ある上級役員が、「2024年度年次業績レビュー」という件名の個人メールを受け取りました。メールにはダウンロード可能なPDFが含まれており、開くとバックドアがインストールされます。メールはCEOから送信されたように見せかけられ、会社のロゴも含まれています。これはどのフィッシング手法を最もよく表していますか?
正解:C
This scenario is a textbook example of a Whaling Attack, a highly targeted phishing technique described in the CEH v13 Social Engineering module. Whaling specifically targets senior executives or high-ranking individuals, exploiting their authority, access privileges, and decision-making roles.
In the given case, the attacker crafts a personalized email, impersonates the CEO, and uses legitimate corporate branding to build trust. The malicious PDF attachment delivers a backdoor, aligning with CEH v13 descriptions of advanced spear-phishing techniques used against executives.
CEH v13 differentiates whaling from other phishing types:
Broad phishing targets large groups indiscriminately.
Pharming redirects users via DNS manipulation.
Email clone attacks copy legitimate emails but typically target peers, not executives.
Whaling attacks are particularly dangerous because executives often bypass security scrutiny and possess elevated system access. CEH v13 emphasizes executive awareness training as a key mitigation strategy.
Therefore, the correct answer is Whaling attack aimed at high-ranking personnel.