There's A Simple Way To Protect Against Chinese Hackers
Cybersecurity firm Mandiant has concluded that the onslaught of complicated Chinese Tactics, Techniques and Procedures to exploit systems and run your business into the ground starts with just a click - in particular, your click.
Imagine this: The names and emails of your staff, to include your executives, are either listed publicly, or accessible via the web in a matter of five diligent minutes.
Once you're targeted, and a hacker has that info, he then signs up for a dummy email account, named after your boss, your Chief Financial Officer or your fellow worker (often all three). Then you start to get emails from those dummy accounts, containing language commonly seen in the workplace.
The tactic is called "Spear Phishing," and it relies the user and reflexive clicking.
On some occasions, unsuspecting email recipients have replied to the spear phishing messages, believing they were communicating with their acquaintances. In one case a person replied, "I'm not sure if this is legit, so I didn't open it." Within 20 minutes, someone in APT1 responded with a terse email back: "It's legit."
The solution to this is simple: calm down, breath, and hover that mouse. Most browsers and email platforms allow users to identify the exact email of a sender.
via Geoffrey Ingersoll
Rather, I should contact Henry and ask him if he's been using a new email account.
These emails can also come from other sources, like faux PayPal (subject: "account disabled!") or credit card dummy accounts.
Within these emails is usually a harmless looking word document or excel spreadsheet which actually contains malicious code.
Once the code has penetrated the system, it becomes markedly more difficult for IT Officers to clean up the mess.
So the simplest defense begins with education of employees and personnel, not to click reflexively on seemingly "legit" emails - first hover, verify the source - generally emails from coworkers are over company platforms. Same goes for credit card companies: they don't shoot customers sensitive account emails from platforms like @rocketfish.com.
Now this isn't a guarantee, but according to Mandiant, it'll go a long way toward guarding secrets. So be smart, be patient, and avoid the reflexive click - your business may depend on it.
- Bajaj Pulsar NS160, Pulsar NS200 launched in India starting at ₹1.46 lakh
- GPT Healthcare IPO allotment – How to check allotment, GMP, listing date and more
- Juniper Hotels shares jump over 10% after flat market debut
- Rupee turns flat at 82.89 against US dollar in early trade
- Stock market indices kick off trading day with stability, witnessing a mix of gains and losses