Classification of Attack Types and Analysis of Attack Methods for Profiling Phishing Mail Attack Groups

Abstract

In recent years, there has been an increase in the number of phishing attacks targeting people in the fields of defense, security, and diplomacy around the world. In particular, hacking attack group Kimsuky has been conducting phishing attacks to collect key information from public institutions since 2013. The main feature of the attack techniques used by the Kimsuky attack group are to conceal malicious code in phishing e-mails disguised as normal e-mails to spread a document file that is vulnerable to security, such as a Hangul file, or to induce interest through a social engineering attack technique to collect account information. This study classified the types of phishing e-mail attacks into spoofed e-mails, e-mail body vulnerability use, and attached file spoofing, and detailed analyses of their attack methods, such as commonality and characteristic analyses, were performed to analyze the profile of this phishing e-mail attack group. Based on the results, the purpose of the attacking group was determined to be intelligence gathering because it focused on phishing attacks targeting Korean diplomatic and defense public institutions and related foreign institutions. Finally, a countermeasure that can be used by mail service providers and mail users to respond to phishing e-mails is suggested.

Phishing - Unvielling Its Techniques

“…choose not to engage in protective behaviors against email phishing because they perceive there are advantages to not doing so and they weigh the associated costs of protective measures. [4] Phishing attacks target private information such as financial details by pretending to be trustworthy online sources, taking advantage of users' trust and lack of internet security. The goal of various phishing techniques, like deceptive and malwarebased phishing, is to trick users into sharing personal, financial, or password data through social engineering tactics, underscoring the importance of detection systems in fighting these risks.…”

“…These dangers aim at a range of industries including healthcare, government, military, finance, entertainment, and businesses, resulting in financial losses, data breaches, and societal consequences. [2]Phishing attacks often rely on social engineering tactics to manipulate victim into actions that compromise security. Researchers have developed various anti-phishing methods in recent years and still other methods are being developed.…”

Identifying Vulnerabilities and Reducing Cyber Risks and Attacks Using a Cyber Security Lab Environment

“…Hossein Abroshan et al [20] in their paper has discussed about how the Phishing attacks have taken place during the pandemic and the co-relation of human emotions and behaviour with the success of phishing attempts during the pandemic. The phishing attack and its types where explained in detail by Jaeil Lee et al [19]. The detailed analysis was conducted on the attack methods and observations where deduced from these analysis.…”

Design of Automated Website Phishing Detection using Sequential Mechanism of RCL Algorithm

“…Hence, it becomes difficult and challenging for the software professionals in detecting phishing outbreaks effectively. In 2018, a group called Kimsuky in Korea involved in phishing and their target was not just the finance but also the Korean security associated foreign institutions, defence, and diplomatic data [1]. In the pandemic year, COVID-19 attackers have raised their attention to target the vulnerable victim by applying various tricks based on human fear, anxiety, and stress factors.…”

“…In the pandemic year, COVID-19 attackers have raised their attention to target the vulnerable victim by applying various tricks based on human fear, anxiety, and stress factors. They used a lot of tricks to make them explore by sending similar emails from WHO and Health care centers to make the people more vulnerable [1] [2]. Spear fishing is more targeted at open-source intelligence.…”