These so-called “blended attacks” rely heavily on social engineering — the ability to manipulate someone to doing something they wouldn’t normally do — and are often categorised by what they ultimately will do to your systems.
What happens next
Today’s malware comes in easy to use, customised toolkits distributed on the dark web or by well meaning security researchers attempting to fix problems.
With a click of a button, attackers can use these toolkits to send phishing emails and spam SMS messages to deploy various types of malware. Here are some of them:
a remote administration tool (RAT) can be used to access a computer’s camera, microphone and install other types of malware
keyloggers can be used to monitor for passwords, credit card details and email addresses
ransomware is used to encrypt private files and then demand payment in return for the password
botnets are used for distributed denial of service (DDoS) attacks and other illegal activities. DDoS attacks can flood a website with so much virtual traffic that it shuts down, much like a shop being filled with so many customers you are unable to move
cryptominers will use your computer hardware to mine cryptocurrency, which will slow your computer down
According to insurance claim data of businesses based in the UK,, more than 66 per cent of cyber incidents are caused by employee error.
Although the data attributes only 3 per cent of these attacks to social engineering, our experience suggests the majority of these attacks would have started this way.
For example, by employees not following dedicated IT and information security policies, not being informed of how much of their digital footprint has been exposed online, or simply being taken advantage of.
Merely posting what you are having for dinner on social media can open you up to attack from a well trained social engineer.
QR codes are equally as risky if users open the link the QR codes point to without first validating where it was heading, as indicated by this 2012 study.
Even opening an image in a web browser and running a mouse over it can lead to malware being installed. This is quite a useful delivery tool considering the advertising material you see on popular websites.
Fake apps have also been discovered on both the Apple and Google Play stores. Many of these attempt to steal login credentials by mimicking well known banking applications.
Sometimes malware is placed on your device by someone who wants to track you.
Basic awareness of the risks in cyberspace will go a long the way to mitigating them. This is called cyber hygiene.
Using good, up-to-date virus and malware scanning software is crucial.
However, the most important tip is to update your device to ensure it has the latest security updates.
Hover over links in an email to see where you are really going.
Avoid shortened links, such as bit.ly and QR codes, unless you can check where the link is going by using a URL expander.
Uh oh, I’ve already clicked
If you suspect you have malware on your system, there are simple steps you can take.
Open your webcam application. If you can’t access the device because it is already in use, this is a telltale sign that you might be infected.
Higher than normal battery usage or a machine running hotter than usual are also good indicators that something isn’t quite right.
Make sure you have good anti-virus and anti-malware software installed.
Estonian start-ups, such as Malware Bytes and Seguru, can be installed on your phone as well as your desktop to provide real-time protection.
If you are running a website, make sure you have good security installed. Wordfence works well for WordPress blogs.
More importantly though, make sure you know how much data about you has already been exposed.
Google yourself — including a Google image search against your profile picture — to see what is online.
Check all your email addresses on the website haveibeenpwned.com to see whether your passwords have been exposed.
Then make sure you never use any passwords again on other services. Basically, treat them as compromised.
Cyber security has technical aspects, but remember: any attack that doesn’t affect a person or an organisation is just a technical hitch; cyber attacks are a human problem.
The more you know about your own digital presence, the better prepared you will be.
All of our individual efforts better secure our organisations, our schools, and our family and friends.
Richard Matthews is a lecturer in the Entrepreneurship, Commercialisation and Innovation Centre and a PhD candidate in Image Forensics and Cyber at the University of Adelaide. Kieren Nicolas Lovell is head of the TalTech Computer Emergency Response Team at Tallinn University of Technology. This article originally appeared in The Conversation.