Cyber threats are becoming increasingly sophisticated, targeting even the most unsuspecting individuals. From day one, it is crucial to protect employees and ensure they are equipped to recognize and respond to potential threats. No one is immune to cyber attacks, and proactive defense strategies are essential in safeguarding both personal and organizational data.
Incident Breakdown
Picture this: a new employee, excited about her role, updates her LinkedIn profile to share the good news. Almost immediately, she receives text messages from someone claiming to be the CEO, asking her to get in touch. Not long after, an email from the ‘CEO’ arrives with a similar request. It all seems urgent and legitimate, but something doesn’t sit right. The texts are coming from two different, unknown numbers, and the email, as it turns out, is from a spoofed address. It becomes clear—attackers are impersonating the CEO to trick the new hire.
So, how did this happen?
Attackers often monitor social media, like LinkedIn, for announcements about new hires. Once they spot a target, they use social engineering tactics to gather contact details, understand internal hierarchies, and figure out the company’s email format. They reach out quickly, banking on the new hire’s hesitation to question a senior executive. This method exploits the natural eagerness and compliance that new employees often have, making it a particularly effective strategy.
Proactive Measures to Protect New Hires
This scenario highlights the need for robust cybersecurity measures and awareness training for new hires. Ensuring that employees know what to look for and how to verify communications can make all the difference in protecting your company from similar attacks. Tactics should include:
1. Awareness Training
Start by educating new hires about these types of attacks. Make sure they understand your communication protocols, especially when it comes to using personal phones and recognizing your internal email domains. Emphasize the importance of staying alert from day one.
2. Verification Practices
Encourage new hires to verify any unexpected messages through alternate means such as Teams or Slack. They should be encouraged to feel comfortable calling a known company number or consulting their supervisor or IT department. Reassure them that no legitimate executive will be upset by a cautious approach.
3. Email Safety Tips
Implement external sender warnings or banners and provide tips to help employees spot potentially malicious emails. Remind them to be cautious and skeptical of any urgent or unexpected requests.
Common Malicious Email Subject Lines
Be on the lookout for subject lines containing urgent prompts, which are often used in cyber-attacks. These subject lines are designed to create a sense of urgency and prompt immediate action, often leading to hasty decisions that can compromise security. Examples include:
- Invoice: RE: INVOICE, Missing Inv {Number}, INV{Number}
- New: New Message from {Name}, New Scanned Fax Doc-Delivery for {Name}
- Message: Message from {Name}, You have a New Message
- Required: Verification Required, Action Required: Expiration Notice
- File: You have a Google Drive File Shared, {Name} sent you some files
- Request: {Business Name} SALES PROJECT FILES AND REQUEST FOR QUOTE
- Action: Action Required: Expiration Notice, {Action Required} Password Expire
- Document: File Document {Number}, You have received a new document
- Verification: Verification Required
- eFax/Fax: eFax from ID {Number}, eFax message from {phone number}
- VM/Voice Mail: VM from {phone number} to Ext {Number}
- Shared: Shared a library with you, Shared a document with you
- Password: Your password expired, Password verification needed
Trust but Verify
Even if a message seems legitimate, always question whether the task or request is typical. If you’re unsure, verify through a different communication channel. Don’t confirm email validity by replying or using non-corporate apps, as this could tip off an attacker if the sender is compromised. Instead, opt for direct communication with known contacts or consult your immediate supervisor or IT staff.
By fostering a culture of vigilance and equipping employees with the right tools and knowledge, we can collectively safeguard our organizations against sophisticated cyber threats.
With GCS, you can create a more secure and productive workplace.
Contact us to see how you can safeguard your company against cyber threats.
