. “The line between pub­lic and pri­vate is so blurred.”

Oth­er more deeply per­son­al pro­files can also be a source of rich data – but also poten­tial embar­rass­ment. “The infor­ma­tion on elite dat­ing sites is an area where attack­ers can manip­u­late data, and it’s exact­ly the sort of place you’d expect to find high-net-worth indi­vid­u­als,” says Kuehn.

These sites, among oth­ers, lay out an oppor­tu­ni­ty for crim­i­nals to build trust and con­vince tar­gets to invest larg­er and larg­er sums of mon­ey from cryp­to wal­lets or off­shore bank accounts.

The tools that attack­ers now have in their arse­nal pro­vide an acute abil­i­ty to repli­cate the sort of com­mu­ni­ca­tions senior exec­u­tives expect to see in their inbox­es, elim­i­nat­ing many of the usu­al red flags. AI chat­bot ser­vices, like Chat­G­PT, Bard and Claude, to name a few can be mis­used and become a fraudster’s friend, mak­ing it even eas­i­er to deliv­er fast, effec­tive, fre­quent attacks. Advanced nat­ur­al lan­guage tools can even offer scam­mers from out­side the Eng­lish-speak­ing world new lev­els of nat­ur­al lan­guage flu­en­cy in their com­mu­ni­ca­tions.

And the expand­ing use of AI makes it like­ly that there will be far more sophis­ti­cat­ed social engi­neer­ing attacks in the future as it becomes chal­leng­ing to dis­tin­guish between gen­uine and fraud­u­lent com­mu­ni­ca­tions. Some tools can detect the use of AI, but these are still play­ing catch-up while deep­fake tech­nolo­gies and AI chat­bots get more sophis­ti­cat­ed.

Rut­land believes that recog­nis­ing the risks posed to indi­vid­ual exec­u­tives along­side the fun­da­men­tal cyber threats fac­ing organ­i­sa­tions is an impor­tant mea­sure. “We have to go back to under­stand­ing the risks and find new ways to mit­i­gate them as the land­scape con­tin­ues to evolve,” he says. “Exec­u­tives will need to be more con­scious than ever about the infor­ma­tion they put out there. When they get an email that might seem like an obvi­ous request, con­sid­er a self-check built into the sys­tem: Am I expect­ing this? Should I be respond­ing? How did that infor­ma­tion get in there, and is there a way to val­i­date this?”

The assort­ment of vul­ner­a­bil­i­ties hack­ers can exploit, from fam­i­ly and friends to asso­ciates, can see busi­ness­es engag­ing in a high-stakes game of whack-a-mole. But there are ways to plug the gaps.

Assess­ment is the first port of call. It’s vital to under­stand the threats you are most vul­ner­a­ble to and what you can do to bet­ter pro­tect your­self against them. Senior exec­u­tives can start by under­stand­ing their own lev­el of expo­sure. Aon deliv­ers tai­lored indi­vid­ual vul­ner­a­bil­i­ty assess­ments, or IVAs, as part of its cyber loop risk man­age­ment mod­el.

This gives exec­u­tives vis­i­bil­i­ty over threat expo­sures. They can then use this data to dri­ve the deci­sion-mak­ing required to man­age their own dig­i­tal foot­print. A sim­i­lar approach can be tak­en for their organ­i­sa­tions. A com­pre­hen­sive cyber risk assess­ment can be per­formed to deter­mine risks, threats and finan­cial expo­sures, which in turn helps busi­ness­es to pri­ori­tise mit­i­ga­tion mea­sures and bud­gets to bet­ter max­imise cyber resilience.

It’s vital to be com­pre­hen­sive in assess­ing risk, accord­ing to Rut­land. “There is a busi­ness risk, oper­a­tional risk, finan­cial risk, rep­u­ta­tion­al risk, and even sup­ply chain risk. Cyber now lives in all those tow­ers, so an organ­i­sa­tion must con­stant­ly be assess­ing and under­stand­ing its cyber matu­ri­ty and using this insight to make data-dri­ven deci­sions on how to man­age accord­ing­ly,” he says.

Aon’s cyber loop mod­el for sus­tained cyber resilience iden­ti­fies four entry points. Rut­land explains: “These points aren’t lin­ear, and organ­i­sa­tions can enter at any stage: you may enter at a time of recov­ery, or finan­cial trans­fer, for exam­ple, which leads to fur­ther need to assess cyber risk. Mit­i­ga­tion is under­stand­ing where there might be a con­trol gap and clos­ing it through peo­ple, process­es or tech­nol­o­gy,” he explains. “You can move from assess­ment to trans­fer or recov­ery to mit­i­ga­tion or any num­ber of com­bi­na­tions. What is impor­tant is that man­ag­ing cyber risk is not a sin­gle point in time activ­i­ty. It is a cir­cu­lar process and needs to be con­tin­u­ous­ly reviewed.”

The sheer num­ber of ways organ­i­sa­tions and indi­vid­u­als can be exposed to cyber risks might seem daunt­ing, but it needn’t be despair­ing. Busi­ness­es can estab­lish a cul­ture of vig­i­lance and pre­pared­ness that puts them on the path to sus­tained cyber resilience.

“It has to be in con­stant deploy­ment all the time,” says Kuehn. “Cyber is always chang­ing. It’s a nev­er-end­ing jour­ney, and there’s always going to be inno­va­tion that we have to think about.”

For more infor­ma­tion vis­it aon.com/cyberloop

Although the C-suite can be a tough nut to crack, the potential payouts from a successful whaling attack – one that targets top-level executives - can make cracking it well worth a fraudster’s time.

In a world where almost everyone has a digital presence, cybercriminals have all the resources at their disposal to get to know their mark - and the ramifications can be devastating for senior executives caught in the crosshairs.

According to the UK government’s Cyber Security Breaches Survey, phishing constitutes the most common cyber threat vector for businesses, with 83% of the organisations that spotted attacks registering this as the scammer’s chosen method. And with the wealth of information that is shared publicly across various online spaces, whaling attacks are becoming a serious cause for concern.