Once the hackers have figured out who they’ll attack, they then look at all the information about the victim and determine what methods could be successful.

They might find that the best strategy is to convince someone to visit a website with an attack package or open an email in an out-of-date Outlook which then triggers a silent hack. Or they may try to socially engineer a staff-member into opening a remote-control session so the attacker can open an exploit on their computer. The aim of Weaponisation and Delivery is to deliver an appropriate exploit package to a victim.

Although an average Joe/Jane/Jamie user can’t stop a hacker from weaponising, we can each play a part in preventing delivery! Our Scam and Phishing module is all about watching out for scam emails and messages on digital devices. Keeping an ear out for suspicious phone calls, SMS’s and watching for things out-of-the-ordinary is critical. Vigilance and attention are the strategies to prevent delivery of a weaponised package.

Advice includes a lot of advice we've given previously - see which ones you recognise:

1. Email security (the #1 delivery method)

Spam and malware filters - block suspicious emails before they reach inboxes
Attachment scanning - automatically check files for malicious code
Link protection - rewrite URLs to scan destinations before users click
Email authentication (Uh oh - techie stuff!!!) - use SPF, DKIM, and DMARC to verify sender legitimacy and block spoofed email.

2. Web filtering - This is done by your tech team!

Block access to known malicious websites
Prevent users from visiting compromised or suspicious sites
Stop "drive-by downloads" where just visiting a page installs malware.

(This is like having a bouncer who won't let you into dangerous establishments)

4. Endpoint protection - AKA Anti-virus and similar systems

Antivirus and anti-malware software on every device
Real-time scanning of downloads and file access
Behavioral analysis to catch new, unknown threats

(Your last line of defense on the actual computer)

5. Application Hardening and Control

Only allow approved applications to run - Blocks unauthorized software from executing, even if it gets delivered

6. USB/removable device controls

Disable or restrict USB ports and external drives
Scan any allowed external media before use

(This prevents infected USB sticks delivering an weaponised package - a surprisingly common delivery method)

7. Patch Management and Updates

Keep all software updated to close known vulnerabilities

(Many attacks deliver through exploiting outdated software)

8. Disable Office macros by default (as we discussed earlier!)

While you can’t stop Weaponisation, being aware that it’s happening helps with killing the attack at Delivery.

Lesson 3. Weaponisation and Delivery