27. Social Engineering Awareness
27.6 Red vs Blue, Project and Real Incidents
Chala mitrano, phishing, vishing, smishing, pretexting, SET awareness, 1930 – aata Purple Team loop. Red authorised training lab madhe lookalike URL / mock mailbox dakhavto (kadhihi strangers la nahi); Blue URL+HTTPS check, OTP never share, callback on official number, MFA, email filters/DMARC awareness ani staff safety card lavto. Tumhi Raja-Rani Traders style OWN consented simulation madhe build → hack → fix karun Purple report liha. Awareness; fix + prove = career. Samjla ka? Real people without written consent – kadhi nahi.
Red Team vs Blue Team – social engineering awareness
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Phishing / spear phishing email with lookalike URL (concept) | Teach URL bar + HTTPS lock check; never click-to-login – open official app/site |
| Vishing / smishing: urgency + "share OTP" | Never share OTP/password/PIN; callback on number from official site/app |
| Pretexting as bank / manager / IT support | Verify unusual requests out-of-band; written approval for money/access changes |
| Baiting (USB labelled "salary") / tailgating | No unknown USBs; badge/door discipline; report left media to IT |
| SET-style fake login page in authorised awareness lab only | Security awareness training + simulated phishing only with written consent |
| Typosquat / lookalike domain for brand | MFA everywhere; SPF/DKIM/DMARC high-level for your domain; report to 1930 / cybercrime.gov.in |
Defender chi simple checklist: URL+HTTPS → never OTP → official callback → MFA → report 1930/cybercrime.gov.in → awareness training → DMARC/SPF if you own a domain → prove staff can spot a lookalike. SET = awareness tool authorised lab madhe; bachav habits + MFA + reporting Blue var. Interview madhe "I phished people" peksha "I ran a consented simulation, showed the lookalike URL, then rolled out a safety card, MFA and a clear report path" jast strong.
# OWN / consented lab only – NEVER send phishing to strangers
mkdir -p ~/labs/raja-rani-se
# Safe mock (examples – pick what you control):
# 1) Closed lab mailbox / mailhog / local SMTP catcher on YOUR VM
# 2) HTML lookalike login page served only on host-only (e.g. 192.168.56.50) – not on the internet
# 3) Written consent list (classmates who signed) before any simulation inbox send
# Document the lookalike (do not use real customer emails):
echo 'Example lookalike (training): https://paypa1-secure.example.lab/login' \
> ~/labs/raja-rani-se/lookalike-note.txt
echo 'Real habit: type paypal.com yourself; check HTTPS lock; never OTP on phone' \
>> ~/labs/raja-rani-se/lookalike-note.txt
# Blue prove checklist (write answers in the same folder):
# - Staff safety card: 5 rules + 1930 + cybercrime.gov.in
# - MFA enabled on mail + bank apps used for the shop
# - If Raja-Rani has a domain: ask admin about SPF/DKIM/DMARC status (high-level – no need to break DNS)
# - Report path: who to tell in shop + national helpline
Ravindra Bagale's Tip
Students use SET to send a "surprise test" to a friend – there is no consent, and that breaks the IT Act. The second mistake: sharing an OTP because "once is okay". Rule: written consent OR closed mock mailbox only → show lookalike URL → FIX with safety card + MFA + report path same day → never real phishing to strangers. The social engineering chapter is really a human firewall chapter. Don't worry, it becomes a habit.
Ravindra Bagale's Tip – मराठी
Students SET ने मित्राला "surprise test" पाठवतात – consent नाही, IT Act मोडला. दुसरी चूक: OTP "एकदा चालेल" म्हणून share करणे. Rule: written consent OR closed mock mailbox only → show lookalike URL → FIX with safety card + MFA + report path same day → never real phishing to strangers. Social engineering chapter = human firewall chapter. घाबरू नका, सवयीने जमते.
Ravindra Bagale's Tip – हिंदी
Students SET से दोस्त को "surprise test" भेजते हैं – consent नहीं, IT Act टूटा. दूसरी गलती: OTP "एक बार चलेगा" सोचकर share करना. Rule: written consent OR closed mock mailbox only → show lookalike URL → FIX with safety card + MFA + report path same day → never real phishing to strangers. Social engineering chapter = human firewall chapter. घबराओ मत, आदत से आ जाता है.
Lab
SET concept notes (27.4) warpashi bagha – pan tool strangers var naka. Swatahcha host-only mock page OR closed lab mailbox madhe ek lookalike URL example banva (fictional brand). Screenshot/notes ~/labs/raja-rani-se/: URL bar farak, HTTPS habit, "never OTP", callback rule. Mag 1-page family/staff safety card (1930 + cybercrime.gov.in) liha. Real bank customers / random numbers var message nahi.
Project: Build it, hack it, fix it
Build: For fictional Raja-Rani Traders (Nashik/Pune shop staff awareness) on systems you own or classmates with written consent:
- Ethics card + consent list (or use only a mock mailbox / host-only fake page – no strangers)
- Draft one training email theme (delivery update / password reset) – fictional brand, not a real customer's bank
- Prepare the safety card template (5 rules + 1930 + cybercrime.gov.in)
Hack (lab awareness only – OWN / consented):
- Show how convincing a lookalike URL/page looks (SET awareness or static HTML on host-only
.50) - If using email simulation: send only to accounts you own or classmates who consented in writing (or a closed lab catcher)
- Record who clicked in the safe simulation (training metric) – no shame, only learning
Do not phish strangers, do not collect real OTPs/passwords, do not host fake bank pages on the public internet, do not call random people as "bank fraud test".
Fix:
- Hand out the safety card; run a short awareness huddle (URL check, never OTP, official callback)
- Enable MFA on shop mail and critical apps Raja/Rani control
- Document report path: shop owner + 1930 + cybercrime.gov.in
- If they have a domain: high-level note on SPF/DKIM/DMARC with their DNS admin (awareness, not a full mail-server rebuild)
Re-verify: Second mini-quiz or consented resend – click rate drops; MFA screenshots; safety card signed/acknowledged. 1-page Purple report for owners Raja and Rani: finding → risk → training/MFA/DMARC/report fix → evidence. Peer-review with Zoya / Salman. IT Act 66C/66D: no real-world fraud simulations without authorisation.
Real incident: Twitter / X employee social engineering – bitcoin scam (2020)
In July 2020, public reporting described a breach of Twitter (now X) in which attackers used social engineering against employees to gain access to internal tools, then posted bitcoin-scam messages from many verified high-profile accounts. Users were urged to send cryptocurrency to addresses controlled by the attackers; platforms and law enforcement publicly discussed the employee-targeted social engineering angle. Weakness: trusted internal tools reachable after staff were manipulated, plus the viral reach of verified accounts. What would have reduced it: stronger employee verification for sensitive tools, least privilege on admin panels, MFA and phishing-resistant authentication for staff, and rapid internal alerting when verified accounts mass-post identical scam text. Lab lesson: your Raja-Rani project is not "email filters only" – staff awareness + MFA + privileged-tool access control matter as much as spam rules. Source: Twitter company statements and major news coverage of the July 2020 bitcoin scam (2020); verify current summaries.
Real incident: Target – HVAC vendor phishing path (2013)
In 2013, the Target retail breach was widely reported as involving credentials tied to an HVAC vendor whose access was used as a path into Target's network; public reporting linked the vendor compromise to phishing-style attacks against that third party. Payment-card data exposure was reported at very large scale (exact figures vary by source – treat published numbers as reported, not as your invention). Weakness: third-party vendor access without enough segmentation and vendor security hygiene, so one phished partner became a bridge. What would have reduced it: vendor risk reviews, network segmentation so HVAC/vendor networks cannot reach cardholder systems, MFA on vendor VPN/accounts, and phishing-resistant awareness for suppliers. Lab lesson: social engineering often hits the weakest connected human – Blue must harden staff and vendors. Source: US Senate commerce committee / investigative reporting on the 2013 Target breach and vendor phishing path; verify current summaries.
Real incident: Astrana Health – vishing / phone spoofing (Sept 2026)
1. What happened On 22–23 September 2026, Astrana Health, Inc. filed an SEC Form 8-K (Item 1.05) for a material cybersecurity incident at subsidiary Astrana Health Management. Threat actors used social engineering: they impersonated company personnel and spoofed the main corporate telephone number to contact employees and gain unauthorized system access. Astrana reported that private and confidential information was accessed and/or acquired; investigation of patient/employee/provider scope continued.
2. How the hack happened (public reporting only – high-level) 1. Attackers researched the company enough to sound internal (personnel names, roles). 2. They placed inbound voice calls while spoofing the organisation's main phone number (classic vishing). 3. Targeted employees were persuaded to help with access (remote tools / credentials / approvals – exact employee actions vary; the SEC filing frames it as social engineering for unauthorized access). 4. With that foothold, actors reached internal systems holding confidential data. 5. Defenders detected unusual activity, engaged forensics, notified law enforcement/regulators, rotated credentials, restricted remote-access tools, restored some systems from clean backups, and improved monitoring.
3. How to stop it / defend (this chapter: social engineering awareness) - Callback rule: hang up; call back only on a number from the official directory – never trust caller ID alone. - Never share OTP, password, or approve remote access on an inbound "IT support" call. - MFA + phishing-resistant auth for privileged and remote-access tools; least privilege on help-desk reset powers. - Staff safety card: 1930 / cybercrime.gov.in for India drills; report path to security team. - Log and alert on new remote-access tool installs and unusual privilege changes after off-hours calls.
4. How to take care so it won't happen again (checklist) - [ ] Written "no password/OTP/remote tools on inbound calls" policy; tabletop once a quarter. - [ ] MFA on email, VPN, and remote-support tools; disable unused remote-access software. - [ ] Help-desk identity verification that is not "they called from our main number." - [ ] After any suspected vishing: rotate affected credentials, review access logs, preserve call/ticket evidence. - [ ] Family/staff card: official callback numbers only – spoofed ID is easy.
Source: Astrana Health Form 8-K (filed 23 Sept 2026); SecurityWeek, 24 Sept 2026; BankInfoSecurity, 28 Sept 2026.
Interview model (clean English): "I only run phishing simulations on accounts I own or classmates who consented in writing. I show how a lookalike URL fools people, then I fix it with a staff safety card, MFA, a clear 1930 report path, and high-level SPF/DKIM/DMARC awareness for the shop domain."
Thodkyaat: fasavnuk olakha, pan MFA + safety card + 1930 shika. Aata pudhe digital forensics – purava. Chala pudhe, mitrano!
Thodkyaat sangaycha tar
- Social engineering attacks people, not machines, using authority, urgency, greed, trust and curiosity.
- Types: phishing (email), spear phishing, vishing (call), smishing (SMS), pretexting, baiting (USB), tailgating.
- Spot phishing with the 8-point checklist; the strongest habit is never clicking a link to log in – open the site yourself.
- SET shows how convincing fakes are made; it is for authorised awareness training only, never for attacking real people.
- No legitimate bank or company ever asks for your OTP/password/PIN.
- If tricked: disconnect, change passwords from a safe device, enable MFA, call the bank, and report to 1930 / cybercrime.gov.in.
Samjla ka? Manus surakshit tar sagli suraksha kaamachi. Pudhchya chapter madhe digital forensics – ghatnenantar purava kasa gola karaycha. Chala pudhe, mitrano!