# Spearphishing Spearphishing is the contemporary cybersecurity-attack-mechanism designating substantial-targeted-phishing attack substantially-organized around substantial-individual-target-personnel-research-and-substantial-customized-attack-content-construction. The substantial-mechanism substantially-distinguishes itself from substantial-broad-phishing substantial-attack-environments through substantial-target-individual-customization-and-substantial-target-individual-research-infrastructure-deployment. The framework matters for the KB substantially across multiple registers: 1. **Contemporary cybersecurity-attack-mechanism documentary anchor.** Spearphishing is one of the principal contemporary substantial-state-actor-cybersecurity-attack mechanisms. Tracking the framework is essential to engaging with broader contemporary American cybersecurity-attack-environment analytical-literature. 2. **Substantial Russian-state-actor cyber-tradecraft documentary anchor.** Substantial Russian-state-actor cyber-tradecraft infrastructure substantially-deploys spearphishing as principal attack-mechanism. Tracking the framework is essential to engaging with broader contemporary Russian-state-actor cyber-tradecraft analytical-literature. 3. **Substantial 2016 American election-environment substantial Russian-state-actor cyber-deployment documentary case.** Substantial 2016 American election-environment substantial Russian-state-actor cyber-deployment substantially-deployed spearphishing infrastructure against substantial [[Hillary Clinton]] presidential-campaign-organizational-personnel (substantial John Podesta substantial-spearphishing-attack substantial historical case-environment). Tracking the framework is essential to engaging with broader contemporary American 2016-election Russian-interference analytical-literature. ## Operational Mechanism **Substantial-target-research phase.** Substantial spearphishing operation substantially-organizes around substantial-individual-target-research substantially-collecting substantial target-personnel substantial-personal-and-professional-information. The substantial-research substantially-deploys substantial open-source-intelligence (OSINT) techniques across substantial public-records-and-online-presence infrastructure. **Substantial-customized-attack-content-construction phase.** Substantial spearphishing operation substantially-organizes around substantial-customized-attack-content-construction substantially-deploying substantial-target-personnel substantial-collected substantial-personal-and-professional-information. The substantial-customized-content substantially-includes substantial-target-personnel substantial-personally-recognizable-references, substantial-target-personnel substantial-context-appropriate communications-style, substantial-target-personnel substantial-organizational-context-appropriate communications-content. **Substantial-delivery-and-target-engagement phase.** Substantial spearphishing operation substantially-deploys substantial-customized-attack-content substantially-through substantial-email-or-substantial-messaging-platform infrastructure. The substantial-delivery substantially-organized around substantial-target-personnel substantial-engagement-and-substantial-credential-or-substantial-information-extraction infrastructure. **Substantial-credential-or-information-extraction phase.** Substantial-target-personnel substantial-engagement substantially-produces substantial-credential-or-substantial-information-extraction substantially-deployable for substantial subsequent substantial-account-compromise-and-substantial-organizational-access-and-substantial-information-extraction infrastructure-deployment. ## Documented Cases **Substantial 2016 John Podesta substantial-spearphishing-attack.** Substantial March 2016 substantial Russian-state-actor (substantial GRU Unit 26165 / "Fancy Bear" attribution) substantial-spearphishing-attack against substantial John Podesta substantial Hillary Clinton presidential-campaign-organizational chairman-personnel. The substantial-attack substantially-extracted substantial-Podesta-email-credential infrastructure substantially-deployable for subsequent substantial-WikiLeaks-publication of substantial Podesta-and-Clinton-campaign-internal-communications across substantial 2016 American election-environment. **Substantial 2016 Democratic National Committee (DNC) substantial-spearphishing-attack.** Substantial 2016 substantial Russian-state-actor substantial-spearphishing-attack against substantial DNC organizational-personnel. The substantial-attack substantially-extracted substantial DNC-internal-communications infrastructure substantially-deployable for subsequent substantial-WikiLeaks-publication of substantial DNC-internal-communications across substantial 2016 American election-environment. **Substantial contemporary state-actor cyber-tradecraft substantial-deployment.** Substantial contemporary state-actor cyber-tradecraft infrastructure substantially-deploys spearphishing across substantively-distinct state-actor-environments — Russian-state-actor, Chinese-state-actor, Iranian-state-actor, North-Korean-state-actor, and substantial adjacent state-actor cyber-tradecraft environments. ## Why It Matters for the KB **Contemporary cybersecurity-attack-mechanism documentary anchor.** Spearphishing is one of the principal contemporary substantial-state-actor-cybersecurity-attack mechanisms. Tracking the framework is essential to engaging with broader contemporary American cybersecurity-attack-environment analytical-literature. **Substantial Russian-state-actor cyber-tradecraft documentary anchor.** Substantial Russian-state-actor cyber-tradecraft infrastructure substantially-deploys spearphishing as principal attack-mechanism. Tracking the framework is essential to engaging with broader contemporary Russian-state-actor cyber-tradecraft analytical-literature. **Substantial 2016 American election-environment substantial Russian-state-actor cyber-deployment documentary case.** Substantial 2016 American election-environment substantial Russian-state-actor cyber-deployment substantially-deployed spearphishing infrastructure. Tracking the framework is essential to engaging with broader contemporary American 2016-election Russian-interference analytical-literature. ## See Also - [[Doxxing]] / [[Swatting]] — adjacent contemporary American online-harassment-and-attack mechanisms - [[Crossfire Hurricane]] — adjacent contemporary American 2016-election Russian-interference analytical-case - [[Surveillance State]] — adjacent contemporary American surveillance-state-infrastructure analytical-framework - [[Watering Hole]] — adjacent contemporary cybersecurity-attack-mechanism - [[Tradecraft]] — the broader intelligence-community-operational-vocabulary umbrella - [[Cambridge Analytica Scandal]] — adjacent contemporary American 2016-election interference analytical-case