# data[].attributes.headline
What can we do to help prevent attackers from leveraging social engineering for their own benefit?

# data[].attributes.subject
What can we do to help prevent attackers from leveraging social engineering for their own benefit?

# data[].attributes.body
Delete any request for financial information or passwords. If you get asked to reply to a message with personal information, it’s a scam.

Reject requests for help or offers of help. Legitimate companies and organizations do not contact you to provide help. If you did not specifically request assistance from the sender, consider any offer to ’help’ restore credit scores, refinance a home, answer your question, etc., a scam. Similarly, if you receive a request for help from a charity or organization that you do not have a relationship with, delete it. To give, seek out reputable charitable organizations on your own to avoid falling for a scam.

Set your spam filters to high. Every email program has spam filters. To find yours, look at your settings options, and set these to high–just remember to check your spam folder periodically to see if legitimate email has been accidentally trapped there. You can also search for a step-by-step guide to setting your spam filters by searching on the name of your email provider plus the phrase ’spam filters’.

Secure your computing devices. Install anti-virus software, firewalls, email filters and keep these up-to-date. Set your operating system to automatically update, and if your smartphone doesn’t automatically update, manually update it whenever you receive a notice to do so.  Use an anti-phishing tool offered by your web browser or third party to alert you to risks.

# data[].attributes.headline
$100 Million Google and Facebook Spear Phishing Scam

# data[].attributes.subject
$100 Million Google and Facebook Spear Phishing Scam

# data[].attributes.attachment_link.title
Facebook and Google were victims of an elaborate cyber crime

# data[].attributes.attachment_link.description
Facebook and Google were the victims of an elaborate $100 million cyber crime, according to a Fortune report.

# data[].attributes.headline
$60 Million CEO Fraud Lands CEO In Court

# data[].attributes.subject
$60 Million CEO Fraud Lands CEO In Court

# data[].attributes.attachment_link.readable_text
The co-founders of San Francisco-based private medical testing company uBiome Inc. have been charged by the US Securities and Exchange Commission (SEC) and indicted by a federal grand jury for allegedly defrauding investors out of $60 million.

According to the SEC's complaint, uBiome CEO Jessica Richman and Chief Scientific Officer Zachary Apte allegedly falsely portrayed their company as a successful startup with a strong track record of receiving health insurance reimbursement for its clinical tests, which purportedly could detect microorganisms and assist in diagnosing diseases.

"uBiome's purported success in generating revenue, however, was a sham," the SEC said in its complaint. "It depended on duping doctors into ordering unnecessary tests and other improper practices that Richman and Apte directed and which, once discovered, led insurers to claw back their previous reimbursement payments to uBiome."

The complaint alleges that although uBiome employees raised concerns regarding the company's practices, Richman and Apte failed to take action to fix the improper practices and failed to disclose those practices to investors. They also allegedly tried to hide their wrongdoing from uBiome's general counsel, board of directors, and insurers, which included instructing employees to provide insurers with backdated and misleading medical records to substantiate the claims for reimbursement.

Richman and Apte's scam unraveled in April 2019 when the company's board of directors initiated an internal investigation after the FBI executed a search warrant at uBiome's San Francisco headquarters. The investigation "brought uBiome's improper billing practices to light and made clear that uBiome's business model was untenable," according to the complaint. uBiome then suspended its clinical tests business, and in September 2019 ceased operations and filed for bankruptcy protection. It is currently undergoing Chapter 7 bankruptcy liquidation.

The complaint, which was filed in federal court in San Francisco, charges Richman and Apte with violating the antifraud provisions of the federal securities laws. The SEC is seeking officer and director bars to prevent Richman and Apte from engaging in future fraud, as well as orders requiring them to disgorge their ill-gotten gains and pay civil penalties.

"We allege that Richman and Apte touted uBiome as a successful and fast-growing biotech pioneer while hiding the fact that the company's purported success depended on deceit," said Erin Schneider, director of the SEC's San Francisco Regional Office, in a statement.

In a parallel action, a federal grand jury handed down an indictment charging Richman and Apte with multiple federal crimes including conspiracy to commit securities fraud, conspiracy to commit health care fraud, money laundering, and related offenses in connection with their alleged scam.

The indictment describes how Richman and Apte ended up employing several fraudulent practices with respect to the firm's clinical tests. Specifically, they allegedly developed, implemented, and oversaw practices designed to deceive approving health care providers and reimbursing insurance providers regarding tests that were not validated and that were not medically necessary.

"The indictment alleges defendants bilked insurance providers with fraudulent reimbursement requests," Stephanie Hinds, acting US Attorney for the Northern District of California, said in a statement. "Further, defendants cashed out on the investment that flowed into the company to benefit themselves."

Related Stories:
SEC Charges Biotech Head with Using Pandemic to Defraud Investors CEO Charged in Rapid COVID-19 Test Scam SEC, SDNY Charge Seismic Data Firm in $100 Million Accounting Fraud
Tags: health care fraud, Jessica Richman, medical testing, Money Laundering, Northern District of California, SEC, Securities Fraud, uBiome, Zachary Apte

# data[].attributes.attachment_link.title
SEC Charges Biotech Co-Founders with $60 Million Fraud | Chief Investment Officer

# data[].attributes.attachment_link.description
uBiome's CEO and chief scientific officer were also indicted by a federal grand jury.

# data[].attributes.attachment_link.readable_text
An unusual case of CEO fraud used a deepfake audio, an artificial intelligence (AI)-generated audio, and was reported to have conned US$243,000 from a U.K.-based energy company. According to a report from the Wall Street Journal , in March, the fraudsters used a voice-generating AI software to mimic the voice of the chief executive of the company's Germany-based parent company to facilitate an illegal fund transfer.

The cybercriminals called the U.K. company's CEO pretending to be the CEO of the parent company. The attackers demanded that an urgent wire transfer be made to a Hungary-based supplier and the U.K. company's CEO was assured of a reimbursement. After the money had been transferred, it was forwarded to an account in Mexico and then other locations, making the identification of the fraudsters more difficult.

The fraudsters called the company a second time for another transfer, stating that the first payment had already been reimbursed. With the reimbursement not going through successfully, the U.K. company's CEO refused. On the third call, the fraudsters attempted to demand a followup payment. However, this call was already met with suspicion, especially since the call was made using an Austrian phone number.

Staying Safe From Social Engineering Scams Through Best Practices, Machine Learning-Powered Solutions

Deepfake audio fraud is a new cyberattack, further highlighting how AI can be abused by cybercriminals to make scams harder to detect. Despite newfound ways of siphoning money from companies, however, tried-and-tested ways such as phishing and business email compromise (BEC) remain top attack vectors businesses should be on the lookout for.

BEC scams continue to swindle large sums of money from businesses on a global scale. In fact, the Trend Micro midyear security roundup reported that BEC rose 52% from the second half of 2018. It has been recently reported that cybercriminals attempt to steal a whopping US$301 million per month via BEC scams .

To prevent companies from falling for BEC attacks, both company personnel and business partners must make a concerted effort to practice prudence as well as raise security awareness within the organization. These are some best practices to apply:

Fund transfer and payment requests, especially those that involve large amounts, should always be verified, preferably by contacting the supplier via a phone call and confirming the transaction. If possible, a secondary sign-off should also be done by someone higher up in the organization.

Look for red flags when it comes to business transactions. For example, a change in bank account information with no prior notice is a red flag and a possible sign of a BEC attempt.

BEC threat actors try to masquerade as a member of, or at least as an individual connected with, the organization. Employees should always scrutinize r eceived emails for any suspicious elements - for example, the use of unusual domains or changes in email signatures.

Furthermore, enterprises can also consider using a security technology designed to fight against BEC scams, such as Writing Style DNA, which is used by the Trend Micro™ Cloud App Security™ and ScanMail™ Suite for Microsoft® Exchange™ solutions. It can help detect email impersonation tactics used in BEC and similar scams. It uses AI to recognize the DNA of a user's writing style based on past emails and then compares it to suspected forgeries. The technology verifies the legitimacy of the email content's writing style through a machine learning model that contains the legitimate email sender's writing characteristics.

# data[].attributes.attachment_link.title
Unusual CEO Fraud via Deepfake Audio Steals US$243,000 From UK Company

# data[].attributes.attachment_link.description
An unusual case of CEO fraud used a deepfake audio, an artificial intelligence (AI)-generated audio, and was reported to have conned US$243,000 from a U.K.-based energy company. According to a report from the Wall Street Journal , in March, the fraudsters used a voice-generating AI software to mimic the voice of the chief executive of the company's Germany-based parent company to facilitate an illegal fund transfer.

# data[].attributes.headline
Ransomware gang hijacks victim’s email account

# data[].attributes.subject
Ransomware gang hijacks victim’s email account

# data[].attributes.attachment_link.title
Your Data Belongs to the Void | Cyber Protection Operation Center News

# data[].attributes.headline
$100 Million Google and Facebook Spear Phishing Scam

# data[].attributes.subject
$100 Million Google and Facebook Spear Phishing Scam

# data[].attributes.attachment_link.title
How this scammer used phishing emails to steal over $100 million from Google and Facebook

# data[].attributes.attachment_link.description
A 50-year-old Lithuanian man faces up to 30 years in prison after pleading guilty to an email scheme that bilked tech giants Facebook and Google out of more than $100 million.

# data[].attributes.headline
Use the record video feature in Padlet A & B explain what Social Engineering means. Also answer: How does the social engineering piece intertwine with the technical aspect of cyber attacks

# data[].attributes.subject
Use the record video feature in Padlet A & B explain what Social Engineering means. Also answer: How does the social engineering piece intertwine with the technical aspect of cyber attacks

# data[].attributes.headline
Most common ways social engineering affects cybersecurity

# data[].attributes.subject
Most common ways social engineering affects cybersecurity

# data[].attributes.body
Popular Social Engineering Attacks

-> Phishing Attacks

Phishing attackers will pretend as a trustworthy organization or individual in order to force you to reveal personal information. This method involves sending spoof emails, phone calls, or SMS randomly to a large number of people requesting them to provide their confidential information. To trick people into giving up passwords and other personal details, their communication will appear to come from a legitimate organization. Whether it’s a direct communication or via a fake website form, anything you share goes directly into a scammer’s pocket.

-> Spear Phishing

This is a more focused variant of the phishing scam, in which the attacker targets particular people or companies. They then do a background study and customize their messages based on the characteristics, job titles, and contacts of their victims in order to build trust and make their attack less transparent.

-> Scareware

Scareware is a technique that manipulates victims by sending false alerts and threatening them with fictitious attacks. Users are fooled into believing their device is infected with viruses and asked to download and install software that has no real benefit (other than for the attacker). When the user clicks the link or installs the software, the attacker gains access to the user’s data.

Baiting

Baiting attacks use baits to lure the victim by triggering their curiosity. Baits are physical or non-physical items such as pendrives, CDs with company logos etc which is used to steal a victim’s confidential information. Attacker leaves bait in a common area such as parking, bathroom etc. Once victim picks up the bait out of curiosity and injects it into a work or home computer, the device will be infected with malware automatically.

-> Pretexting

By impersonating coworkers, police, bank officials, or other people with right-to-know authority, the attacker will typically gain the confidence of their target. The attacker will pretend they need confidential information from the victim in order to complete a critical task. An attacker will obtain confidential information by telling a series of highly detailed lies.

# data[].attributes.headline
How do cyber attackers leverage social engineering to go after a target?

# data[].attributes.subject
How do cyber attackers leverage social engineering to go after a target?

# data[].attributes.body
A social engineering attack persuades the target to click on a link, open an attachment, install a program, or download a file. The link may redirect the target to a website that solicits personal information (that is then collected by the attacker) or has malware on it that then infects the target's computer. That malware might install a keylogger (a malicious program that records any keystroke, often to pilfer passwords), or some other program or code that enables the attacker to move from the target's computer to the target's network and others in the organization.