Learn Social Engineering

Key points from this example

• It's very hard to distinguish between legitimate and illegitimate emails.
• Classic attacks can still be valid today! At Truesec, we do a lot of fancy attacks using the latest research; however, most organization are still vulnerable to simple download links and instructions.
• Sometimes, a combination can be highly effective; for example, email and phone.
• Good preparation increases the chance of success. If, for example, we didn't know about the IDS configuration, we could have failed to set up a successful communication channel.
• Custom malware will usually not be detected by antivirus or IDS.

In more advanced attacks, we use file-less malware, zero-day vulnerabilities, and obfuscation of origin, such as domain ...