New Social Engineering Tricks

United States-based security services company, SecureWorks, recently discovered an extremely advanced social engineering attack that nearly succeeded in compromising a Middle Eastern client. While analyzing a failed spyware infection, SecureWork analysts traced the spyware to an email sent to an employee by a woman named Mia Ash. When digging into this person's background, they found she had social media profiles such as Facebook and LinkedIn and she had over 500 friends and connections on each. From what they could tell she had two art school degrees and was a successful photographer. However, Mia Ash is not a real person. Even the photos on her Facebook and LinkedIn profiles were stolen from another woman's Facebook page. In short, this woman was a fabricated persona.

Mia Ash had reached out to the target at SecureWorks's client's company and spent weeks creating trust. After initially reaching out on LinkedIn, the conversation had moved to Facebook and email. She had built such trust that she had managed to convince the employee that a download she had sent him would be best downloaded and opened on his company office network as the download would be faster. The employee had complied, feeling reasonably sure that the individual he had been speaking to for weeks was real and trustworthy.

An attack like this is nearly impossible to avoid. People form connections online everyday and in the modern-age, some established, strong connections never meet in person. This type of attack takes advantage of this new vulnerability.