Whaling and Targeted Attacks in Social Engineering
An experienced cyber attacker has created a fake LinkedIn profile, successfully impersonating a high-ranking official from a well-established company, to execute a social engineering attack. The attacker then connected with other employees within the organization, receiving invitations to exclusive corporate events and gaining access to proprietary project details shared within the network. What advanced social engineering technique has the attacker primarily used to exploit the system and what is the most likely immediate threat to the organization?
Community Votes
58% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The scenario tests the distinction between broad phishing/whaling targets and pretexting methods, with the trap being the misidentification of 'impersonating an executive' as pretexting rather than whaling.
This question examines the use of whaling, a form of targeted social engineering where attackers impersonate high-ranking officials. It establishes that such impersonation on professional networks leads to targeted attacks compromising proprietary data.
Many learners select B (Pretexting) because they focus on the act of impersonation itself, overlooking that 'Whaling' is the specific term for targeting or impersonating C-level executives to gain high-value access.
Community Discussion (16 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The attacker impersonated a 'high-ranking official' to gain credibility and access to exclusive corporate events and proprietary details. This specific tactic of targeting or mimicking top-tier executives (C-suite) is known as Whaling, which is a subset of targeted attacks. The immediate threat is the compromise of sensitive intellectual property through these targeted interactions.Why the Other Options Are Wrong
Option B (Pretexting) involves creating a fabricated scenario to engage a victim, but while impersonation is a form of pretexting, the specific context of 'high-ranking official' points directly to Whaling in CEH terminology. Option C (Spear Phishing) typically involves email-based attacks, whereas this scenario relies on LinkedIn networking. Option D (Baiting) involves offering something enticing, like a USB drive, which does not fit this profile.Community Comment Notes
Several users pointed out that the key phrase 'high-ranking official' signals Whaling. One user noted, 'Impersonation of a high-ranking official... typical tactic in whaling attacks.' Another highlighted that the attacker gained 'access to proprietary project details,' confirming the targeted nature of the attack.Exam Strategy
Always look for keywords indicating the target's seniority. When 'CEO', 'CFO', or 'high-ranking official' appears, consider Whaling over general Phishing or Pretexting, especially if the goal is high-value information access.
Frequently Asked Questions
Is impersonating an executive always Whaling?
In CEH contexts, yes. Whaling specifically refers to targeting or impersonating C-level executives to extract high-value information.
Why isn't this Spear Phishing?
Spear Phishing usually implies direct communication like email. Here, the attacker built a relationship via LinkedIn connections, fitting the broader 'Targeted Attack' model of Whaling.