Cybersecurity Training for Managers

Attackers rely on the fact that the victim often reacts intuitively (on autopilot). This is based on the well-known principles of how the human mind works, as described and popularized by Daniel Kahneman, known as fast and slow thinking:

• System 1: Fast, intuitive = autopilot – decision-making is based on experience and emotions. It is quick and effortless, but at the same time, it is easily manipulable and prone to cognitive biases. This is the system attackers target – they use time pressure, fear, or seemingly trustworthy cues to get the victim to react impulsively
• System 2: Slow, analytical – decision-making is conscious, requiring focus and careful consideration of information. This system is more resistant to manipulation because it can critically analyze situations and verify facts

The attacker purchased a domain (munl.cz) for less than 200 CZK, which mimicked the legitimate domain of Masaryk University (muni.cz). Using a publicly available guide on the internet, they set up an email server on this domain and sent phishing emails that closely resembled messages from INET. In these emails, the recipient was prompted to click on a fraudulent link leading to a fake login page.

This page visually replicated the legitimate MUNI Unified Login portal. Users who rely on multi-factor authentication and the verification code method (TOTP), believing they were logging into the real university website, entered their code – thereby handing it directly to the attacker. The attacker then gained access to their accounts and could immediately misuse them.

Lesson learned: Even weaker methods of multi-factor authentication won't protect you. Replace TOTP with a security key.

What happened: Attackers used publicly available data for a targeted spear-phishing attack. They focused on the membership fees of an organization where Masaryk University is listed as a member. About a month before the actual payment deadline, they initiated communication with the correct contact person at MU, and under the pretext of administratively handling the payment, exchanged several emails. Through this conversation, they gained trust and were able to convince the university employee to pay a fake invoice worth several thousand euros. The fraud was only discovered when the real invoice arrived.

Similar frauds have been recorded for at least five years. The same attack vector was used against other entities, such as airline companies. Even though more people were involved in the payment approval process, no one found it suspicious.

Lesson learned: Manipulation of the victim ("gaining trust") and the abuse of the "autopilot" in decision-making cannot be solved with technical measures, but by building the right habits.

The MU Cybersecurity Team (CSIRT-MU) coordinates the resolution of security incidents caused by phishing or malware, data breaches, or login credential leaks. Technical issues (e.g., forgotten passwords or non-functioning VPN) are handled by technical support.