Post 4: How do cyber-criminals target you? A peek into social engineering.

🖧Post 1/2025: How do
cyber-criminals target you? A peek into social engineering.

 

Cybercrimes prove to be a distinct
category of crimes when contrasted with the traditional crimes, due to the peculiarities and unpredictable modus operandi. Cybercrimes are transnational and
can be targeted towards any user from anywhere globally. The cyber criminals majorly
use ‘psychological manipulation’ techniques to establish connection with their
targets. The trending cyber-fraud of ‘digital arrest’ is one of the classic examples of the same. This manipulation technique that the cybercriminals use is known as ‘social
engineering’.

Through this social engineering, the perpetrators gain hold of the victim’s personal data, credentials, access
to their devices and trick individuals into sharing of other sensitive
information about themselves, which is later used in black-mailing or extortion. Honey-traps,
digital arrest, Phishing, Whaling (a more detailed attack as compared to phishing) and data compromises are some USUAL examples
of social engineering in cyber-crimes.

⚠ Modus Operandi of Social Engineering?

(Figure1:The Modus Operandi)

Step I: The perpetrators identify
the victims by contacting them on social media platforms or via emails pr phone
calls. Here, they conduct a proper investigation and research on the user they
want to target by gathering background information, vulnerabilities and the
resource they want to exploit.

Step II: The perpetrator will
establish a connection with the target by engaging the target, creating a fake
scenario which will engage the victim, overpower the victim in the
conversation, identify the weakness and try to assure them as to start gaining
the trust of the target.

Step III: The perpetrators show commitment
towards the victim by completely gaining their trust so much that the victims
will blindly follow their instructions. In some cases, this stage also includes
black-mailing and extortions.

Step IV: The cyber criminals may
submit fake authenticity proofs and even showcase that people known to the
victim have also been involved in this transaction and it is safe for victim’s
usage as well.

Step V: Execution and then Exiting
are usually two steps that are being carried out together, when the victim has
finally given the information and personal data as required by the
cybercriminals, they will cover their tracks, stop contacting the victim, and exit
in a suspicious way leaving the victim with loss at hand.

Takeaways:

One of the greatest dangers of
social engineering is that the attacks don’t have to work against everyone: A
single successfully fooled victim can provide enough information to trigger an
attack that can affect an entire organization.[1]

Dos and Don’ts:

Basic steps and vigilance can
prove to be of great help while preventing these social engineering attacks on
yourself.

Avoid establishing contacts with unknown persons/users;

Always check the validity of the
sources from which an email is sent;

Being VIGILANT;

Avoiding use of URLs that do not begin
with HTTPs;

Being careful of phone calls and
emails asking for your personal data and being aware of impersonation;

Never respond to any message
asking for URGENT REQUESTS;

Never use unknown USBs or click
or download materials from unfamiliar websites or senders.