Module 7: Threats & social engineering

Estimated time: 3-4 hours (including the lab) · Prerequisites: M0-M6

Most breaches don't start with a genius exploit. They start with a person being tricked. Attackers go through humans because it's cheaper and more reliable than going through firewalls. This module teaches you to recognise the tricks, name the malware families, and know Australia's reporting and support channels: core skills for SOC triage and for the security-awareness side of GRC.

Security+ SY0-701 mapping: Domain 2 (Threats, Vulnerabilities, and Mitigations): social engineering, threat actors and malware types.

What you'll get from this module

• Explain why humans are the primary attack path and the psychology attackers exploit.
• Dissect a phishing email (and its SMS, voice and QR cousins) using a repeatable checklist.
• Describe business email compromise (BEC) and payment redirection fraud.
• Classify malware with a working taxonomy, including ransomware and double extortion.
• Name Australia's channels: ACSC alerts, ReportCyber, Scamwatch, IDCARE.
• Complete a phishing analysis lab, safely, on your own spam folder.

---

1. Why attackers target people

Modern perimeter defences are decent; humans remain persuadable. One convincing email costs an attacker almost nothing, scales to thousands of targets, and only has to work once. ASD's annual cyber threat reporting and Scamwatch data consistently show that email-borne fraud and phishing-initiated compromises sit among the most reported and most costly incidents in Australia, which is why every SOC treats "user reported a suspicious email" as a core alert type.

The takeaway for your career: recognising manipulation isn't a soft skill. It's a triage skill you will use daily.

---

2. The phishing family

Same con, four delivery channels:

Name	Channel	Typical example
Phishing	Email	"Your account will be suspended. Verify now"
Smishing	SMS	"Your parcel is held. Pay a redelivery fee" (toll and post scams are Australian classics)
Vishing	Voice call	"This is your bank's fraud team. Read me the code we just sent"
Quishing	QR code	A QR on a poster, invoice or email that leads to a fake login page

Anatomy of a phishing email

Almost every phish is built from the same parts:

1. A spoofed or look-alike sender: the display name says "Australia Post" but the address is support@auspost-parcels-example.top. Display names are trivially fakeable; the address (and the headers behind it) matter.
2. Manufactured urgency: act now or something bad happens: account closed, fine issued, parcel returned. Urgency exists to stop you thinking.
3. Mismatched links: the visible text says one thing; hovering (never clicking) reveals a different, unrelated domain.
4. A credential-harvesting page: the destination is a pixel-perfect copy of a real login page. Everything typed into it goes to the attacker. This is how phishing and M6 connect: the phish steals the password; MFA is what makes the stolen password insufficient.

Plus supporting cast: generic greetings, unexpected attachments, requests to move to WhatsApp or gift cards, and just-slightly-off logos and grammar (though AI-written phish are increasingly flawless: polish alone proves nothing).

---

3. BEC: the quiet billion-dollar crime

Business email compromise (BEC) skips malware entirely. The attacker either compromises or convincingly impersonates a trusted business identity (a CEO, a supplier, a conveyancer) and uses plain, well-written email to redirect money:

• Invoice/payment redirection: "Our bank details have changed. Please pay this (real, expected) invoice to the new account."
• Executive impersonation: "It's the CFO. I need an urgent confidential transfer before close of business."
• Property settlement fraud: intercepting conveyancing emails to redirect house deposits, a distinctly painful Australian variant.

Because BEC targets payments, not systems, technical controls struggle with it. ACSC/ASD annual threat reporting and Scamwatch consistently place BEC and payment-redirection fraud among the largest reported financial losses in Australia. The defences are procedural: verify any bank-detail change by phoning a known number (never one from the email), and require dual approval for large transfers.

---

4. Malware taxonomy

"Malware" is the umbrella; interviews and Security+ expect the families:

Type	Defining behaviour	One-line example
Virus	Attaches to files/programs; spreads when they're run or shared	Infected macro document
Worm	Self-propagates across networks, no user action needed	WannaCry's spread mechanism
Trojan	Pretends to be legitimate software; the user installs it	"Free PDF converter" carrying a payload
Ransomware	Encrypts data and demands payment	Business files locked, ransom note dropped
Infostealer	Silently harvests saved passwords, cookies, session tokens	Stolen browser logins sold in bulk online
RAT (remote access trojan)	Gives the attacker ongoing remote control	Attacker watches the desktop, moves laterally

Worth flagging: infostealers are a fast-growing quiet threat (stolen session cookies can let attackers bypass logins entirely) and they're a big reason "change your password and sign out everywhere" is standard incident advice.

Ransomware operations and double extortion

Modern ransomware is a business, often run as ransomware-as-a-service (developers lease the tooling to affiliates). The standard play is double extortion:

1. Break in (often via phishing, stolen credentials or an unpatched service: see the Essential Eight, M5).
2. Steal copies of sensitive data first.
3. Then encrypt systems and demand payment: for the decryption key and for not publishing the stolen data.

Double extortion is why "we have backups" is no longer a complete answer: backups fix encryption, not publication. Medibank (M5) is the canonical Australian example. Data was published when payment was refused. Australian Government guidance is not to pay: payment funds the ecosystem and guarantees nothing.

---

5. The Australian response channels

Know these cold. You'll use them at work and recommend them to family:

• ACSC alerts and advisories (cyber.gov.au): the national feed of current threats. SOC teams check it; so should you.
• ReportCyber (via cyber.gov.au): report cybercrime affecting you or your organisation; reports route to the appropriate police jurisdiction. The 1300 CYBER1 hotline (M5) provides 24/7 help.
• Scamwatch (run by the National Anti-Scam Centre): scam reporting and statistics; the best plain-English database of what scams are circulating in Australia right now.
• IDCARE: the national identity and cyber support service for individuals whose identity has been compromised. Free, and the standard referral after breaches like Optus/Medibank.
• eSafety Commissioner: the regulator for online safety and abuse; the right referral for cyberbullying, image-based abuse and online harm (adjacent to, but distinct from, cybercrime).

---

6. The psychology: four levers

Social engineering is applied psychology. Nearly every lure pulls at least one of these levers:

Lever	The manipulation	Example
Authority	We comply with power	"This is the ATO. A warrant will be issued unless…"
Urgency	Time pressure kills judgement	"Payment must clear before 5 pm today"
Scarcity	Fear of missing out	"Only 3 refund places remaining"
Familiarity	We trust the known	Spoofed colleague, cloned supplier thread, a voice that sounds like your boss

The professional habit to build: when a message makes you feel a spike of emotion + pressure to act immediately, that combination is itself the red flag, regardless of how legitimate the message looks. Slow down and verify out-of-band.

---

7. How organisations defend

Defence is layered. No single control stops social engineering:

• Awareness training and simulated phishing: teaching staff the red flags above, then testing safely. (Designing and running these is genuine junior GRC/security work.)
• Email filtering: secure email gateways strip known-bad links, attachments and impersonation attempts before delivery.
• Email authentication in one paragraph: three DNS-based standards make sender forgery harder. SPF lists which servers may send mail for a domain; DKIM cryptographically signs messages so tampering is detectable; DMARC tells receiving servers what to do when SPF/DKIM checks fail (and sends reports). Names and one-line purposes are enough at this level. You'll meet them again in SOC email triage.
• Reporting culture, the highest-value control: staff who report suspicious emails fast, without fear of blame (even after clicking) give the SOC minutes instead of weeks. A "report phish" button plus a no-blame policy beats any poster campaign.

---

🧪 Lab 7: Phishing analysis on your own spam folder

You already own a threat-intelligence feed: your spam folder. This lab is read-only: you will analyse, never interact.

Safety rules (non-negotiable):

• Never click links, open attachments, scan QR codes, reply, or unsubscribe.
• Read messages in your webmail's normal view; don't download anything.
• If a message involves your real bank or a real account, don't act on the message. Go to the site directly via your browser if you need to check.

Steps:

1. Open your email spam/junk folder and pick three obvious phishing or scam emails.
2. For each, view the full headers/original message (Gmail: ⋮ menu → Show original; Outlook.com: ⋮ → View message source). You're just reading text. This is safe.
3. Analyse each against this checklist and record your findings:
   • Sender: does the real address match the display name? What's the actual domain?
   • Urgency/emotion: what feeling is it engineering, and which of the four levers (authority, urgency, scarcity, familiarity) is it pulling?
   • Links: hover only. Does the visible text match the true destination domain?
   • Ask: what does it ultimately want: credentials, payment, a call, an attachment opened?
   • Impersonation: which real brand/agency is being faked, and how faithfully?
   • Headers: in the source view, find the From: line and look for SPF/DKIM/DMARC results (Gmail shows pass/fail summaries in Show original).
4. Write up each email in five lines or fewer: verdict, lure type, lever used, target, red flags. Three write-ups = a portfolio-ready mini triage report (screenshot-free and sanitised).
5. Calibrate yourself: take Google Jigsaw's phishing quiz at phishingquiz.withgoogle.com and note which examples fooled you.

Lab success = three sanitised phishing write-ups using the checklist, plus your quiz result and one sentence on what fooled you.

---

Self-check

Answer before you reveal: the attempt is what makes it stick. Your score and card ratings are saved on this device only.

Scored self-check

Check your understanding

Commit to an answer before you check: the attempt is what makes it stick. Your first answer to each question is the one scored; practising again afterwards doesn't change it. Saved on this device only.

Question 1 of 7An email says your Australia Post parcel is held. The logo and grammar are flawless, and the visible link text reads “auspost.com.au”, but hovering shows the link actually points to a completely different domain. What’s your verdict?

Legitimate: the link text shows the real Australia Post domainProbably legitimate: real phishing emails have poor grammar and off logosPhishing: the mismatched link is the red flag, however polished the email looksUndecidable: you’d have to click the link to see where it really goes

Question 2 of 7A supplier emails your finance team: “Our bank account has changed. Please pay the attached (genuine) invoice to the new BSB.” What is this, and what’s the correct control?

BEC payment redirection: verify by phoning the supplier on a known, previously used numberA trojan: quarantine the attachment and rebuild the machineBEC: reply to the email asking the supplier to confirm the new account detailsSmishing: report the message to the telco

Question 3 of 7After a compromise you force a password reset, yet the attacker keeps accessing the user’s webmail from an external IP, with no new login event in the logs. Which malware family’s behaviour best explains this?

VirusWormInfostealerRAT (remote access trojan)

Question 4 of 7Your manager says: “Ransomware isn’t a big risk for us. Our backups are tested and solid.” What’s the gap in that reasoning?

Nothing: tested backups fully neutralise modern ransomwareDouble extortion: data is stolen before encryption, and backups can’t stop it being publishedThe gap is budget: you should also set money aside to pay the ransomBackups only protect against viruses and worms, not ransomware

Question 5 of 7A neighbour’s personal details were caught up in a breach like Optus or Medibank, and they ask you where to get help as an individual. Where do you point them first?

ACSC alerts on cyber.gov.auScamwatchIDCAREThe eSafety Commissioner

Question 6 of 7An email arrives as a reply inside a genuine months-old thread with a supplier you deal with every week, asking you to open an “updated contract”. Which psychological lever is doing the work?

AuthorityUrgencyScarcityFamiliarity

Question 7 of 7A staff member clicked a link in a phishing email, realised seconds later, and reported it straight away. As the security team, what’s the best response?

Start a disciplinary process so the mistake isn’t repeatedThank them: fast, no-blame reporting gives the SOC minutes instead of weeksSend an all-staff warning email naming the personNothing needed: the email gateway will already have neutralised the link

When a suspicious-email report lands in a SOC queue you won't have time to look up what smishing or double extortion means: these names have to be reflex, so rate yourself honestly and let the cards come back on a spaced schedule.

Flashcards · spaced repetition

Drill the key terms

Say your answer out loud (or in your head) before revealing. Recall is the workout. "Knew it" pushes a card's next review further out; "Review again" brings it back today.

Card 1 of 18

Prompt

Why do attackers go through people rather than firewalls?

---

Next module

➡️ M8: Defensive operations & the SOC, where the defenders sit: alerts, triage, SIEMs and what a SOC L1 shift actually looks like.