What type of network attack involves an attacker creating a malicious email that appears to come from a legitimate source to trick recipients into…

The attack described is a form of social engineering known as phishing. The attacker sends a fraudulent email that appears to be from a trusted source to deceive the recipient. The goal is to trick the user into revealing sensitive information (e.g., credentials, financial details) or executing malicious code by clicking a link or opening an attachment. Spear phishing is a highly targeted version of this attack, often customized for a specific individual, organization, or group to increase its perceived legitimacy and success rate. Among the options provided, this is the most accurate description of the attack.

A. Distributed Denial-of-Service Attack: This attack focuses on overwhelming a target system with traffic to make it unavailable, not on deceiving users via email for information theft.

B. Man-in-the-Middle Attack: This involves an attacker secretly intercepting and relaying communications between two parties, rather than sending a deceptive email directly to a victim.

C. Cross-Site Scripting Attack: This is a web application vulnerability where malicious scripts are injected into trusted websites; it is not an email-based social engineering attack.

1. National Institute of Standards and Technology (NIST). (2017). Special Publication 800-63-3: Digital Identity Guidelines. Appendix A

A.2 Definitions. "Phishing: A technique for attempting to acquire sensitive information... through a fraudulent solicitation in email or on a web site

in which the perpetrator masquerades as a legitimate business or reputable person."

2. National Institute of Standards and Technology (NIST). (2015). Special Publication 800-82 Rev. 2: Guide to Industrial Control Systems (ICS) Security. Section 3.3.3

Social Engineering. "Phishing is a form of social engineering that uses email or malicious websites... to solicit personal information... by posing as a trustworthy organization or entity. A spear phishing attack is a targeted phishing attack..."

3. Warner

J. (2012). Understanding phishing and its impact on organizations. SANS Institute InfoSec Reading Room. Page 4. "Spear phishing is a targeted attack against a specific company

organization

or even an individual."

4. Hale

C.

& Heartfield

R. (2020). A Thematic Analysis of Human Elicitation Techniques in Social Engineering. In Proceedings of the 15th International Conference on Availability

Reliability and Security (ARES '20). Association for Computing Machinery

New York

NY

USA

Article 58

1–10. https://doi.org/10.1145/3407023.3407081 (The paper discusses phishing and spear phishing as primary social engineering techniques used for information elicitation).