Were you the black sheep in your organization who clicked the link or downloaded the attachment? That’s a bummer. But don't feel bad, it can happen to the best of us. At the CLOUDMEN office, we're dealing (literally) daily with clients who have accidentally clicked on phishing links or placed malicious zip files etc. on their computers.
The (international) news is dominated by it these days as well. Even large banks and companies are increasingly facing security breaches, AI is "breaking out" and taking over the world... It is good that awareness is being created, but panic-driven reactions are never good. Above all, use your common sense.
Wait, why am I suddenly asked to login?
Indeed, good question.
What we see most often are "emails from colleagues" or "clients" with a link to a (fake) Google login page. It looks so real (except for the URL!) that you unknowingly enter your credentials and MFA, which are then received by the malicious hacker through the back door. The same goes for credible Microsoft, Dropbox, OneDrive... "invitations." Keep in mind, it's no coincidence that your attacker knows what you recognize and trust!
Know that the only real link in your browser bar you should see is: accounts.google.com!
Nothing to worry about?
Due to automated exploits, targeted phishing, deepfakes, AI, etc., vulnerabilities or an incident are not just a matter of carelessness anymore, but purely a matter of time or statistics. It is not so much a question of if/how an organization is targeted, but the effectiveness and calm of the response to the attack and how far the damage can seep through.
Have you received spam or phishing and it is actually marked as spam? Nothing to worry about. As long as you don't click on anything, download, or log in... it is sufficient to ignore the email (or text message, calendar invite, WhatsApp, etc.). Are you in doubt? Then report it as spam just to be safe and block the sender. Better to report one too many than one too few!
F***
Do you suddenly feel that you might have done something wrong, clicked on too far? Do you suddenly notice something weird? What can you do if it is "too late"?
As with most crisis situations, the first motto is: stay calm. And the second: notify your IT manager (or CLOUDMEN).
-
Is your computer compromised? Isolate your device from the network immediately. Disconnect all network connections immediately (unplug cables and turn off Wi-Fi and BlueTooth). This prevents further spread on the physical workplace or within the network (lateral movement). Deleting the package (or even emptying your trash) is useless if it has already been opened. On the contrary, it makes it harder to determine what was actually inside and what damage your device (possibly) sustained.
-
Has your password been stolen? Assume that your business account (i.e., your contacts, your mailbox, passwords, etc.) is being monitored by the attacker. Immediately reset your Google password and log out everywhere (i.e. from all your devices and from all your browser sessions). Preferably, this is done (by you or your admin) on another, secure device, in case the hacker is still watching. And let's hope and pray you only used this particular password for this account?!
- Has anything already been sent out? Have emails been sent from your account to your contacts, has your computer sent out things or shared items with others? Inform the recipients to ignore your message.
- Do you have financial or legal damages? Contact your bank, your insurer, your advisor, your lawyer. Unfortunately, we are not authorized for that.
Deepfake, voice cloning, vishing, jailbreak, ransomware, stuffing, shadowing, social engineering, zero-days, password spraying, MFA-bombs...
We get that you don't get it anymore. You can't blink twice or there are new criminal techniques you should be afraid of. But a well-protected work environment can do a lot, you know. Only, this is a long-term process and one you have to be working on day in and day out. And, alas, one where there is often a lot of resistance. "Do we really have to..." Yes, you do.
Unfortunately, you cannot rely on technology alone. Tools detect patterns, but internal processes and trained people stop incidents. Awareness and training people remains the most important hurdle to keeping hackers out!
We repeat once again what you can do to prevent rather than cure.
- Ensure your software and hardware are up to date. Hackers find new weaknesses every day, but developers fortunately also create patches every day to solve them. An update is not there to make your life miserable (or to give you a fifteen-minute break), but to keep your devices and tools safe!
- Choose secure and different passwords and A.L.W.A.Y.S. use two-step verification. Every AI bot can (soon) kick down the front door, but identifying yourself to the bouncer with your fingerprint, face, SMS code... is not easy, even for AI.
- Don't just tighten up your Google Workspace panel and permissions, but also use the available tools. A good password manager, antivirus software, mobile device management system, etc., are not just tricks to get your money. They are necessary.
Now more than ever.
Catch up on the latest about third party apps.
