Introduction
Cyber Guru allows the execution of simulated attacks via USB sticks, providing a malicious Word file to be physically loaded onto USB devices by the customer.
This feature is available exclusively for organizations that have purchased the "Phish Pro" add-on and activated the relevant licenses.
Important Note:
The "Phish Pro" add-on must be properly purchased for the interested organization.
Activation for testing or trial purposes is not allowed.
If you have any doubts or special needs, you must contact technical support before activation.
Enabling USB Attack
To activate a USB attack, follow these steps:
-
Go to the Setup > Phishing section.
-
Enable the "Enable USB Attack" option.
Once enabled, the feature will be visible within the "Release Management" section, under "Remediation".
USB attacks can also be executed on new targets, meaning users who have never received any type of attack.
Types of USB Attacks
There are two types of USB attacks
-
USB Attack with Macro: In this scenario, when the user inserts the USB stick into their device, opens the file, and runs the macro (via the "Enable Content" option), the hostname and IP address of the machine are recorded. However, macro execution may be blocked by company policies; therefore, it is necessary to verify on a case-by-case basis if this attack mode can be adopted, possibly supporting it with a certified macro.
-
USB Attack without Macro: in this mode, only a file opening event (a click per user) is recorded, without collecting specific details like hostname or IP. This approach allows for aggregated data on user interaction with the file.
Sending the Malicious File
To send the USB attack, simply click "Start" in the "Release Management" section. You will need to choose the template (USB type) to use.
NOTE: You cannot select just one template for each campaign. If a new template is created, it will be eligible for Phish Pro the day after the template is created.
Campaign Duration Management
In the section dedicated to duration management, you can enter
-
Campaign Start Date: Indicates the date from which the platform will start recording interaction events with the malicious file. You cannot enter a past date.
-
Campaign Duration: Defines the period during which events will be recorded. Events occurring before the start date or after the end of the specified duration will not be considered by the Cyber Guru platform.
-
Campaign Start Time: Specifies the exact time when the platform starts recording interactions with the malicious file.
-
Email sending duration: this field should be left blank.
Contact Information
Next, you will need to provide the email address of the contact person who will receive the communication containing the malicious file to be loaded onto the USB sticks. You can enter any email address here, even one belonging to a user not registered within the company.
NOTE: The email will be sent to the specified contact the DAY AFTER the campaign is set up on the platform.
The contact receives an email with the content present in the template and the malicious file attached. The message within the template is global.
Every interaction of the contact with the attached file (e.g., opening the file or executing the macro) will be counted and recorded in the campaign's final report.
NOTE: It is important to remind the contact of the duration and the time from which the platform will record interactions, so they can properly organize the distribution of the malicious file via USB.
Attachment Customization
Attachment customization is the customer's responsibility. The standard file sent includes instructions for customizing the file.
Reporting
At the end of the campaign, you will be able to download a report that allows you to view
-
Phished IP: Public IP
-
Host Name of the machine of the user who opened the file and enabled macro execution
-
Host IP: Local IP of the device where macro execution was enabled
Every interaction of the contact with the attached file (e.g., opening the file or executing the macro) will be counted and recorded in the campaign's final report.
In the case of USB templates without macro, the report only records the click associated with the Phished IP (Public IP).