内部鱼叉式钓鱼是攻击者利用已控制的内部账户实施定向欺骗的高级社会工程攻击，通过伪造内部通信获取敏感信息或横向移动。与传统钓鱼不同，其利用组织内部信任关系，结合精准的情报收集和场景还原，大幅提升攻击成功率。防御措施主要包括实施内部邮件日志分析、部署多因素认证、以及开展安全意识培训等。
为规避内部通信监控和异常行为检测，攻击者发展出高度隐蔽的鱼叉式钓鱼技术。通过深度业务场景仿真和跨平台会话操控等手法，将恶意活动嵌入正常业务流程，在保持攻击效能的同时降低可检测性。
当前内部鱼叉式钓鱼的匿迹技术核心在于构建攻击行为的场景合理性与交互可信度。组织架构仿生钓鱼通过多维度业务特征还原，使钓鱼内容与真实工作流形成语义一致性；跨平台会话劫持则通过寄生合法数字工作空间，实现恶意行为的上下文隐藏。两类技术的共性在于突破传统协议层检测，转而攻击组织信任体系和社会工程学防线，通过精确的场景适配与多阶段攻击链设计，使安全系统难以通过孤立事件进行有效识别。
匿迹技术的演进导致传统基于发件人验证、附件扫描的防御体系逐渐失效。防御方需构建用户行为基线分析、跨平台会话关联检测等能力，结合零信任架构实施动态访问控制，并通过威胁狩猎主动识别潜伏在正常业务流程中的复合攻击链。
| 效应类型 | 是否存在 |
|---|---|
| 特征伪装 | ✅ |
| 行为透明 | ✅ |
| 数据遮蔽 | ❌ |
| 时空释痕 | ❌ |
攻击者通过精确还原组织内部通信规范，使钓鱼邮件在文件格式、语言风格、业务流程等方面与合法通信高度一致。例如使用真实项目编号的文档模板、模仿管理层邮件签名格式等，使得钓鱼内容在表面特征维度与正常业务文件无法区分。
利用零日漏洞或未公开的应用程序逻辑缺陷（如协作平台的API滥用），在无需触发常规安全告警的情况下实现会话劫持。攻击过程不依赖传统恶意代码特征，使得基于特征匹配的检测机制难以生效。
| ID | Name | Description |
|---|---|---|
| G0047 | Gamaredon Group |
Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.[1] |
| G1001 | HEXANE |
HEXANE has conducted internal spearphishing attacks against executives, HR, and IT personnel to gain information and access.[2] |
| G0094 | Kimsuky |
Kimsuky has sent internal spearphishing emails for lateral movement after stealing victim information.[3] |
| G0065 | Leviathan |
Leviathan has conducted internal spearphishing within the victim's environment for lateral movement.[4] |
| C0022 | Operation Dream Job |
During Operation Dream Job, Lazarus Group conducted internal spearphishing from within a compromised organization.[5] |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0015 | Application Log | Application Log Content |
Monitor email gateways usually do not scan internal email, but an organization can leverage the journaling-based solution which sends a copy of emails to a security service for offline analysis or incorporate service-integrated solutions using on-premise or API-based integrations to help detect internal spearphishing attacks.[6] |
| DS0029 | Network Traffic | Network Traffic Content |
Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)). |
| Network Traffic Flow |
Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. |