# data[].attributes.body
Social engineering is the practice of persuading others to provide sensitive information. The types of information sought by these criminals vary, but when people are targeted, the criminals are frequently attempting to deceive you into giving them your passwords or bank information, or accessing your computer to discreetly install dangerous software—giving them access to your passwords and bank information as well as control over your computer.
Criminals use social engineering strategies because it is typically simpler to take advantage of your inherent tendency to trust others than it is to figure out how to hack your program.

# data[].attributes.headline
Social Engineering and relation to cyber attacks

# data[].attributes.subject
Social Engineering and relation to cyber attacks

# data[].attributes.headline
Humans are the weakest link in Cyber Security (Social Engineering - The art of hacking humans)

# data[].attributes.subject
Humans are the weakest link in Cyber Security (Social Engineering - The art of hacking humans)

# data[].attributes.attachment_link.title
Social Engineering- The art of hacking humans | Prasad Sawant | TEDxElproIntlSchool

# data[].attributes.body
Knowing who and what to trust is the foundation of security. It's crucial to understand when to believe someone when they say they do and when to verify that the person you are speaking with is who they claim to be. The same is true of utilizing websites and engaging in online activities: when do you feel confident that the website you are accessing is reliable or secure enough for you to give personal information?

# data[].attributes.body
Social engineering is closely related to and entwined with nearly all cyberattacks. Many in the cybersecurity industry believe that social engineering plays a part in almost all cyberattacks.

# data[].attributes.body
Slow down- Spammers urge you to take action without thinking. Never let their sense of urgency influence your cautious analysis if the communication uses high-pressure sales tactics or portrays a sense of urgency.
Research the facts- Any unsolicited messages should raise suspicions. Make your own inquiries if the email appears to be coming from a business you deal with. To find the true company's website or phone number, use a search engine to navigate there.
Don’t let a link be in control of where you land- Stay in control by finding the website yourself using a search engine to be sure you land where you intend to land. Hovering over links in email will show the actual URL at the bottom, but a good fake can still steer you wrong.
Email hijacking is rampant- People's email accounts (as well as other communication accounts) being taken over by hackers, spammers, and social engineers has become commonplace. Once they have access to an email account, they abuse the contacts' confidence. If you aren't expecting an email with a link or attachment, check with your friend before opening any links or downloading anything, even if the sender seems to be someone you know.
Beware of any download- Downloading anything is a mistake if you don't know the sender personally AND anticipate receiving a file from them.
Foreign offers are fake- It is always a fraud if you receive an email asking you to send money from abroad to get a piece of the money, enter a foreign lottery or sweepstakes, or accept money from an unidentified family.

# data[].attributes.attachment_link.readable_text
A Lithuanian man whose business email compromise (BEC) scheme lifted over $100 million from Google and Facebook pleaded guilty to wire fraud last March 20. Evaldas Rimasauskas, aged 50, and unnamed collaborators essentially posed as a Taiwan-based hardware company that was a known business associate of both Facebook and Google. Their elaborate fraud first involved setting up a company in Latvia impersonating the hardware company. The group then sent fake invoices, contracts, letters and such to the tech companies, falsely billing them for millions of dollars over a period of years.

These documents were legitimate-looking enough that Google and Facebook wired money to accounts controlled by Rimasauskas from 2013 to 2015. He then reportedly laundered the money through banks in Latvia, Cyprus, Slovakia, Lithuania, Hungary and Hong Kong.

Rimasauskas agreed to forfeit $49.7 million, and his sentencing is scheduled for July 24. He could face up to 30 years in prison.

The year of messaging threats

The Trend Micro annual security roundup noted that BEC and other types of messaging threats were on the rise in 2018. However, BEC in particular has been on the radar of cybersecurity and government organizations for a while. The Federal Bureau of Investigation has been closely monitoring BEC scams, and their July 2018 report shows that this type of messaging fraud cost enterprises $12.5 billion since 2013. Moreover, Trend Micro data showed a 28% increase in BEC attempts (specifically those targeting CEOs) from 2017 to 2018.

BEC is commonly used because the scheme itself requires little technical knowledge - it involves the use of fake documents or social engineering to trick employees of a company to transfer funds to the scammer.

Thwarting BEC attacks

BEC detection is sometimes difficult, as forged documents are getting better and social engineering techniques get more sophisticated, but there are effective ways to curb the threat. BEC detection techniques featured in Trend Micro™ email security products use artificial intelligence (AI) and machine learning to defend against BEC.

Trend Micro™ Cloud App Security™ (CAS) for Microsoft® Office 365™and ScanMail™ Suite for Microsoft® Exchange™ (SMEX) use AI and ML to enhance overall cyberdefense against BEC, EAC, phishing, and other advanced threats. The anti-BEC technology found in Trend Micro™ email security products combines the knowledge of a security expert with a self-learning mathematical model to identify fake emails by looking at both behavioral factors and the email's intention.

Used by CAS and SMEX, the new Writing Style DNA feature uses AI to detect email impersonation by recognizing the DNA of a user's writing style based on past written emails and comparing it to suspected forgeries. When an email is suspected of spoofing a user, the writing style is compared to this trained AI model and a warning is sent to the implied sender, the recipient, and the IT department.

Besides advanced security solutions, following best practices against email fraud can also thwart BEC scammers.

# data[].attributes.attachment_link.title
Google and Facebook Fraudster Pleads Guilty to $100 million Scam

# data[].attributes.attachment_link.description
A Lithuanian man whose business email compromise (BEC) scheme lifted over $100 million from Google and Facebook pleaded guilty to wire fraud last March 20. Evaldas Rimasauskas, aged 50, and unnamed collaborators essentially posed as a Taiwan-based hardware company that was a known business associate of both Facebook and Google.

# data[].attributes.attachment_link.title
Nearly 470 people lose at least $8.5m in phishing scams involving OCBC Bank

# data[].attributes.attachment_link.description
Most of the amount was lost over the past two weeks, said the police. . Read more at straitstimes.com.

# data[].attributes.headline
Social Engineering majorly compromises the "Confidentiality" aspect of information or a system

# data[].attributes.subject
Social Engineering majorly compromises the "Confidentiality" aspect of information or a system

# data[].attributes.attachment_link.title
10 Ways Businesses Can Prevent Social Engineering Attacks | Indusface Blog

# data[].attributes.attachment_link.description
Checkout here “10 Ways Businesses Can Prevent Social Engineering Attacks”. Also You can explore more about the dangers of social engineering here.

# data[].attributes.attachment_link.title
Breaking into a Bank  - Kevin Mitnick demonstrates the Access Card Attack

# data[].attributes.headline
How do cyber attackers leverage social engineering to go after a target?

# data[].attributes.subject
How do cyber attackers leverage social engineering to go after a target?

# data[].attributes.body
Baiting- An attacker places a physical object that has been infected with malware in a location where it will be discovered, like a USB flash drive. When the target picks up the object and places it inside their computer, the malware is unintentionally installed.

Phishing- When a malicious attacker sends an email that looks authentic but is actually fraudulent and typically poses as coming from a reliable source. The goal of the message is to deceive the receiver into disclosing financial or personal information or clicking on a malicious link.

Spear Phishing- This is similar to phishing, except the attack is targeted at a particular person or business.

Vishing- Vishing, also referred to as voice phishing, is the practice of using social engineering to get financial or personal information from a target over the phone.

Whaling- Whaling attacks are a particular kind of phishing scam that target high-profile workers like the CEO or CFO in an effort to deceive the targeted employee into providing confidential information.

# data[].attributes.attachment_link.readable_text
What is social engineering?

Social engineering is an attack vector that relies heavily on human interaction and often involves manipulating people into breaking normal security procedures and best practices to gain unauthorized access to systems, networks or physical locations or for financial gain.

Threat actors use social engineering techniques to conceal their true identities and motives, presenting themselves as trusted individuals or information sources. The objective is to influence, manipulate or trick users into releasing sensitive information or access within an organization. Many social engineering exploits rely on people's willingness to be helpful or fear of punishment. For example, the attacker might pretend to be a co-worker who has some kind of urgent problem that requires access to additional network resources.

Social engineering is a popular tactic among attackers because it is often easier to exploit people than it is to find a network or software vulnerability. Hackers will often use social engineering tactics as a first step in a larger campaign to infiltrate a system or network and steal sensitive data or disperse malware.

Social engineering is an attack vector largely dependent on human interaction.

How does social engineering work?

Social engineers use a variety of tactics to perform attacks.

The first step in most social engineering attacks is for the attacker to perform research and reconnaissance on the target. If the target is an enterprise, for instance, the hacker may gather intelligence on the organizational structure, internal operations, common lingo used within the industry and possible business partners, among other information.

One common tactic of social engineers is to focus on the behaviors and patterns of employees who have low-level but initial access, such as a security guard or receptionist; attackers can scan social media profiles for personal information and study their behavior online and in person.

From there, the social engineer can design an attack based on the information collected and exploit the weakness uncovered during the reconnaissance phase.

If the attack is successful, the attacker gains access to confidential information, such as Social Security numbers and credit card or bank account information; makes money off the targets; or gains access to protected systems or networks.

Types of social engineering attacks

Popular types of social engineering attacks include the following techniques:

Baiting. An attacker leaves a malware-infected physical device, such as a Universal Serial Bus flash drive, in a place it is sure to be found. The target then picks up the device and inserts it into their computer, unintentionally installing the malware.

Phishing. When a malicious party sends a fraudulent email disguised as a legitimate email, often purporting to be from a trusted source. The message is meant to trick the recipient into sharing financial or personal information or clicking on a link that installs malware.

Spear phishing. This is like phishing, but the attack is tailored for a specific individual or organization.

Vishing. Also known as voice phishing, vishing involves the use of social engineering over the phone to gather financial or personal information from the target.

Whaling. A specific type of phishing attack, a whaling attack targets high-profile employees, such as the chief financial officer or chief executive officer, to trick the targeted employee into disclosing sensitive information.
These three types of phishing attacks fall under the wider umbrella of social engineering.

Pretexting. One party lies to another to gain access to privileged data. For example, a pretexting scam could involve an attacker who pretends to need financial or personal data to confirm the identity of the recipient.

Scareware. This involves tricking the victim into thinking their computer is infected with malware or has inadvertently downloaded illegal content. The attacker then offers the victim a solution that will fix the bogus problem; in reality, the victim is simply tricked into downloading and installing the attacker's malware.

Watering hole. The attacker attempts to compromise a specific group of people by infecting websites they are known to visit and trust with the goal of gaining network access.

Diversion theft. In this type of attack, social engineers trick a delivery or courier company into going to the wrong pickup or drop-off location, thus intercepting the transaction.

Quid pro quo. This is an attack in which the social engineer pretends to provide something in exchange for the target's information or assistance. For instance, a hacker calls a selection of random numbers within an organization and pretends to be a technical support specialist responding to a ticket. Eventually, the hacker will find someone with a legitimate tech issue whom they will then pretend to help. Through this interaction, the hacker can have the target type in the commands to launch malware or can collect password information.

Honey trap. In this attack, the social engineer pretends to be an attractive person to interact with a person online, fake an online relationship and gather sensitive information through that relationship.

Tailgating. Sometimes called piggybacking, tailgating is when a hacker walks into a secured building by following someone with an authorized access card. This attack presumes the person with legitimate access to the building is courteous enough to hold the door open for the person behind them, assuming they are allowed to be there.

Rogue security software. This is a type of malware that tricks targets into paying for the fake removal of malware.

Dumpster diving. This is a social engineering attack whereby a person searches a company's trash to find information, such as passwords or access codes written on sticky notes or scraps of paper, that could be used to infiltrate the organization's network.

Pharming. With this type of online fraud, a cybercriminal installs malicious code on a computer or server that automatically directs the user to a fake website, where the user may be tricked into providing personal information.

Dumpster diving is a type of social engineering attack.

Examples of social engineering attacks

Perhaps the most famous example of a social engineering attack comes from the legendary Trojan War in which the Greeks were able to sneak into the city of Troy and win the war by hiding inside a giant wooden horse that was presented to the Trojan army as a symbol of peace.

In more modern times, Frank Abagnale is considered one of the foremost experts in social engineering techniques. In the 1960s, he used various tactics to impersonate at least eight people, including an airline pilot, a doctor and a lawyer. Abagnale was also a check forger during this time. After his incarceration, he became a security consultant for the Federal Bureau of Investigation and started his own financial fraud consultancy. His experiences as a young con man were made famous in his best-selling book Catch Me If You Can and the movie adaptation from Oscar-winning director Steven Spielberg.

Once known as "the world's most wanted hacker," Kevin Mitnick persuaded a Motorola worker to give him the source code for the MicroTAC Ultra Lite, the company's new flip phone. It was 1992, and Mitnick, who was on the run from police, was living in Denver under an assumed name. At the time, he was concerned about being tracked by the federal government. To conceal his location from authorities, Mitnick used the source code to hack the Motorola MicroTAC Ultra Lite and then sought to change the phone's identifying data or turn off the ability for cellphone towers to connect to the phone.

To obtain the source code for the device, Mitnick called Motorola and was connected to the department working on it. He then convinced a Motorola employee that he was a colleague and persuaded that worker to send him the source code. Mitnick was ultimately arrested and served five years for hacking. Today, he is a multimillionaire and the author of a number of books on hacking and security. A sought-after speaker, Mitnick also runs cybersecurity company Mitnick Security.

A more recent example of a successful social engineering attack was the 2011 data breach of security company RSA. An attacker sent two different phishing emails over two days to small groups of RSA employees. The emails had the subject line "2011 Recruitment Plan" and contained an Excel file attachment. The spreadsheet contained malicious code that, once the file was opened, installed a backdoor through an Adobe Flash vulnerability. While it was never made clear exactly what information was stolen, if any, RSA's SecurID two-factor authentication ( 2FA) system was compromised, and the company spent approximately $66 million recovering from the attack.

In 2013, the Syrian Electronic Army was able to access the Associated Press' (AP) Twitter account by including a malicious link in a phishing email. The email was sent to AP employees under the guise of being from a fellow employee. The hackers then tweeted a fake news story from AP's account that said two explosions had gone off in the White House and then-President Barack Obama had been injured. This garnered such a significant reaction that the Dow Jones Industrial Average dropped 150 points in under 5 minutes.

Also in 2013, a phishing scam led to the massive data breach of Target. A phishing email was sent to a heating, ventilation and air conditioning subcontractor that was one of Target's business partners. The email contained the Citadel Trojan, which enabled attackers to penetrate Target's point-of-sale systems and steal the information of 40 million customer credit and debit cards. That same year, the U.S. Department of Labor was targeted by a watering hole attack, and its websites were infected with malware through a vulnerability in Internet Explorer that installed a remote access Trojan called Poison Ivy.

In 2015, cybercriminals gained access to the personal AOL email account of John Brennan, then the director of the Central Intelligence Agency. One of the hackers explained to media outlets how he used social engineering techniques to pose as a Verizon technician and request information about Brennan's account with Verizon. Once the hackers obtained Brennan's Verizon account details, they contacted AOL and used the information to correctly answer security questions for Brennan's email account.

Preventing social engineering

There are a number of strategies companies can take to prevent social engineering attacks, including the following:

Make sure information technology departments are regularly carrying out penetration testing that uses social engineering techniques. This will help administrators learn which types of users pose the most risk for specific types of attacks, while also identifying which employees require additional training.

Start a security awareness training program, which can go a long way toward preventing social engineering attacks. If users know what social engineering attacks look like, they will be less likely to become victims.

Implement secure email and web gateways to scan emails for malicious links and filter them out, thus reducing the likelihood that a staff member will click on one.

Keep antimalware and antivirus software up to date to help prevent malware in phishing emails from installing itself.

Stay up to date with software and firmware patches on endpoints.
Phishing, social engineering, password hygiene and secure remote work practices are essential cybersecurity training topics.

Keep track of staff members who handle sensitive information, and enable advanced authentication measures for them.

Implement 2FA to access key accounts, e.g., a confirmation code via text message or voice recognition.

Ensure employees don't reuse the same passwords for personal and work accounts. If a hacker perpetrating a social engineering attack gets the password for an employee's social media account, the hacker could also gain access to the employee's work accounts.

Implement spam filters to determine which emails are likely to be spam. A spam filter might have a blacklist of suspicious Internet Protocol addresses or sender IDs, or they might detect suspicious files or links, as well as analyze the content of emails to determine which may be fake.

Continue Reading About social engineering

# data[].attributes.attachment_link.description
Learn how attackers use social engineering to gain unauthorized access by manipulating people into breaking normal security procedures and best practices.

# data[].attributes.attachment_link.readable_text
An unusual case of CEO fraud used a deepfake audio, an artificial intelligence (AI)-generated audio, and was reported to have conned US$243,000 from a U.K.-based energy company. According to a report from the Wall Street Journal , in March, the fraudsters used a voice-generating AI software to mimic the voice of the chief executive of the company's Germany-based parent company to facilitate an illegal fund transfer.

The cybercriminals called the U.K. company's CEO pretending to be the CEO of the parent company. The attackers demanded that an urgent wire transfer be made to a Hungary-based supplier and the U.K. company's CEO was assured of a reimbursement. After the money had been transferred, it was forwarded to an account in Mexico and then other locations, making the identification of the fraudsters more difficult.

The fraudsters called the company a second time for another transfer, stating that the first payment had already been reimbursed. With the reimbursement not going through successfully, the U.K. company's CEO refused. On the third call, the fraudsters attempted to demand a followup payment. However, this call was already met with suspicion, especially since the call was made using an Austrian phone number.

Staying Safe From Social Engineering Scams Through Best Practices, Machine Learning-Powered Solutions

Deepfake audio fraud is a new cyberattack, further highlighting how AI can be abused by cybercriminals to make scams harder to detect. Despite newfound ways of siphoning money from companies, however, tried-and-tested ways such as phishing and business email compromise (BEC) remain top attack vectors businesses should be on the lookout for.

BEC scams continue to swindle large sums of money from businesses on a global scale. In fact, the Trend Micro midyear security roundup reported that BEC rose 52% from the second half of 2018. It has been recently reported that cybercriminals attempt to steal a whopping US$301 million per month via BEC scams .

To prevent companies from falling for BEC attacks, both company personnel and business partners must make a concerted effort to practice prudence as well as raise security awareness within the organization. These are some best practices to apply:

Fund transfer and payment requests, especially those that involve large amounts, should always be verified, preferably by contacting the supplier via a phone call and confirming the transaction. If possible, a secondary sign-off should also be done by someone higher up in the organization.

Look for red flags when it comes to business transactions. For example, a change in bank account information with no prior notice is a red flag and a possible sign of a BEC attempt.

BEC threat actors try to masquerade as a member of, or at least as an individual connected with, the organization. Employees should always scrutinize r eceived emails for any suspicious elements - for example, the use of unusual domains or changes in email signatures.

Furthermore, enterprises can also consider using a security technology designed to fight against BEC scams, such as Writing Style DNA, which is used by the Trend Micro™ Cloud App Security™ and ScanMail™ Suite for Microsoft® Exchange™ solutions. It can help detect email impersonation tactics used in BEC and similar scams. It uses AI to recognize the DNA of a user's writing style based on past emails and then compares it to suspected forgeries. The technology verifies the legitimacy of the email content's writing style through a machine learning model that contains the legitimate email sender's writing characteristics.

# data[].attributes.attachment_link.title
Unusual CEO Fraud via Deepfake Audio Steals US$243,000 From UK Company

# data[].attributes.attachment_link.description
An unusual case of CEO fraud used a deepfake audio, an artificial intelligence (AI)-generated audio, and was reported to have conned US$243,000 from a U.K.-based energy company. According to a report from the Wall Street Journal , in March, the fraudsters used a voice-generating AI software to mimic the voice of the chief executive of the company's Germany-based parent company to facilitate an illegal fund transfer.

# data[].attributes.attachment_link.title
Throwback Attack: How a single whaling email cost $61 million - Industrial Cybersecurity Pulse

# data[].attributes.attachment_link.description
A single phishing-style email cost Austria-based airplane component manufacturer FACC close to $61 million in a "fake president" scam.

# data[].attributes.attachment_link.title
This is how hackers hack you using simple social engineering

# data[].attributes.attachment_link.readable_text
What Happened?

A flaw within Google Drive was exploited to send out seemingly legitimate push notifications and emails from Google, If a Gmail user clicked on the "Open in Docs" button in the email, they were taken to a real Google-hosted page and asked to permit a seemingly legitimate service, called "Google Docs", to access their email account data.

Giving the permission allowed scammers to access the email account, contacts and online documents. The malware then emailed everyone in the victim's contacts list in order to spread itself.

Potential Consequences

The phishing scam itself is nothing new - which is to get you to click on a link within a message. The scariest part about this Google Docs scam is that the emails and notifications it generates come directly from Google. On mobile, the scam uses the collaboration feature in Google Drive to generate a notification inviting people to collaborate on a document. Google blocks millions of spam mail each day, but this message really catches people off-guard since the notification or email comes from Google itself.

To learn how to secure Google Drive read our guide here. Or if you'd like to use a similar alternative to Google Docs, we have a great list of secure Google Docs alternatives here.

How can I tell if an email from Google is legitimate?

Strange language, nonsense names and newly registered websites are a dead giveaway. People targeted by the Google Docs email scam receive Google Drive emails and notifications in Russian or broken English, asking them to collaborate with people with nonsense names. If you click on the link within these messages you'll be taken to a scam website which is usually registered only a few days before, and full of click bait about prize draws and giveaways.

You can report scam emails, and Google documents to the Google abuse team. To report abuse to Google about a document simply click 'Report abuse/copyright' from the 'Help' menu. To report a spam email to Google, click 'More' next to 'Reply' and then click 'Report phishing'.

Is the Google Docs Phishing Email Still Active?

Google has removed documents which were used in the Google Docs email scam, after they were reported by victims. We assume that the security flaw which allowed scammers to generate notifications from Google, has been fixed - but it's best to stay vigilant. Online scams have quadrupled since the pandemic and with most of us working from home scammers are finding incredibly clever ways to hide their tracks within phishing emails.

What Can You Do to Protect Yourself?

A closer look at the emails shared online offer some clues to help you distinguish phishing emails from legitimate emails.

The email appears to come from a genuine person in your contacts, and the subject line reads something along the lines of "[Your Friend] has shared a document on Google Docs with you."

Included on the string of recipients is an email address that begins in "hhhhhhhhhhhhhh" and ends in "mailinator.com." Mailinator is a website that lets visitors obtain a temporary and disposable email address.

In some cases, the suspicious Mailinator account appears in the email's BCC field.

If you get an email that fits the description above, delete it immediately. If you're concerned that your account might have been compromised, you can go to Google's account management page, select "Sign-In and Security", and then "Connected Apps." Look for "Manage Apps" and revoke access to untrusted apps.

Rule #1: To protect yourself from phishing attacks, never click on any email links and do not open any attachments unless you are positive that the email comes from a legitimate source. The best way to verify the source is pay close attention to the sender's address.

For added protection always use two factor authentication (2FA) on your accounts. When enabled, you'll need to answer a secret question, or use a fingerprint, as well as your password to get into your accounts. This is a great way of securing yourself if your passwords ever get stolen. One of the best ways to secure your data online is by using a VPN. With a single NordVPN account you can protect up to 6 devices from accessing potential phishing sites, and hide your online activity from trackers.

NordVPN also has the Threat Protection feature. It neutralizes cyber threats before they can do any real damage to your device. TP helps you identify malware-ridden files, stops you from landing on malicious websites, and blocks trackers and intrusive ads on the spot.

Online security starts with a click.

Stay safe with the world's leading VPN

# data[].attributes.attachment_link.title
Google Docs phishing scam: What you need to know

# data[].attributes.attachment_link.description
A flaw within Google Drive was exploited to send out seemingly legitimate push notifications and emails from Google, If a Gmail user clicked on the "Open in Docs" button in the email, they were taken to a real Google-hosted page and asked to permit a seemingly legitimate service, called "Google Docs", to access their email account data.