Spear phishing data set

Question

Are there any existing data sets of spear phishing emails available?

I've found a bunch of data sets of phishing emails, but that's not what I'm looking for. I'm not looking for mass phishing campaigns. Rather, I'm interested in spear phishing: targeted social engineering emails. I've checked phishing archives, like Phishtank, but haven't found any that have separated out the ones that are targeted. My goal is to study what real spear phishing emails, as observed in the wild, look like.

Answer 1

I don't think you will find a data set with the original mails, since they are usually too sensitive. But you will find lots of indicators how these mails look like or what they contain in the various reports:

• The APT28 report by Mandiant documents use of Excel documents with back door and use of links with domain names visually similar to trusted domains.
• A report from Usenix 2014 A Look at Targeted Attacks Through the Lense of an NGO researches the use of spear-phishing mails against NGO's in Asia and gets some insight into the techniques used.
• The analysis of Careto by Kaspersky also has some details about the used spear-phishing mails, like that they don't contain the exploit but instead use links which look like trusted links.
• A report by ArborNetworks documents spear-phishing mails with various attachments (7z, rar, exe..) and which use left-to-right-override or Icons in exe to hide the real file type.
• The use of CVE-2014-4114 RCE in spear-phishing mails was documented by TrendMicro and others.
• Using Decoy documents in spear-phishing mails in the Siesta Campaign.

From looking at these reports I would say they are not that different from the normal phishing mails, which got already very sophisticated. The main difference is that spear-phishing is more targeted. That means it has less recipients, has more content which should be relevant to the recipients and might make more use of unknown exploits to evade detection.

Answer 2

The Targeted Email Attacks tumblr page lists a collection of examples of targeted, malicious emails. Many of them are not necessarily phishing, but some are.