Understanding Social Engineering Attack Methods 

Social engineering is a term used for a broad range of criminal activity and it is a dangerous weapon that is used by many cyber criminals to achieve their odious goals. It leverages psychological manipulation to deceive individuals into divulging confidential or personal information. 

As technological defences become more robust, cyber criminals are increasingly using social engineering techniques to exploit the weakest link in the security chain: people.

Social engineers use a variety of means, both online and offline, to deceive unsuspecting users into compromising their security, transferring money or giving away sensitive information and it is different from traditional hacking, which relies on exploiting software vulnerabilities, social engineering targets human vulnerabilities.

Here are the most common  types of social engineering attacks currently in use with real-world examples.

Phishing: Hook, Line & Sinker

Phishing is one of the most common social engineering attacks. It involves sending fraudulent communications, usually emails, that appear to come from a legitimate source. The goal is to trick recipients into providing sensitive information, such as login credentials or financial details.

In 2022, a sophisticated phishing attack aimed at stealing Office 365 credentials, where attackers impersonated the US Department of Labor (DoL). This scam demonstrates the increasing sophistication and convincing nature of modern phishing attempts.

Spear Phishing: Precision Social Engineering

Spear phishing is a more targeted version of phishing. While phishing attacks are often sent to many recipients with a “mud-against-the-wall” approach, spear phishing targets specific individuals or firms. The malicious actor customises the message based on information about the target, making it more convincing.

As world leaders deliberated on the best response to the escalating tensions between Russia and Ukraine, Microsoft issued a warning in February 2022 about a new spear phishing campaign by a Russian hacking group targeting Ukrainian public sector entities and NGOs. The group, known as Gamaredon and tracked by Microsoft as ACTINIUM, had reportedly targeted “organisations critical to emergency response and ensuring the security of Ukrainian territory” since 2021.

Pretexting

Pretexting is another form of social engineering involving creating a fabricated scenario to steal information. These scams use the same social engineering techniques that con artists have used for centuries to manipulate their victims, such as deception, validation, flattery, and intimidation. The attacker pretends to need the information to confirm the victim’s identity or to help with a supposed emergency.

At the organisational level, a pretexting actor may take extensive measures to impersonate trusted figures such as managers, coworkers, or customers. This could involve fabricating identities through fraudulent email addresses, websites, or social media profiles. In more elaborate scenarios, the attacker might arrange face-to-face meetings with targets. For instance, a hacker masquerading as a vendor representative might schedule a meeting to gain access to confidential customer data. The attacker aims to appear credible during these encounters and build rapport with the target.

By establishing trust, the attacker increases the likelihood that the target will comply with requests for sensitive information, believing them to be legitimate.

Deepfakes

Deepfakes, which use artificial intelligence (AI) to create realistic but fake audio, video, or images that impersonate real people, are increasingly used in various social engineering attacks to create compelling but fraudulent scenarios. They leverage manipulated audio and video to deceive targets into disclosing sensitive information or performing actions they otherwise would not.

In 2022 a deepfake purported to show President Zelensky declaring that Ukraine has “decided to return Donbas” to Russia. and instructing Ukrainian soldiers to lay down their arms. 

Quid Pro Quo

Another type of social engineering is quid pro quo attacks, which involve offering a service or benefit in exchange for information. Attackers may promise tech support, free software, or other services to persuade victims to reveal confidential information. 

One of the most prevalent quid pro quo attacks involves fraudsters posing as representatives of the US Social Security Administration (SSA). These fraudsters contact individuals randomly, requesting confirmation of their Social Security Numbers under false pretences, enabling identity theft. 

Attackers don’t even need to be very convincing, as previous incidents have demonstrated that office employees are willing to divulge their passwords in exchange for inexpensive items like pens or chocolate bars.

Honeytraps

Honeytraps involve creating fake online personas to establish romantic relationships with victims. The goal is to gain and exploit the victim’s trust for financial gain or access to sensitive information.According to police reports, a man from Vancouver Island lost $150,000 in a romance scam. Over several months, the scammer requested money for plane tickets, medical bills, and various other expenses.

In 2023 the FBI Seizes $112m From 'CryptoRom' Criminals. Their schemes involve fraudsters cultivating long-term relationships with victims online to coax them to make crypto-currency investments. The catch is that the transferred funds end up in the swindler’s pockets while the victim is abandoned

Piggybacking

Two other widespread threats are tailgating and piggybacking. Tailgating, in essence, is unauthorised access to secured spaces, which malefactors gain by exploiting the trust of real users. It involves gaining physical access to a restricted area by following someone with legitimate access and exploiting the courtesy of others to gain entry without proper authorisation. 

It can also involve badge cloning, using unattended devices, or impersonation. Piggybacking happens when someone attempts to piggyback onto a hacker's attempted extortion.

In 2018, an individual admitted guilt in England's Reading Crown Court for unauthorised computer access and blackmail, while he was working at Oxford Biomedica, a gene therapy company. There was an incident where the company faced a ransom demand of $370,000 in Bitcoin after an attack. One untrustworthy employee even altered ransom notes to redirect payments to his cryptocurrency wallet, effectively launching a separate attack against his employer.

Business Email Compromise

Business email compromise (BEC) is a sophisticated cyberattack where criminals meticulously gather information about an organisation's structure and key executives. Using this knowledge, they exploit the trust associated with high-ranking positions, like the CFO, to trick employees into transferring funds or divulging sensitive information.

By gaining access to an executive's email account, attackers impersonate them and request urgent financial transactions, such as paying fraudulent invoices. They exploit the time-sensitive nature of these transactions to minimise the chances of detection.

BEC is one of the most common attacks and one of the most costly types of cybercrime. Between 2013 and 2022, the FBI says BEC attacks caused roughly $50.8 billion in losses worldwide.

Awareness & Education

Social engineering attacks are a growing scourge in today's digital landscape. They exploit human psychology rather than technological weaknesses, making them particularly challenging to defend against. Awareness and education are crucial in combating these attacks and employees should know how to recognise and report potential incidents promptly.

Key points to emphasise in security awareness training:

  • If you receive a suspicious email, verify its legitimacy by contacting the sender directly via phone or in person.
  • Be sceptical of unsolicited offers. If something appears too good to be true, it likely is.
  • Always lock your laptop when stepping away from your workstation to prevent unauthorised access.
  • Invest in antivirus software. While no antivirus solution offers foolproof protection, it can significantly bolster defences against social engineering tactics.
  • Familiarise yourself with your company’s privacy policy to understand protocols regarding access permissions for external individuals.
  • Validate urgent requests from internal contacts before taking action, primarily involving financial transactions or sensitive information.
  • Foster a culture of risk awareness to keep employees vigilant.

Social engineering thrives on human error, so embedding security awareness into the organisational mindset is crucial.

By understanding the common types of social engineering attacks and recognising their real-world implications, individuals and organisations can better protect themselves from these pervasive threats.

Splunk   |   Imperva   |   Tripwire   |   Fortra   |     Vancouver Sun   |    BankInfoSecurity   |   ITGovernance 

Image:

You Might Also Read: 

Every Employee Should Be Considered A Target:


If you like this website and use the comprehensive 7,000-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« For Many Businesses Experiencing MultiCloud Data Breach, Multi-Cloud Security Could Be The Answer
PDF Merging Guide: Simplify Document Management »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Government Communications Headquarters (GCHQ)

Government Communications Headquarters (GCHQ)

GCHQ defends Government systems from cyber threat, provide support to the Armed Forces and strive to keep the public safe, in real life and online.

Ovarro

Ovarro

Ovarro is the new name for Servelec Technologies and Primayer. Ovarro's technology is used throughout the world to monitor, control and manage critical and national infrastructure.

IT Security House

IT Security House

IT Security House is a leading European supplier of Cyber Security Intelligence and eCrime services.

National Cyber Security Agency (NACSA) - Malaysia

National Cyber Security Agency (NACSA) - Malaysia

NACSA is the leading government agency in Malaysia responsible for the development and implementation of national cyber security management policie and strategies.

Idaptive

Idaptive

Idaptive delivers Next-Gen Access through a zero trust approach. Idaptive secures access everywhere with single sign-on, adaptive MFA, EMM and analytics.

C2A Security

C2A Security

C2A Security offers a comprehensive suite of cyber security solutions for the automotive industry, providing in-vehicle end-to-end protection.

National Centre for Cyber Security (NCCS) - Pakistan

National Centre for Cyber Security (NCCS) - Pakistan

National Centre for Cyber Security (NCCS) undertakes cyber security research and plays a leading role in securing Pakistan’s Cyberspace.

EOL IT Services

EOL IT Services

EOL IT Services is the UK’s most accredited provider of IT Asset Disposal (ITAD), Lifecycle Services and Data Destruction.

Y-PARC

Y-PARC

Y-PARC is a center of excellence for cybersecurity, precision industries and medtech, fostering innovation and development and support for startups.

IP2Location

IP2Location

IP2Location provide services to identify geolocation by IP address, and to detect IP addresses associated with anonymous proxy servers, which are often used for fraud and spamming purposes.

Cirosec

Cirosec

Cirosec is a specialized company with a focus on information security. We carry out pentests & audits and advise our customers in the German-speaking countries on information and IT security issues.

Lockheed Martin

Lockheed Martin

Lockheed Martin deliver full-spectrum cyber capabilities and cyber resilient systems to defense, intelligence community and global security customers.

Obrela Security Industries

Obrela Security Industries

Obrela provides security analytics and risk management services to identify, analyze, predict and prevent highly sophisticated security threats in real time.

Crypto Legal

Crypto Legal

Crypto Legal is a leading UK-based law firm specialising in blockchain forensics and legal services.

Semgrep

Semgrep

Semgrep is a fast, open-source, static analysis tool for profoundly improving software security and reliability.

OpenZiti

OpenZiti

OpenZiti is the world’s most used and widely integrated open source secure networking platform. OpenZiti provides both zero trust security and overlay networking as pure open source software.