As the story broke about the charges against former U.S. Air Force intelligence specialist who defected to Iran and support targeted hacking against some of her former colleagues, one clear takeaway stood out: even U.S. intelligence officers can fall victim to basic, directed hacking campaigns.
The process was simple; the defector provided information that allowed Iranian hackers to create unsuspicious online personas, including one posing as a former coworker, and then sent personalized, convincing links that delivered malware. The hackers were Facebook friends with several U.S. intelligence agents and a member of Facebook groups full of more agents.
“Social media affords our adversaries the ability to harvest our trust with beguiling specificity,” stated a former FBI agent. “It allows them to beguile us into a false position of trust. You think because the person who approaches you has such specific information it’s someone to whom you should offer trust.”
Analyst warn that Iranian hackers have become experts in conducting these kinds of simple phishing attacks. “Spear phishing and social engineering are their core competencies…they just continue to improve at it. If people would learn to stop clicking on links, it would make it a lot more difficult for them,” declared a chief intelligence officer at Treadstone 71.
Would your users fall for clever phishing attacks? Take the first step now and find out before the bad guys do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
PS: Don't like to click on redirected buttons? Cut & Paste this link in your browser: