Phishing Trends
ISITPHISHING.AI
JPAAWG, Tokyo, November 8th 2018

Olivier LEMARIECTO

Phishing Trends Overview• Rise of credential phishing attacks• Gaining access to a treasure trove ofconfidential files, financial data, contacts,..

• Compromised accounts to fuel additionalattacks• Sending Emails but also to conduct spear
phishing, or other insider attacks• High level of sophistication• Defeating traditional layers of protection• Industrialization of Phishing• With significant financial capacity

Phishing Trends©2018 – Vade SecureTrend : Phishing Targeting Businesses

Source : Vade Secure Phisher’s Favorites Report Q3 2018

Phishing Trends

Source : IsItPhishing.AI©2018 – Vade Secure

Can you “still” spot the real Office 365 login page ?

Phishing Trends©2018 – Vade Secure

Can you “still” spot the real Office 365 login page ?

Trend: Higher Content Quality to Drive Phishing EffectivenessPhishing Trends©2018 – Vade SecureTrend : Combining Technics to Defeat Traditional Layers of Protection
EmailSource
From
DomainStatic IPs

SpecificDomain

Botnets

HackedDomains

Public Cloud /Snow Shoe

Legit Sources(compromisedaccounts)

IP Reputation
based systems

Well known
Brand Domains

DomainHomographic / Confusable reputation, DKIM
Domains/ DMARC,..
Content filtering,
Signatures,Fingerprints..

EmailContent

StaticBody Random
Obfuscation

Templating Legit
Brand Content

Small Payload (URL)or just an image

URL
Link

StaticParameters
Randomization& Encoding

URL Shorteners& Redirections

Via Legit Sites andSmart URL Redirection

URL blacklists &CentralizedcrawlingLanding
Page

StaticFrequent
Randomization/ Rotations

Very close to Legit
Brand Content

Dynamic & DistributedContent

HTML signature
based analysis &humans..

Phishing Trends©2018 – Vade Secure

Example: Targeted credential phishing attack (Oct 2018)

Compromised
Accounts

SmallDynamicContent Targeting one large  Every email different
in structure andISPpayload
 More than 150,000
 Several legit urls
compromised 1 phishing URL
accounts(never the same) 10 minutes cycles
 Below thresholdvolumesSmart URL
Redirection

Smart landing
phishing page

Auto detectionof blocking
FBL Variety of redirection  Serving content only  Thousands of canarytechnics (shorteners,for few minutes
accounts
tracking..) And not at time of Instant detection of Rotation out ofemail delivery
blocking and25,000 domains
rotation
specifically registeredfor the attack (2months before)
Phishing Trends©2018 – Vade Secure

AI To Address New Challenges• Not replacing but complementing
existing filtering layers• Allowing the detection to happen
from the first email• Processing massive amount of data inrealtime• Expertise driven approach• Prediction Models build out offeatures extracted from source,
content & context of the emails.
• Moving towards predictive models

IsItPhishing.AI©2018 – Vade SecureMachine Learning Predictive Models for Phishing• Models for Phishing detection integrated in our IsItPhishing.AI platform• Analysis of urls and documents in real time at time of click• Selected 47 features to drive for effectivenessSupport Vector Machine

Recursive Feature Elimination Algorithm# features / Accuracy
1Random Forest

0.9
0.8
0.7

•

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 35 37 39 41 43 45 47 49 51 53 55 57 59 61 63 65 67 69 71

2 others areas of focus in roadmap :• Computer Vision / Phishing Brand detection• Targeted Attacks Detection
IsItPhishing.AI

Accuracy©2018 – Vade SecureMachine Learning Models for Spear Phishing
Example: CEO Fraud / Business Email Compromise( BEC)
I need you to arrange a transfer of $140,000 to a supplier today.
It is for an acquisition that we have been trading privately fora few weeks and the supplier has accepted our payment terms of 10% down payment. Let me know if you can do it immediately, I cansend you the bank details.

• Highly damaging• Using Employee impersonation• Extremely rare
• Often text based only• Anomaly detection FP rate can be high• Natural Language Processing (NLP)
requires a lot of tuning• Classification / Machine Learning
requires quantitative and qualitative
data
IsItPhishing.AI©2018 – Vade Secure

Data Augmentation Technics• Presented at MAAWG NYC last month• Enrich a dataset used to construct models• Synonyms Replacement, Mispelling, Name
Replacement, Amount transformation,
Language Translation,..

• Ensure quality of augmented data

• Semantic similarity, Syntactic similarity
Example on CEO Fraud : English -> French -> Spanish -> EnglishHi,I need you to arrange a transfer of $140,000
to a supplier today. It is for an acquisition
that we have been trading privately for a few
weeks and the supplier has accepted ourpayment terms of 10 % down payment. Let meknow if you can do it immediately, I can send
you the bank details.
Thank you.
Sincerely
Sandy
IsItPhishing.AI

Hello, I'll need you to arrange a transferof 136,700 € to a vendor today. This isfor an acquisition that we have been
negotiating privately for some weeks andthe vendor agreed to our payment terms of10% down payment. Let me know if you canget this done immediately, I can forward
you the bank details.
Thanks.
Best regards
Irene©2018 – Vade SecureThank You