Phishing Tactics Help Legitimate Pension Fund to Secure Meetings with Prospective Customers



Phishing Tactics Help Pension Fund Secure MeetingsSecurity researchers uncover a marketing campaign that takes a page from the cybercriminal phishing handbook to “trick” pensioners to have an introductory call with their fund expert.

You would think that an established business would send out solicitation emails using their own business name, domain, etc. and be up front about who they are. Whether the recipient has done business with the sender or not, etc.

In this interesting use case of phishing tactics, PERA LLC, based in Nevada right off the bat takes on a familiar acronym. If your retirement is being managed by one of the various Public Employees Retirement Association companies, and even feels like an brand impersonation attack on the long-standing pension fund company, Colorado PERA.

Targeting the employees of U.S. municipalities, PERA LLC impersonated the municipality itself (e.g., placing the municipality name in the email subject), making the opportunity to speak with someone about their retirement feel like it’s company-sanctioned:

eT7riGYZDjnMGqVusb6moAYcrJqrbK4Oe6SiHwW-AeZMXhqph4_B9NGyXfQL2ueAd1d56yEwPmaR-etq8HFtXMYbDrCnbaZP9ducP5I20AqLt5IdWEGqM7cIPXbpXp_A-UpAdVsJ

 

 

 

 

 

 

 

 

Source: PERA LLC

PERA LLC also used over 20 different PERA-related domain names to obfuscate who was really sending the email.

We’ve all seen items in the U.S. Mail attempting to appear “official” to obtain your business. But this is the first time I’ve heard about a company doing this using not just one, but many phishing tactics.

And while the end result here isn’t an infected environment or data being stolen, it’s important to teach users via Security Awareness Training on how to sport suspicious emails (even like this one) and realize they’re not legitimate.


Free Phishing Security Test

Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.

PST ResultsHere's how it works:

  • Immediately start your test for up to 100 users (no need to talk to anyone)
  • Select from 20+ languages and customize the phishing test template based on your environment
  • Choose the landing page your users see after they click
  • Show users which red flags they missed, or a 404 page
  • Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
  • See how your organization compares to others in your industry

Go Phishing Now!

PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser:

https://www.knowbe4.com/phishing-security-test-offer

Topics: Phishing

Subscribe To Our Blog


Cybersecurity Awareness Month Resource Kit




Get the latest about social engineering

Subscribe to CyberheistNews