Infradapt @infradapt - Tumblr Blog

The New Insider Threat: When Hackers Recruit Your Employees

.elementor-69372 .elementor-element.elementor-element-f4be128text-align:left;.elementor-69372 .elementor-element.elementor-element-f4be128 .elementor-heading-titlecolor:#1A277D;font-family:"Roboto", Sans-serif;font-weight:600;line-height:40px;.elementor-69372 .elementor-element.elementor-element-f4be128 > .elementor-widget-containerpadding:50px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-element-38cf8edpadding:24px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-element-7e02624 > .elementor-widget-containermargin:24px 0px 0px 0px;padding:0px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-element-7e02624width:var( --container-widget-width, 100% );max-width:100%;--container-widget-width:100%;--container-widget-flex-grow:0;.elementor-69372 .elementor-element.elementor-element-ca36126 > .elementor-widget-containerpadding:22px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-element-c0cdda0 .elementor-heading-titlecolor:#1A277D;font-family:"Roboto", Sans-serif;font-weight:600;text-transform:capitalize;.elementor-69372 .elementor-element.elementor-element-c0cdda0 > .elementor-widget-containerpadding:15px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-element-6920969font-family:"Roboto", Sans-serif;font-weight:400;line-height:24px;.elementor-69372 .elementor-element.elementor-element-359c518 .elementor-heading-titlefont-family:"Roboto", Sans-serif;font-weight:600;text-transform:capitalize;.elementor-69372 .elementor-element.elementor-element-ca78abffont-family:"Roboto", Sans-serif;font-weight:400;line-height:24px;.elementor-69372 .elementor-element.elementor-element-48bb51a .elementor-heading-titlecolor:#1A277D;font-family:"Roboto", Sans-serif;font-weight:600;text-transform:capitalize;.elementor-69372 .elementor-element.elementor-element-48bb51a > .elementor-widget-containerpadding:15px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-element-b948638 .elementor-heading-titlefont-family:"Roboto", Sans-serif;font-weight:600;text-transform:capitalize;.elementor-69372 .elementor-element.elementor-element-7bf846c .elementor-heading-titlefont-family:"Roboto", Sans-serif;font-weight:600;text-transform:capitalize;.elementor-69372 .elementor-element.elementor-element-4bf715d .elementor-heading-titlefont-family:"Roboto", Sans-serif;font-weight:600;text-transform:capitalize;.elementor-69372 .elementor-element.elementor-element-77a7283 .elementor-heading-titlecolor:#1A277D;.elementor-69372 .elementor-element.elementor-element-77a7283 > .elementor-widget-containerpadding:15px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-element-795efb6 .elementor-heading-titlefont-family:"Roboto", Sans-serif;font-weight:600;text-transform:capitalize;.elementor-69372 .elementor-element.elementor-element-5ab5114 .elementor-heading-titlefont-family:"Roboto", Sans-serif;font-weight:600;text-transform:capitalize;.elementor-69372 .elementor-element.elementor-element-f6250ac .elementor-heading-titlecolor:#1A277D;.elementor-69372 .elementor-element.elementor-element-f6250ac > .elementor-widget-containerpadding:15px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-element-1ebd8f1 .elementor-heading-titlefont-family:"Roboto", Sans-serif;font-weight:600;text-transform:capitalize;.elementor-69372 .elementor-element.elementor-element-c158448 .elementor-heading-titlefont-family:"Roboto", Sans-serif;font-weight:600;text-transform:capitalize;.elementor-69372 .elementor-element.elementor-element-782268e .elementor-heading-titlecolor:#1A277D;font-family:"Roboto", Sans-serif;font-weight:600;text-transform:capitalize;.elementor-69372 .elementor-element.elementor-element-782268e > .elementor-widget-containerpadding:15px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-element-6d8ba47 .elementor-heading-titlecolor:#1A277D;font-family:"Roboto", Sans-serif;font-weight:600;text-transform:capitalize;.elementor-69372 .elementor-element.elementor-element-6d8ba47 > .elementor-widget-containerpadding:15px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-element-2f411ac--spacer-size:50px;.elementor-69372 .elementor-element.elementor-element-e29efd7 > .elementor-element-populatedpadding:0px 30px 0px 30px;.elementor-69372 .elementor-element.elementor-element-6ad36d0 .elementor-heading-titlecolor:#00096E;font-family:"Source Sans Pro", Sans-serif;font-weight:300;.elementor-69372 .elementor-element.elementor-element-6ad36d0 > .elementor-widget-containermargin:0px 0px 0px 40px;padding:0px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-element-330f8a1 .elementor-heading-titlecolor:#1A227D;font-family:"Source Sans Pro", Sans-serif;font-size:3.2em;font-weight:300;.elementor-69372 .elementor-element.elementor-element-330f8a1 > .elementor-widget-containermargin:-20px 0px 0px 0px;padding:0px 0px 0px 40px;.elementor-69372 .elementor-element.elementor-global-47750 .elementor-field-grouppadding-right:calc( 10px/2 );padding-left:calc( 10px/2 );margin-bottom:13px;.elementor-69372 .elementor-element.elementor-global-47750 .elementor-form-fields-wrappermargin-left:calc( -10px/2 );margin-right:calc( -10px/2 );margin-bottom:-13px;.elementor-69372 .elementor-element.elementor-global-47750 .elementor-field-group.recaptcha_v3-bottomleft, .elementor-69372 .elementor-element.elementor-global-47750 .elementor-field-group.recaptcha_v3-bottomrightmargin-bottom:0;body.rtl .elementor-69372 .elementor-element.elementor-global-47750 .elementor-labels-inline .elementor-field-group > labelpadding-left:0px;body:not(.rtl) .elementor-69372 .elementor-element.elementor-global-47750 .elementor-labels-inline .elementor-field-group > labelpadding-right:0px;body .elementor-69372 .elementor-element.elementor-global-47750 .elementor-labels-above .elementor-field-group > labelpadding-bottom:0px;.elementor-69372 .elementor-element.elementor-global-47750 .elementor-field-type-htmlpadding-bottom:0px;color:#54595F;.elementor-69372 .elementor-element.elementor-global-47750 .elementor-field-group:not(.elementor-field-type-upload) .elementor-field:not(.elementor-select-wrapper)background-color:#F5F5F5;border-width:0px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-global-47750 .elementor-field-group .elementor-select-wrapper selectbackground-color:#F5F5F5;border-width:0px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-global-47750 .elementor-buttonfont-family:"Source Sans Pro", Sans-serif;font-weight:500;.elementor-69372 .elementor-element.elementor-global-47750 .e-form__buttons__wrapper__button-nextbackground-color:#137EFA;color:#FFFFFF;.elementor-69372 .elementor-element.elementor-global-47750 .elementor-button[type="submit"]background-color:#137EFA;color:#FFFFFF;.elementor-69372 .elementor-element.elementor-global-47750 .elementor-button[type="submit"] svg *fill:#FFFFFF;.elementor-69372 .elementor-element.elementor-global-47750 .e-form__buttons__wrapper__button-previouscolor:#ffffff;.elementor-69372 .elementor-element.elementor-global-47750 .e-form__buttons__wrapper__button-next:hovercolor:#ffffff;.elementor-69372 .elementor-element.elementor-global-47750 .elementor-button[type="submit"]:hovercolor:#ffffff;.elementor-69372 .elementor-element.elementor-global-47750 .elementor-button[type="submit"]:hover svg *fill:#ffffff;.elementor-69372 .elementor-element.elementor-global-47750 .e-form__buttons__wrapper__button-previous:hovercolor:#ffffff;.elementor-69372 .elementor-element.elementor-global-47750 .elementor-messagefont-size:26px;.elementor-69372 .elementor-element.elementor-global-47750 .elementor-message.elementor-message-successcolor:#00FF00;.elementor-69372 .elementor-element.elementor-global-47750 .elementor-message.elementor-message-dangercolor:#FA0000;.elementor-69372 .elementor-element.elementor-global-47750--e-form-steps-indicators-spacing:20px;--e-form-steps-indicator-padding:30px;--e-form-steps-indicator-inactive-secondary-color:#ffffff;--e-form-steps-indicator-active-secondary-color:#ffffff;--e-form-steps-indicator-completed-secondary-color:#ffffff;--e-form-steps-divider-width:1px;--e-form-steps-divider-gap:10px;.elementor-69372 .elementor-element.elementor-global-47750 > .elementor-widget-containerpadding:0px 40px 0px 40px;.elementor-69372 .elementor-element.elementor-global-47750.ha-has-bg-overlay > .elementor-widget-container:beforetransition:background 0.3s;.elementor-69372 .elementor-element.elementor-element-b4ca180--spacer-size:50px;.elementor-69372 .elementor-element.elementor-element-4b5a0b1 .elementor-heading-titlecolor:#1A277D;font-family:"Roboto", Sans-serif;font-weight:600;.elementor-69372 .elementor-element.elementor-element-4b5a0b1 > .elementor-widget-containerpadding:15px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-element-c478186 .elementor-heading-titlecolor:#1A277D;font-family:"Roboto", Sans-serif;font-weight:600;text-transform:capitalize;.elementor-69372 .elementor-element.elementor-element-c478186 > .elementor-widget-containerpadding:15px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-element-7837412 .elementor-heading-titlecolor:#1A277D;font-family:"Roboto", Sans-serif;font-weight:600;text-transform:capitalize;.elementor-69372 .elementor-element.elementor-element-7837412 > .elementor-widget-containerpadding:15px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-element-ed2278f .elementor-heading-titlecolor:#1A277D;font-family:"Roboto", Sans-serif;font-weight:600;text-transform:capitalize;.elementor-69372 .elementor-element.elementor-element-ed2278f > .elementor-widget-containerpadding:15px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-element-188577c .elementor-heading-titlecolor:#1A277D;font-family:"Roboto", Sans-serif;font-weight:600;text-transform:capitalize;.elementor-69372 .elementor-element.elementor-element-188577c > .elementor-widget-containerpadding:15px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-element-0a422d5 .elementor-heading-titlecolor:#1A277D;font-family:"Roboto", Sans-serif;font-weight:600;text-transform:capitalize;.elementor-69372 .elementor-element.elementor-element-0a422d5 > .elementor-widget-containerpadding:15px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-element-08b69ca .elementor-heading-titlecolor:#1A277D;font-family:"Roboto", Sans-serif;font-weight:600;text-transform:capitalize;.elementor-69372 .elementor-element.elementor-element-08b69ca > .elementor-widget-containerpadding:15px 0px 0px 0px;@media(max-width:1024px).elementor-69372 .elementor-element.elementor-element-6ad36d0 > .elementor-widget-containermargin:20px 0px 0px 30px;.elementor-69372 .elementor-element.elementor-element-330f8a1 > .elementor-widget-containermargin:-20px 0px 0px 0px;padding:0px 0px 0px 30px;.elementor-69372 .elementor-element.elementor-global-47750 > .elementor-widget-containerpadding:0px 0px 50px 0px;@media(min-width:768px).elementor-69372 .elementor-element.elementor-element-93fe185width:35%;.elementor-69372 .elementor-element.elementor-element-821196cwidth:65%;@media(max-width:1024px) and (min-width:768px).elementor-69372 .elementor-element.elementor-element-e29efd7width:100%;@media(max-width:767px).elementor-69372 .elementor-element.elementor-element-e29efd7 > .elementor-element-populatedmargin:-100px 0px 0px 0px;--e-column-margin-right:0px;--e-column-margin-left:0px;padding:0px 10px 0px 10px;.elementor-69372 .elementor-element.elementor-element-6ad36d0text-align:center;.elementor-69372 .elementor-element.elementor-element-6ad36d0 > .elementor-widget-containermargin:0px 0px 0px 0px;padding:0px 0px 0px 0px;.elementor-69372 .elementor-element.elementor-element-330f8a1text-align:center;.elementor-69372 .elementor-element.elementor-element-330f8a1 .elementor-heading-titlefont-size:2.1em;.elementor-69372 .elementor-element.elementor-element-330f8a1 > .elementor-widget-containermargin:-18px 0px 0px 0px;padding:0px 0px 0px 0px;

The New Insider Threat: When Hackers Recruit Your Employees

The classic insider threat story used to be simple: a disgruntled employee steals data, or someone makes a mistake and clicks the wrong link. That still happens. What is changing is the playbook on the other side.

Recent reporting describes threat actors actively recruiting employees and contractors who already have legitimate access, especially people who feel overlooked, underpaid, or worried about job security.

For business leaders, this is a different kind of risk. Many security controls are built to keep outsiders out. Recruited insiders can walk around those controls because they already have keys, passwords, and trusted device access.

This article explains what the “new insider threat” looks like, how to spot early warning signs, and how to reduce risk without turning your workplace into a surveillance state.

Why insider recruitment works and what it puts at risk

When criminals recruit insiders, they are not trying to “hack” in the traditional sense. They are trying to buy a shortcut around security. The most common targets are people who can do any of the following:

approve payments or update vendor bank details

access customer lists, HR files, or sensitive documents

create new accounts, reset passwords, or disable security tools

export data from a system that does not log activity well

provision access in cloud apps or identity tools

Recruitment can start quietly. A message on social media. A “consulting” offer. A promise of quick money for “just one export” or “a screenshot.” Reporting notes that some attackers look for people affected by layoffs, demotions, or workplace dissatisfaction.

What makes this so damaging is that the activity can look normal at first. If a trusted employee exports a file, the export itself is not always suspicious. Context matters: why, when, and how often.

A practical way to think about the risk is this: insider recruitment attacks the trust layer of your business. It is not only an IT issue. It is an operations issue, a finance issue, and a people issue.

Many organizations start by formalizing insider risk as part of their overall security governance and liability planning, including policies, roles, and response steps that line up with resources like cybersecurity and liability protection from Infradapt.

Key Takeaways

Insider recruitment is a shortcut around perimeter controls because the insider already has legitimate access.

High-risk roles include finance, IT administration, HR, and anyone with broad data export rights.

Early recruitment often looks like a “side gig,” not an obvious threat.

Treat insider risk as a cross-functional business risk, not just a security problem.

Early warning signs that do not rely on “mind reading”

Leaders often ask for a list of “red flags.” The problem is that people are complicated, and most warning signs have innocent explanations. The goal is not to label employees as threats. The goal is to spot risk conditions where abuse would be easy and hard to detect.

Here are warning signs that are operational, observable, and relevant:

1) Access and behavior changes that do not match the role

Examples:

repeated access to systems that are unrelated to job duties

unusual file downloads or mass exports

new use of personal email, personal cloud storage, or removable media for work files

frequent password resets for others, or repeated account unlocks

These can be benign. They can also signal that someone is testing boundaries.

2) “Single point of failure” work patterns

If one person is the only one who can:

run payroll changes

approve vendor payment updates

administer your identity platform

manage backups

then you have a single-person access risk. That risk exists even if the person is trustworthy.

3) Process gaps that make abuse easy

Process gaps are often the real root cause:

no second approval for changing vendor bank details

shared admin accounts “for convenience”

unclear rules on what data can be exported and when

offboarding steps that rely on manual checklists and memory

This is where good operations design beats guesswork.

Pain Point #1: “We are afraid to monitor employees because of privacy and culture”

That fear is rational. Heavy-handed monitoring can damage trust, create HR risk, and still miss the real threats.

Actionable solution: create a “minimum necessary monitoring” policy

Monitor for high-risk actions, not personal content. Focus on exports, privilege changes, and sensitive data access.

Restrict monitoring to business systems and business accounts.

Document what is monitored, why, who can view it, and how long it is retained.

Require a clear escalation path that includes HR and legal where appropriate.

This approach supports security without defaulting to blanket surveillance. It also makes it easier to explain your practices to employees in plain language.

Example: a professional services firm with a “helpful” data exporter

Example: A consulting firm notices a project manager exporting large client folders “to work faster at home.” The real issue is that the official remote workflow is slow and frustrating. The firm improves the approved workflow, limits bulk export permissions for that role, and adds logging for high-risk exports. The outcome is fewer workarounds and fewer opportunities for abuse.

Key Takeaways

Look for role-to-access mismatches and process gaps, not personality traits.

Single-person access risk is a business continuity issue as much as a security issue.

Privacy-respecting monitoring focuses on high-risk actions, not personal content.

Many “red flags” are created by broken workflows that push people into workarounds.

Least privilege and access design that makes insider recruitment harder

Least privilege means people get the minimum access needed to do their job, and nothing more. It is one of the most effective ways to reduce insider risk because it limits what any one compromised or recruited account can do.

If you want one sentence: insider recruitment gets harder when access is narrow, time-limited, and well logged.

Start with your highest-risk access types

Prioritize these first:

privileged admin access (especially identity and endpoint tools)

finance approvals and payment system access

HR and payroll systems

customer data repositories

backups and recovery tooling

Then apply three controls that work well together:

Role-based access: access tied to a defined job role, not an individual “because they need it.”

Time-bound elevation: admin rights only when needed for a task, then removed.

Separation of duties: no single person can complete a full high-risk action end to end.

A Gartner prediction points to where many organizations are heading: by 2027, 70% of organizations will combine data loss prevention and insider risk management with identity and access management context to identify suspicious behavior more effectively. (Gartner, “Gartner Unveils Top Eight Cybersecurity Predictions for 2024,” 2024.)

You do not need to adopt everything at once to benefit. Even partial improvements reduce the “blast radius” of one account.

To keep access changes consistent across endpoints and networks, many organizations align this work with their operational IT management model, such as IT support and network management from Infradapt.

Reduce shared accounts and “everyone is an admin”

Shared accounts are a gift to attackers. They also make investigations harder because accountability is unclear.

A practical replacement is:

named accounts for admins

separate admin accounts from daily work accounts

strict logging on privileged sessions

approval workflows for sensitive changes

Key Takeaways

Least privilege reduces the damage an insider can cause and limits what a recruited account can do.

Focus first on privileged access, finance, HR, customer data, and backups.

Replace shared accounts with named admin accounts and strong logging.

Separation of duties removes the single-person “complete the action” pathway.

Cyber insurance is an important safety net, but coverage depends on meeting the requirements written into the policy. The most common causes of denied or reduced claims include missing controls, outdated documentation, and a lack of risk assessment or continuity testing.

By building a structured readiness strategy and maintaining consistent security practices, organizations can protect themselves financially and operationally.

To learn how to strengthen your cyber insurance readiness and long term IT resilience, explore the managed IT services overview from Infradapt.

Monitoring that respects privacy

Most organizations want detection but do not want to create a surveillance culture. That is reasonable. The best approach is to monitor high-risk actions on business systems, not personal content.

Focus monitoring on:

bulk downloads and exports

privilege escalation and new admin grants

disabling security tools

creation of new accounts or access keys

unusual remote access patterns

To keep it fair and defensible:

document what is monitored and why

restrict access to logs

set retention rules

involve HR and legal in escalation procedures

This type of governance often fits alongside broader risk and incident readiness planning like cybersecurity liability protection from Infradapt.

Key Takeaways

Monitor risky actions, not personal content.

Logging is only useful if it is consistent and reviewed.

Clear rules and boundaries protect culture and reduce HR risk.

A defined escalation path prevents ad hoc reactions.

Offboarding controls that close the most common gaps

Offboarding is a top risk window because access can linger. Strong offboarding is mostly process discipline.

Minimum controls:

disable accounts at separation time, not later

remove access from key SaaS apps and admin tools

rotate shared credentials and known secrets

confirm device return and data handling

review recent high-risk actions around departure

If business continuity is tied to a small number of admins, combine offboarding hardening with resilience planning like disaster recovery and continuity guidance from Infradapt.

Key Takeaways

Offboarding failures create lingering access that is easy to exploit.

Disable accounts quickly and remove SaaS access systematically.

Rotate shared secrets and review high-risk activity around departures.

Reduce “keys to the kingdom” dependence on any one person.

To deepen your understanding of operational controls that reduce insider risk, review outsourced IT guidance from Infradapt.

SCHEDULE YOUR

FREE CONSULTATION

Name

I need help with...

Message

GET STARTED

FAQ: Cyber Insurance Coverage and Readiness

What is the “insider threat” in cybersecurity?

An insider threat is a security risk caused by someone with legitimate access to a company’s systems, data, or facilities, such as an employee, contractor, or vendor, who misuses that access intentionally or unintentionally.

What does it mean when hackers “recruit” employees?

Hackers recruiting employees means attackers try to pay, pressure, or trick workers into helping them bypass security. This can include sharing credentials, exporting data, approving payments, or providing access to internal systems.

What are the most common signs of an insider threat at work?

Common signs include unusual access to systems unrelated to a role, sudden spikes in downloads or data exports, repeated privilege requests, use of unapproved file-sharing tools, or changes to security settings without a clear business need.

Which roles are most targeted for insider recruitment attacks?

Roles with high-value access are most targeted, including IT administrators, finance and accounts payable staff, HR and payroll teams, and employees who can export large amounts of sensitive customer or business data.

How can a business reduce insider threat risk without invading employee privacy?

Businesses can focus monitoring on high-risk actions in company systems, like bulk exports, privilege changes, and disabling security tools, while avoiding personal content. Clear policies on what is logged and who can access logs help maintain trust.

What is “single-person access risk,” and why does it matter?

Single-person access risk is when one person can complete a critical action alone, such as changing vendor banking details, creating admin accounts, or controlling backups. It matters because it increases the chance of fraud or sabotage and makes incidents harder to detect and recover from.

https://www.infradapt.com/news/the-new-insider-threat-when-hackers-recruit-your-employees/

Windows 10 End of Support Aftershock: Migration, ESU, and Real-World Business Risk

3 Mistakes That Will Void Your Cyber Insurance Coverage

Cyber insurance is an increasingly important part of a modern risk management strategy, but many organizations are surprised to learn that their policies can be denied or limited if certain conditions are not met. Insurers expect businesses to maintain specific security controls, follow written procedures, and document their risk management efforts. If these expectations are not met, claims can be rejected or coverage may be reduced.

This article explains the three most common mistakes that invalidate cyber insurance coverage and provides practical steps to avoid them.

Mistake 1: Not Maintaining Required Security Controls

Why this mistake matters

Cyber insurance policies often list technical safeguards that must be in place for coverage to apply. These include multi factor authentication for administrative accounts, updated endpoint protection, secure backups, encryption, and regular patching. If a breach occurs and the insurer discovers these controls were missing or inconsistent, the claim may be denied.

Organizations that rely on multiple systems, remote work, or third party providers often struggle to maintain these controls consistently.

Support services such as managed IT services from Infradapt help organizations maintain the controls insurers expect.

How To Avoid It

Implement multi factor authentication across all critical systems.

Regularly update and patch operating systems and applications.

Use modern endpoint protection with monitoring capabilities.

Maintain secure, offsite backups and test recovery processes.

Review controls during onboarding and offboarding of staff.

Document any exceptions and plan corrective actions.

Example: Coverage denial due to missing MFA

A consulting firm suffered a credential based attack that compromised email accounts. The insurer requested evidence of MFA for administrative users. The organization had rolled out MFA to employees but not to privileged accounts. The insurer denied part of the claim because a required control was missing.

Mistake 2: Incomplete or Outdated Documentation

Why this mistake matters

Cyber insurers often ask for written policies, training records, incident response plans, continuity plans, and system inventories. If these documents are outdated or incomplete, insurers may argue that the organization failed to follow reasonable security practices.

This is especially important during renewal questionnaires, which insurers use to verify whether controls and procedures match what is written in the policy.

Organizations can maintain accurate documentation through support services such as IT support and network management from Infradapt.

How to avoid it

Maintain updated policies for security, access control, acceptable use, and incident response.

Keep records of user training and awareness activities.

Document changes to systems, networks, and applications.

Update inventories of assets, vendors, and data types.

Review and update documentation during annual assessments.

Example: Long response delays due to unclear procedures

A manufacturer experienced a ransomware event. The insurer requested documentation of the incident response plan and backup procedures. The policies had not been updated in several years, and backup testing logs were missing. The claim was delayed for months while the organization reconstructed records and explained gaps.

Mistake 3: Not Performing Risk Assessments or Testing Critical Plans

Why this mistake matters

Cyber insurers increasingly require annual risk assessments and updated business continuity plans. They want proof that organizations understand their vulnerabilities and have taken steps to address them. If no risk assessment has been completed or if continuity plans have not been tested, insurers may reduce coverage or add exclusions.

Services such as disaster recovery and continuity planning from Infradapt help organizations test their readiness and document results.

How to avoid it

Complete a formal IT risk assessment each year or before major technology changes.

Use assessments to prioritize improvements and address high risk gaps.

Review continuity and recovery plans at least annually.

Conduct tabletop exercises or technical recovery tests to validate readiness.

Document findings and corrective actions.

Example: Reduced coverage due to lack of assessments

A financial services firm applied for cyber insurance renewal. The insurer requested the previous year’s risk assessment and continuity test results. The organization had not conducted either. The insurer added exclusions to the policy and increased the deductible until the assessments were completed.

Additional Best Practices for Protecting Your Coverage

Train employees on phishing, password hygiene, and safe data practices.

Validate vendor security and confirm contract terms align with insurance obligations.

Keep incident logs and retain evidence from security tools.

Review policy wording to understand what insurers consider mandatory.

Maintain long term oversight through managed IT for businesses from Infradapt.

Conclusion

By building a structured readiness strategy and maintaining consistent security practices, organizations can protect themselves financially and operationally.

To learn how to strengthen your cyber insurance readiness and long term IT resilience, explore the managed IT services overview from Infradapt.

SCHEDULE YOUR

FREE CONSULTATION

FAQ: Cyber Insurance Coverage and Readiness

Why do cyber insurance claims get denied even when a policy is active?

Claims are often denied because required security controls were not in place, documentation was outdated, or incident response procedures were not followed. Insurers expect businesses to maintain the protections listed in the policy.

Do cyber insurance carriers check your security controls before approving a policy?

Many carriers do. Some conduct pre underwriting assessments, review questionnaires, or ask for evidence of controls like MFA, backup testing, or endpoint protection. Others verify controls during a renewal or after a claim.

Is cyber insurance still useful if we have strong security already?

Yes. Even strong security cannot eliminate all risk. Cyber insurance helps organizations handle costs related to legal obligations, forensics, downtime, customer communication, and regulatory requirements after an incident.

Can a small business meet modern cyber insurance requirements?

Yes, but smaller teams often need outside help. Managed service providers or vCIO support can help build and maintain the controls insurers expect, such as risk assessments, documentation, and continuity planning.

How often should we update policies and documentation to meet insurer expectations?

Most organizations update documentation annually or when major technology changes occur. Insurers prefer to see current policies, training logs, system inventories, and continuity plans during underwriting.

Are cyber insurance requirements the same for all industries?

No. Requirements differ depending on the type of data you handle, your systems, and your operational risk. Regulated sectors like healthcare, education, and finance typically face more detailed questions and controls.

https://www.infradapt.com/news/windows-10-end-of-support-migration-esu-business-risk/

What Business Owners Need to Know About NIST's 2025 Digital Identity Guidelines

https://www.infradapt.com/news/what-business-owners-need-to-know-about-nists-2025-digital-identity-guidelines/

The Hidden Costs of DIY IT: Why ‘Good Enough’ Isn’t Enough Anymore

.elementor-68437 .elementor-element.elementor-element-1dec012 .elementor-heading-titlecolor:#1A277D;.elementor-68437 .elementor-element.elementor-element-1dec012 > .elementor-widget-containerpadding:50px 0px 0px 0px;.elementor-68437 .elementor-element.elementor-element-057d048 > .elementor-widget-containerpadding:29px 0px 0px 0px;.elementor-68437 .elementor-element.elementor-element-057d048width:var( --container-widget-width, 100% );max-width:100%;--container-widget-width:100%;--container-widget-flex-grow:0;.elementor-68437 .elementor-element.elementor-element-3efded8 .elementor-heading-titlecolor:#1A277D;.elementor-68437 .elementor-element.elementor-element-c592685 .elementor-heading-titlecolor:#1A277D;.elementor-68437 .elementor-element.elementor-element-598b915 .elementor-heading-titlecolor:#1A277D;.elementor-68437 .elementor-element.elementor-element-598b915 > .elementor-widget-containerpadding:15px 0px 0px 0px;.elementor-68437 .elementor-element.elementor-element-442a19b .elementor-heading-titlecolor:#1A277D;.elementor-68437 .elementor-element.elementor-element-fb98c6c .elementor-heading-titlecolor:#1A277D;.elementor-68437 .elementor-element.elementor-element-ddadcfa .elementor-heading-titlecolor:#1A277D;.elementor-68437 .elementor-element.elementor-element-eba39e6 .elementor-heading-titlecolor:#1A277D;.elementor-68437 .elementor-element.elementor-element-eba39e6 > .elementor-widget-containerpadding:15px 0px 0px 0px;.elementor-68437 .elementor-element.elementor-element-8261a0a .elementor-heading-titlecolor:#1A277D;.elementor-68437 .elementor-element.elementor-element-0d0d93e .elementor-heading-titlecolor:#1A277D;.elementor-68437 .elementor-element.elementor-element-c55455b .elementor-heading-titlecolor:#1A277D;.elementor-68437 .elementor-element.elementor-element-2c5d76c .elementor-heading-titlecolor:#1A277D;.elementor-68437 .elementor-element.elementor-element-2c5d76c > .elementor-widget-containerpadding:15px 0px 0px 0px;.elementor-68437 .elementor-element.elementor-element-385f48f .elementor-heading-titlecolor:#1A277D;.elementor-68437 .elementor-element.elementor-element-c8ddc53 .elementor-heading-titlecolor:#1A277D;.elementor-68437 .elementor-element.elementor-element-c87aeb4 .elementor-heading-titlecolor:#1A277D;.elementor-68437 .elementor-element.elementor-element-091a98e .elementor-heading-titlecolor:#1A277D;.elementor-68437 .elementor-element.elementor-element-6e77ca8 .elementor-heading-titlecolor:#1A277D;.elementor-68437 .elementor-element.elementor-element-6e77ca8 > .elementor-widget-containerpadding:15px 0px 0px 0px;.elementor-68437 .elementor-element.elementor-element-d2ba80e .elementor-heading-titlecolor:#1A277D;.elementor-68437 .elementor-element.elementor-element-d2ba80e > .elementor-widget-containerpadding:15px 0px 0px 0px;@media(min-width:768px).elementor-68437 .elementor-element.elementor-element-dcd2ff3width:35%;.elementor-68437 .elementor-element.elementor-element-03729e0width:65%;

The Illusion of Cost Savings: What DIY IT Really Costs SMBs

In today’s increasingly digital business environment, small and midsize businesses (SMBs) face a critical decision: how to manage their IT infrastructure effectively while balancing costs, security, and scalability. For many, the temptation to adopt a “do-it-yourself” (DIY) IT approach remains strong—often fueled by budget constraints, legacy mindsets, or the belief that internal teams can simply “figure it out.”

At first glance, DIY IT may seem sufficient. After all, what’s wrong with an in-house employee doubling as the go-to tech support person, or using a patchwork of free or inexpensive tools to keep systems running? However, this “good enough” mentality harbors a host of hidden costs, risks, and missed opportunities that can quietly erode profitability, productivity, and competitiveness.

In this article, we’ll go beyond the usual “outsourcing saves money” narrative and explore the deeper, often-overlooked consequences of DIY IT—helping business leaders and IT decision-makers make more informed, strategic choices.

Direct vs. Indirect Costs

On the surface, DIY IT appears budget-friendly—especially when compared to the perceived expense of managed IT services or professional support. But what’s often overlooked are the indirect costs and hidden risks that chip away at those supposed savings:

Opportunity Costs: When business owners, office managers, or employees moonlight as the IT department, they divert time and focus away from their core roles. This slows business growth, dilutes productivity, and can even harm customer experience.

Downtime Losses: DIY IT setups frequently lack the proactive monitoring, redundancy, and contingency planning necessary to prevent or mitigate downtime. Even brief outages can result in lost sales, reputational damage, and frustrated clients.

Reactive Spending: Without a strategic IT roadmap, SMBs are forced into reactive purchases—overpaying for hardware, software, or emergency fixes during crises.

Real-World Example: The $10,000 “Free Fix”

Consider an SMB that relies on an employee with basic tech skills to manage its email and file servers. When a ransomware attack strikes, the company has no off-site backups, no disaster recovery plan, and no cyber insurance. The cost? Weeks of downtime, thousands in lost revenue, and expensive remediation services. That “free” internal support suddenly looks a lot less affordable.

Productivity Drain: How DIY IT Sabotages Efficiency “Free Fix”

The IT Bottleneck Effect “Free Fix”

In a DIY IT environment, technical issues become roadblocks that bog down the entire organization. Employees spend valuable hours troubleshooting printers, rebooting servers, or wrestling with outdated systems. This creates an IT bottleneck that stifles daily operations and frustrates staff.

The “Shadow IT” Problem

Employees often resort to using unsanctioned tools and cloud services to bypass slow or inadequate IT support—introducing shadow IT risks, compliance vulnerabilities, and data governance nightmares.

Compounding Inefficiencies Over Time

Without strategic oversight, systems and tools become increasingly fragmented, inefficient, and difficult to scale. Processes that should be automated remain manual, leading to error-prone workflows and staff burnout.

Productivity Drain: How DIY IT Sabotages Efficiency “Free Fix”

Outdated Systems = Easy Targets

DIY IT environments are notorious for relying on legacy systems, unpatched software, and outdated security practices. Cybercriminals know this—and target SMBs accordingly. According to a recent study, 43% of cyberattacks target small businesses, many of which lack the defenses to withstand even basic phishing campaigns or malware attacks.

Regulatory Compliance Gaps

In industries subject to regulations like HIPAA, PCI-DSS, or GDPR, DIY IT can inadvertently expose businesses to fines, lawsuits, or lost contracts due to inadequate data protection practices or audit trails.

No Incident Response Plan

Most DIY IT setups lack a formal incident response plan. When a breach or outage occurs, the company scrambles to respond—often making mistakes that escalate costs and consequences.

The Business Case for Moving Beyond DIY IT

From Firefighting to Strategy

Outsourcing IT to a trusted Managed Services Provider (MSP), such as Infradapt, shifts the model from reactive support to proactive strategy—ensuring systems are always optimized, secure, and aligned with business goals.

Predictable Costs, Reduced Surprises

MSPs like Infradapt offer predictable, budget-friendly pricing models, helping businesses avoid costly surprises and enabling smarter financial planning.

Enterprise-Grade Security and Compliance

Partnering with an MSP provides access to enterprise-grade tools, threat intelligence, and compliance expertise that would be cost-prohibitive to maintain in-house.

Future-Proofing the Business

MSPs help SMBs plan for the future—designing IT roadmaps, guiding cloud migrations, and ensuring systems can scale with business growth.

Conclusion: ‘Good Enough’ Is the New Risk You Can’t Afford

In a world where technology underpins every aspect of business, relying on DIY IT is no longer a viable or responsible strategy. The hidden costs—lost productivity, security risks, compliance failures, and stunted growth—far outweigh any perceived savings.

SMBs that shift from DIY to professional, managed IT services position themselves to thrive in a digital-first economy. They gain not just cost efficiency, but also resilience, agility, and competitive advantage.

Next Steps: Let’s Talk About Eliminating Your Hidden IT Costs

At Infradapt, we specialize in helping SMBs uncover the true costs of their current IT approach and build a smarter, scalable technology strategy. Let’s explore how our Managed IT Services, cybersecurity solutions, and cloud infrastructure support can eliminate your hidden risks—and fuel your business growth.

Schedule a free IT risk assessment today and discover what ‘good enough’ might be costing you.

https://www.infradapt.com/news/the-hidden-costs-of-diy-it-why-good-enough-isnt-enough-anymore/

Understanding HDMI 2.1

The latest version of HDMI brings significant changes to the venerable format. Here’s what you need to know.

Even though the cable looks the same, modern HDMI connections are vastly more capable than when they first arrived over 20 years ago. The latest version, called 2.1b, is only a small update, but 2.1 in general is a big deal with lots of performance improvements and new features. The standard is found in the best new TVs, including recent models from LG, Samsung, Sony, TCL, Vizio and more. HDMI 2.1 is also on both of the next-generation game consoles, the PlayStation 5 and Xbox Series X. In fact, to get the most out of those consoles you’ll want a TV that supports at least some HDMI 2.1 features.

That doesn’t mean you need HDMI 2.1, however. For most people the extra features are not a good enough reason to buy a higher-end TV. If you’re on a budget, those new consoles will play perfectly well (and still look spectacular) on a TV that lacks HDMI 2.1. Many midrange and higher-end sets support the new connectivity standard, though, so it’s worthwhile to understand what it means if you are looking to purchase soon.

The short version is HDMI 2.1 allows for higher resolutions, higher frame rates and a lot more bandwidth. The connector itself isn’t changing, however, so new HDMI 2.1 gear will be backward-compatible with your current cables and equipment. But if you want to take advantage of everything 2.1 has to offer, you’ll need some select upgrades and potentially new cables, too. Here’s what you need to know.

The really short version

Don’t like reading (much)? Here are the highlights:

The physical connectors and cables look the same as today’s HDMI.

Improved bandwidth from 18 gigabits per second (HDMI 2.0) to 48Gbps (HDMI 2.1).

Can carry resolutions up to 10K, frame rates up to 120 frames per second.

New cables are required for higher resolutions and/or frame rates.

Many new TVs have at least one HDMI 2.1 input.

The main sources that can take advantage of 2.1 right now are the PlayStation 5 and Xbox Series X, as well as high-end graphics cards.

The increased resolution and frame rate possibilities are a futurist’s dream:

4K50/60

4K100/120

5K50/60

5K100/120

8K50/60

8K100/120

10K50/60

10K100/120

You should be able to get 4K/60, and a basic 8K/30, with current cables, but the rest will need an Ultra High Speed HDMI cable. More on these new cables below.

On the color front, 2.1 supports BT.2020 and 16 bits per color. This is the same as HDMI 2.0a/b, and is what makes wide color gamut possible.

https://www.infradapt.com/news/understanding-hdmi-2-1/

Ensuring Mobile Safety: Avoid These 5 Warning Signs When Downloading Apps

The Importance of Vigilance in App Downloading Practices

In the modern era, mobile applications have become an integral part of our lives, providing us with a multitude of conveniences ranging from email checking, music and movie streaming, to secure work access. However, as the number of apps we download and install increases, so does the risk associated with them. A study by York University in Toronto and the University of Connecticut revealed that many users unknowingly consented to give their future firstborn children to a fictitious company named NameDrop, highlighting the lack of due diligence when it comes to reading terms of service (ToS) and privacy policies, or verifying the permissions required by an app.

Despite the efforts of companies like Apple and Google to prevent app tracking across iOS and Android, it remains crucial to remain vigilant during app installation. This article outlines several warning signs to look out for when downloading apps.

The Risk of Third-Party App Stores and Sideloaded Apps

One of the simplest ways to ensure safety when downloading mobile apps is to use official app stores such as Google Play for Android and Apple’s App Store. These platforms meticulously scrutinize apps before listing them. Although occasionally, harmful or unsafe applications may slip through, they are quickly removed by Apple and Google. These first-party app stores also employ additional safety measures. For instance, Google Play Protect scans devices and apps for harmful activity, and the Google Play Store conceals apps that haven’t been updated for years and may have security vulnerabilities.

We recommend downloading apps directly from official Apple and Google Play app stores rather than alternative sources like APKPure or Aptoide. If you must use third-party app marketplaces, stick to reputable sites like the Amazon App Store or Samsung Galaxy Store. In rare cases where sideloading is the only option, ensure that you download apps directly from the official software website.

The Complexity of App Privacy Policies and Terms of Service

If you aren’t meticulously reading each app’s ToS agreement or privacy policy before accepting, you’re in the majority. However, a warning sign to be aware of is when an app’s ToS or privacy policy is so complex that it’s incomprehensible. While intricate language could be harmless, such as poor writing, apps with ToS or privacy policies that obscure what you’re agreeing to are deceptive and should be avoided. A good rule of thumb is not to agree to anything you don’t fully understand. Be sure to look for information on what data is being collected and how it’s used.

Privacy policies that require implicit consent should also be a cause for concern. Nader Henein, a senior research director and fellow of information privacy at Gartner, cautions against privacy policies with implicit agreements. Instead of opting in, a ToS agreement might state something like “by using this app, you agree to A, B, and C.” With implicit agreements, you’re not giving your consent, but a general disclaimer opts you in. Privacy policies and ToS should provide explicit consent, where you have to accept before using an app. But remember, it’s crucial to read the agreements thoroughly.

Simplifying Terms of Service and Privacy Policies with TOSDR

If you’re short on time, consider using the Terms of Service; Didn’t Read (TOSDR) browser addon. TOSDR is a collaborative project where anyone can review the terms and policies of any website. It simplifies these documents into a quick and readable format. TOSDR categorizes privacy policies and website terms into different classes, with Class A being the best and Class E being the worst. Chapter 1: Evaluating App Classifications and User Ratings

In addition to a general class score, users can provide their evaluations for different sections of the terms, categorizing them as Good, Bad, Blocker, or Neutral. A critical aspect to consider is whether the app is generating revenue by gathering and selling user data. It is not uncommon for apps to be monetized using advertisements. A majority of ad-supported apps are either free or available at a minimal cost, which helps generate income to support ongoing development, such as releasing new features or addressing security flaws. However, the presence of in-app advertisements often implies that the app is profiting from your data.

While it is acceptable for apps to collect certain essential information, such as tracking app crashes to rectify bugs or observing incorrect clicks to enhance a poorly designed user interface, the collection of extensive data that is either sold to third-party advertisers or at risk of being compromised in a data breach should be a cause for concern. It is recommended to review the policy agreement’s details about data collection before proceeding with the download. Furthermore, consider the app’s revenue model, especially if it is available for free. If there’s no evident monetization strategy, your data might be at risk of being sold.

The Importance of App Reviews and Download Counts

Before deciding to download an app, it’s essential to scrutinize the reviews. If an app consistently receives low ratings, it might be indicative of technical issues or a questionable reputation. In any case, poor user ratings should serve as a red flag, making you reconsider before installing the software. Similarly, if a widely popular app like Spotify, Netflix, or Instagram has only been downloaded a limited number of times, it’s worth verifying the listing’s authenticity.

Understanding App Permission Requests

The permissions an app requests can also be revealing. For example, a calculator app has no legitimate need to access your microphone or location data. In contrast, it’s logical for social media apps like Instagram or TikTok to request access to your camera and microphone, given that these features are integral to the app’s functionality. Likewise, a dating app requiring your location data makes sense for facilitating geographical matches. However, if an app requests unnecessary permissions and doesn’t provide an option to opt-out, it could be a sign of malicious activity. This could include accessing sensitive data such as call logs or your Wi-Fi connections. It’s important to note that most apps allow you to continue using the app even after denying permissions, and you have the option to temporarily enable these permissions when necessary.

Identifying Other Potential Warning Signs

While thoroughly reading a policy agreement is crucial, there are other potential red flags to be aware of. If you notice your device behaving unusually after installing an app, such as rapid battery drainage, frequent freezing, crashing, or overheating, it’s possible that the app has infected your device with malware. While it’s more likely that poor performance following an app installation or update is due to benign issues, such as unoptimized software or a resource-demanding app running in the background, there’s a possibility that a malfunctioning phone could be the result of spyware included with a malicious app. Therefore, it’s essential to keep your device safeguarded with top-tier antivirus software.

https://www.infradapt.com/news/ensuring-mobile-safety-avoid-these-5-warning-signs-when-downloading-apps/

Deepfake Technology Powers Advanced Malware Attacks on Mobile Banking

Identification of Cyber Threat Actor GoldFactory and its Advanced Banking Trojans

GoldFactory, a cybercrime group that communicates in Chinese, has been identified as the creators of advanced banking trojans. This includes a previously unknown iOS malware named GoldPickaxe, which is designed to collect identity documents, facial recognition data, and intercept SMS messages. According to a detailed report by Group-IB, a Singapore-based cybersecurity firm, the GoldPickaxe family of malware is operational on both iOS and Android platforms. It is believed that GoldFactory maintains strong ties with Gigabud, another cybercrime organization.

Since its inception in mid-2023, GoldFactory has been linked to the creation of other Android-based banking malware. These include GoldDigger and its advanced version GoldDiggerPlus, which incorporates an embedded trojan known as GoldKefu.

Targeted Social Engineering Campaigns in Asia-Pacific

The malware created by GoldFactory has been distributed through social engineering campaigns, primarily aimed at the Asia-Pacific region. Thailand and Vietnam have been specifically targeted, with the malware disguising itself as local banks and government organizations. In these campaigns, potential victims receive phishing and smishing messages that direct them to switch to instant messaging applications like LINE. They are then sent fraudulent URLs that install GoldPickaxe on their devices.

Some of the malicious Android applications are hosted on fake websites designed to mimic the Google Play Store or corporate websites, thus facilitating the installation process.

iOS Distribution Scheme and Sophisticated Evasion Techniques

The iOS version of GoldPickaxe utilizes a different distribution method. It employs successive versions that take advantage of Apple’s TestFlight platform and malicious URLs. These URLs prompt users to download a Mobile Device Management (MDM) profile, which provides complete control over the iOS device and enables the installation of the rogue app.

The Thailand Banking Sector CERT (TB-CERT) and the Cyber Crime Investigation Bureau (CCIB) uncovered these propagation techniques in November 2023.

GoldPickaxe also showcases its sophistication by circumventing security measures implemented by Thailand. These measures necessitate users to verify large transactions using facial recognition to deter fraudulent activities.

Deepfake Videos and Unauthorized Fund Transfers

Security researchers Andrey Polovinkin and Sharmine Low explain that GoldPickaxe tricks victims into recording a video as a confirmation method in the fake application. This recorded video is then utilized as a source for creating deepfake videos using face-swapping artificial intelligence services.

Both the Android and iOS versions of the malware are capable of collecting victims’ ID documents and photos, intercepting incoming SMS messages, and routing traffic through the compromised device. It is believed that GoldFactory actors use their own devices to log into the banking application and execute unauthorized fund transfers.

Comparing the Functionality of iOS and Android Variants

The iOS variant of GoldPickaxe has fewer functionalities compared to its Android counterpart. This is largely due to the closed nature of the iOS operating system and its relatively stricter permissions.

The Android version, considered an evolved version of GoldDiggerPlus, disguises itself as over 20 different applications from Thailand’s government, financial sector, and utility companies. Its main aim is to steal login credentials from these services. However, the exact use of this stolen information by the threat actors remains unclear.

Abuse of Android’s Accessibility Services and Code-Level Similarities

A noteworthy feature of the malware is its exploitation of Android’s accessibility services to log keystrokes and extract content displayed on the screen.

GoldDigger shares code-level similarities with GoldPickaxe, although it is primarily designed to steal banking credentials, while GoldPickaxe is more focused on collecting personal information from victims. To date, no GoldDigger artifacts aimed at iOS devices have been discovered.

Targeting Vietnamese Financial Companies

“The primary feature of GoldDigger is that it targets over 50 applications from Vietnamese financial companies, including their packages’ names in the trojan,” the researchers said. “Whenever the targeted applications open, it will…

Unveiling the GoldDigger Malware and its Evolution

GoldDigger, a base version of a malicious software, was first identified in June 2023. Even though it continues to circulate in the digital space, it has given rise to more advanced versions, including GoldDiggerPlus. This upgraded variant is embedded with an additional Trojan APK component known as GoldKefu, which triggers the malicious activities.

Introduction to GoldDiggerPlus and GoldKefu

GoldDiggerPlus made its first appearance in September 2023. GoldKefu, on the other hand, masquerades as a widely used Vietnamese messaging application to extract banking information from ten different financial institutions. Unlike GoldDigger, which primarily relies on Android’s accessibility services, the Android Trojan, used in combination with GoldKefu, leverages fake overlays to gather login details if the most recently opened application is on the target list.

GoldKefu’s Integration with Agora SDK

GoldKefu also collaborates with the Agora Software Development Kit (SDK) to enable interactive voice and video calls. It deceives victims into reaching out to a fake bank customer service by sending counterfeit alerts. These alerts create an artificial urgency by falsely claiming that a fund transfer of 3 million Thai Baht has occurred in their accounts.

The Lucrative Mobile Malware Landscape

This development is indicative of the mobile malware landscape’s lucrative nature for cybercriminals seeking quick financial gain. These criminals continuously devise methods to bypass the defensive strategies implemented by banks to combat such threats. It also highlights the continuously evolving and dynamic nature of social engineering schemes designed to deliver malware to victims’ devices.

Mitigating Risks Posed

To reduce the risks posed by GoldFactory and its mobile banking malware suite, it is strongly recommended to avoid clicking on suspicious links and installing apps from untrusted sites. These sites are a common source of malware. Regularly reviewing the permissions granted to apps, especially those that request Android’s accessibility services, is also advised.

The Resourcefulness of the GoldFactory Team

The GoldFactory team is skilled in various tactics, including impersonation, accessibility keylogging, creating fake banking websites, sending fake bank alerts, creating fake call screens, and collecting identity and facial recognition data. The team is divided into separate development and operator groups, each dedicated to specific regions.

The Operational Maturity of the Gang

The gang has well-established processes and operational maturity. They continuously enhance their toolkit to match the targeted environment, demonstrating a high level of expertise in malware development.

https://www.infradapt.com/news/deepfake-technology-powers-advanced-malware-attacks-on-mobile-banking/

Ransomware Victims Pay Out a Record-Breaking $1.1 Billion in 2023

The Escalation of Ransomware Attacks in 2023

Throughout 2023, malicious actors specializing in ransomware significantly amplified their assault on prominent entities and essential infrastructure. These included healthcare facilities, educational institutions, and government bodies. Noteworthy supply chain attacks, exploiting widely used file transfer software such as MOVEit, affected a broad spectrum of organizations – from broadcasting giant BBC to the renowned British Airways. The culminating effect of these and other similar intrusions led ransomware syndicates to an unprecedented feat – amassing over $1 billion in extorted digital currency payments from their victims. The developments of the past year underscore the progressive nature of this cyber menace and its mounting impact on international institutions and overall security.

A Turning Point for Ransomware

The year 2023 marked a significant resurgence for ransomware, characterized by a record-breaking surge in payments and a substantial escalation in the scale and sophistication of attacks. This was a marked contrast to the downturn observed in 2022, a trend we had cautioned about in our Mid-Year Crime Update. Ransomware payments in 2023 exceeded the $1 billion threshold, the highest figure ever recorded. Despite a reduction in the volume of ransomware payments in 2022, the overall trajectory from 2019 to 2023 suggests an escalating issue with ransomware. It’s important to remember that this figure doesn’t account for the economic repercussions of lost productivity and recovery expenses linked to these attacks. Cases like the audacious targeting of MGM resorts by ALPHV-BlackCat and Scattered Spider exemplify this, with MGM estimating damages costing the company upwards of $100 million, despite not paying the demanded ransom.

The Continually Expanding Ransomware Landscape

The ransomware landscape is not just prolific but continuously expanding, posing a challenge to keep track of every incident or trace all ransom payments made in digital currencies. Our figures represent conservative estimates, with the potential to rise as new ransomware addresses are uncovered over time. For example, our initial reporting for 2022 in last year’s crime report indicated $457 million in ransoms, a figure that has since been adjusted upward by 24.1%.

2022 – A Deviation, Not a Pattern

A combination of factors likely led to the reduction in ransomware activities in 2022, including geopolitical events such as the Russian-Ukrainian conflict. This conflict not only disrupted the operations of some cyber actors but also shifted their focus from financial gain to politically motivated cyberattacks intended for espionage and destruction. As we highlighted in our 2023 Crypto Crime Report, other contributing factors to this downturn included hesitance among some Western entities to pay ransoms to specific strains due to potential sanctions risks. The ransomware strain Conti, in particular, faced complications due to its reported ties to sanctioned Russian intelligence agencies, the exposure of the organization’s internal communications, and overall internal turmoil. This led to a decrease in their activities and contributed to the overall reduction in ransomware incidents in 2022. However, researchers have observed that many ransomware actors associated with Conti have continued to migrate or launch new strains, making victims more inclined to pay.

Law Enforcement’s Response to Ransomware: The Hive Intervention

A significant factor in the reduction of ransomware in 2022 was the successful penetration of the Hive ransomware strain by the Federal Bureau of Investigation (FBI), as announced by the Department of Justice early in 2023. Our analysis emphasizes the considerable impact of this single enforcement action. During the Hive infiltration, the FBI managed to supply decryption keys to over 1,300 victims, effectively eliminating the need for ransom payments. The FBI estimates that this intervention prevented approximately $130 million in ransom payments to Hive. But the influence of this intervention extends beyond that. The total tracked ransomware payments for 2022 currently stand at just $567 million, indicating that the ransom payments averted by the Hive infiltration significantly reshaped the ransomware landscape last year.

The Full Impact of the FBI’s Hive Operation: A Comprehensive Analysis

The $130 million that the FBI saved by infiltrating Hive doesn’t provide a complete picture of the operation’s success. This figure only considers the ransoms that were avoided by supplying the decryptor keys and doesn’t take into account the ripple effects. The Hive operation likely had a wider impact on Hive affiliates’ operations, potentially reducing the number of additional attacks they could launch.

During the six months the FBI was within Hive, the total ransomware payments across all strains amounted to $290.35 million. However, our statistical models predict a total of $500.7 million for that period, based on the behavior of attackers in the months before and after the operation. This is a cautious estimate. Given this figure, we estimate that the Hive operation may have prevented at least $210.4 million in ransomware payments.

David Walker, the Special Agent in Charge of the FBI’s Tampa Division, provided further insights into the significance of the operation. He stated, “The Hive investigation exemplifies the gold standard for implementing the key services model. The FBI continues to witness the significant positive impact of actions like the Hive takedown on cyber threat actors through its investigations and victim engagements. We will persist in implementing proactive disruptive measures against adversaries.”

The Resurgence of Ransomware: A Look at the 2023 Threat Landscape

In 2023, there was a significant increase in the frequency, scale, and volume of ransomware attacks. These attacks were conducted by a diverse range of actors, from large syndicates to smaller groups and individuals, and their numbers are on the rise, according to experts. Allan Liska, a Threat Intelligence Analyst at cybersecurity firm Recorded Future, stated, “We are witnessing a significant increase in the number of threat actors carrying out ransomware attacks.” In 2023, Recorded Future reported 538 new ransomware variants, indicating the emergence of new, independent groups.

The graph below shows the most active ransomware strains by quarter from the start of 2022 through 2023. There are also significant variations in the victimization strategies of the top ransomware strains, as shown in the chart below, which plots each strain’s median ransom size against its attack frequency. The chart also shows a number of new entrants and offshoots in 2023, who are known to reuse existing strains’ code. This suggests a rising number of new actors, drawn by the potential for high profits and lower entry barriers.

The Changing Tactics of Ransomware Strains

Some strains, such as Cl0p, embody the “big game hunting” strategy, conducting fewer attacks than many other strains, but collecting large payments with each attack. Cl0p exploited zero-day vulnerabilities that allowed it to extort many large, deep-pocketed victims simultaneously, prompting the strain’s operators to adopt a strategy of data exfiltration instead of encryption.

Over the past few years, big game hunting has emerged as the dominant strategy, with an increasing share of all ransomware payment volume consisting of payments of $1 million or more.

Other strains, like Phobos, have adopted the Ransomware as a Service (RaaS) model, where outsiders, known as affiliates, can access the malware to conduct attacks, and in return, pay the strain’s core operators a portion of the ransom proceeds. Phobos simplifies the process for less technically advanced hackers to launch ransomware attacks, using the typical encryption process that is the hallmark of ransomware. Despite targeting smaller entities and demanding lower ransoms, the RaaS model increases the strain’s capacity to conduct a large number of these smaller attacks.

ALPHV-BlackCat is another RaaS strain like Phobos, but it is more selective about the affiliates it allows to use its malware, actively seeking and interviewing potential candidates for their hacking abilities.

The Evolution of Ransomware Attacks: A Closer Look at the Tactics and Tools

The landscape of ransomware attacks is ever-evolving, with groups constantly adapting their strategies to target larger entities for more substantial ransoms. One common tactic is the rebranding of ransomware strains or the simultaneous use of several strains by affiliates. This strategy allows attackers to disassociate themselves from strains that have been publicly sanctioned or have attracted too much attention. Furthermore, it enables them to strike the same victims under different strain names, thus increasing their chances of success.

The Rise of Ransomware-as-a-Service (RaaS) and Initial Access Brokers (IABs)

The proliferation of Ransomware-as-a-Service (RaaS) and hacking tools has simplified the process of launching a successful ransomware attack. This development has been further facilitated by the emergence of Initial Access Brokers (IABs), who infiltrate potential victims’ networks and sell the access to ransomware attackers for a nominal fee.

Our research has identified a correlation between the flow of funds into IAB wallets and a surge in ransomware payments. This suggests that monitoring IAB activities could offer early warning signs and open up opportunities for intervention and mitigation of attacks. The combination of IABs and RaaS has significantly reduced the technical skills required to execute a successful ransomware attack. Andrew Davis, General Counsel at Kivu Consulting, a cybersecurity incident response firm, sheds more light on this phenomenon.

“The surge in attack volume can be attributed to the ease of access provided by the affiliate model and the adoption of ransomware-as-a-service, an alarmingly effective business model for cybercriminals,” Davis explains.

Tracking Ransomware Funds: The Journey and Destination

Understanding how ransomware funds move is crucial in identifying the methods and services used by threat actors. This knowledge enables law enforcement agencies to target and disrupt the financial networks and infrastructure of these actors.

It’s worth noting that threat actors may take a considerable amount of time to launder their ransomware proceeds. The laundering observed in 2023, for instance, includes proceeds from attacks that took place in the past.

Historically, centralized exchanges and mixers have been the go-to methods for laundering ransomware payments. However, 2023 witnessed the adoption of new laundering services such as bridges, instant exchangers, and gambling services. This shift is likely due to the disruption of preferred laundering methods, the implementation of stricter Anti-Money Laundering (AML) and Know Your Customer (KYC) policies by some services, and the unique laundering preferences of new ransomware actors.

Concentration of Laundering Services and Lessons from 2023

There is a significant concentration of specific services within each category that ransomware actors use for laundering. Exchanges exhibit the lowest level of concentration, while gambling services, cross-chain bridges, and sanctioned entities show the highest levels. Mixers, no-KYC exchanges, and underground exchanges fall in between, with about half of all funds from ransomware wallets going to one service.

The concentration of mixers may have increased due to the takedown of Chipmixer, a popular choice for ransomware attackers. This concentration might expose ransomware actors to bottlenecks, making them vulnerable as law enforcement could disrupt operations by targeting a relatively small number of services.

The ransomware landscape underwent significant changes in 2023, characterized by shifts in tactics and affiliations among threat actors, as well as the continued spread of RaaS strains.

Enhanced Speed and Efficacy in Cyber Attacks

The year 2023 witnessed a significant shift in the strategies employed by cybercriminals. The speed of attack execution was notably improved, indicating a more aggressive and efficient modus operandi. The constant shuffling of affiliates underlines the fluid dynamics of the ransomware underworld, as well as the relentless pursuit of more profitable extortion strategies.

Adapting to Changing Landscapes

Despite the ever-evolving tactics of threat actors, they consistently demonstrate their ability to adapt to changes in regulations and law enforcement actions. However, 2023 was not without its triumphs in the battle against ransomware. These victories were largely due to the collaborative efforts of international law enforcement, impacted organizations, cybersecurity companies, and blockchain intelligence.

Law Enforcement’s Proactive Stance

Lizzie Cookson from Coveware highlighted the importance of these collaborative efforts, citing the successful takedown of Hive and the disruption of BlackCat as prime examples. She noted, “These operations underscore the FBI’s commitment to assisting victims, providing aid, and imposing penalties on malicious actors.” Andrew Davis of Kivu Consulting echoed these sentiments, observing an increase in proactive involvement from law enforcement. This indicates a more resolute and determined approach to providing support to victims and tracking down cybercriminals.

https://www.infradapt.com/news/ransomware-victims-pay-out-a-record-breaking-1-1-billion-in-2023/

Meta Exposes Eight Firms Behind Spyware Attacks on iOS, Android, and Windows Devices

Meta Platforms’ Actions Against Surveillance-for-Hire Companies

Meta Platforms has taken action against eight surveillance-for-hire companies based in Italy, Spain, and the United Arab Emirates (U.A.E.), as per their Adversarial Threat Report for Q4 2023. The companies were reportedly involved in malicious activities, including the development of spyware aimed at iOS, Android, and Windows devices.

The malware developed by these companies had the ability to gather and access a wide range of device data, including information about the device itself, location data, photos, media, contacts, calendar entries, emails, SMS, and data from social media and messaging apps. The malware could also activate device microphones, cameras, and screenshot functions.

The companies implicated in these activities are Cy4Gate/ELT Group, RCS Labs, IPS Intelligence, Variston IT, TrueL IT, Protect Electronic Systems, Negg Group, and Mollitiam Industries. According to Meta Platforms, these companies also engaged in data scraping, social engineering, and phishing activities across a variety of platforms, including Facebook, Instagram, X (formerly Twitter), YouTube, Skype, GitHub, Reddit, Google, LinkedIn, Quora, Tumblr, VK, Flickr, TikTok, SnapChat, Gettr, Viber, Twitch, and Telegram.

Specific Malicious Activities

RCS Labs, owned by Cy4Gate, reportedly used a network of fake personas to trick users into providing their phone numbers and email addresses, and to click on fraudulent links for reconnaissance purposes. Facebook and Instagram accounts linked to Spanish spyware company Variston IT were used for exploit development and testing, including the sharing of malicious links. Reports suggest that Variston IT is in the process of shutting down its operations.

Meta Platforms also identified accounts used by Negg Group for testing spyware delivery, and by Mollitiam Industries, a Spanish company offering data collection services and spyware for Windows, macOS, and Android, for scraping public information.

Actions Against Coordinated Inauthentic Behavior (CIB)

Alongside these actions, Meta Platforms also removed over 2,000 accounts, Pages, and Groups from Facebook and Instagram due to Coordinated Inauthentic Behavior (CIB) originating from China, Myanmar, and Ukraine. The Chinese cluster targeted U.S. audiences with content criticizing U.S. foreign policy towards Taiwan and Israel and supporting Ukraine. The Myanmar network targeted local residents with articles praising the Burmese army and criticizing ethnic armed organizations and minority groups. The Ukrainian cluster used fake Pages and Groups to post content supporting Ukrainian politician Viktor Razvadovskyi and expressing support for the current government and criticism of the opposition in Kazakhstan.

Industry-wide Efforts to Curb Spyware Abuse

This action by Meta Platforms comes as part of a broader initiative involving a coalition of government and tech companies aiming to curb the abuse of commercial spyware for human rights abuses. As part of its countermeasures, Meta Platforms has introduced new features such as Control Flow Integrity (CFI) on Messenger for Android and VoIP memory isolation for WhatsApp to make exploitation more difficult and reduce the overall attack surface.

The Persistence of the Surveillance Industry

Despite these efforts, the surveillance industry continues to evolve and thrive in various forms. Last month, 404 Media, building on prior research from the Irish Council for Civil Liberties (ICCL) in November 2023, revealed a surveillance tool called Patternz. This tool utilizes real-time bidding (RTB) advertising data from popular apps like 9gag, Truecaller, and Kik to track mobile devices. The Israeli company behind Patternz, ISA, claims that the tool allows national security agencies to use real-time and historical user advertising data to detect, monitor, and predict user actions, security threats, and anomalies based on user behavior, location patterns, and mobile usage characteristics.

In addition, last week, Enea unveiled a previously unknown mobile network attack known as MMS Fingerprint.

The Use of Pegasus-maker NSO Group’s Alleged Techniques

According to some sources, the Pegasus-maker NSO Group is believed to have employed specific techniques, as stated in a contract they had with Ghana’s telecom regulator in 2015. The exact means used by the group are still somewhat unclear. However, Enea, a Swedish telecom security firm, has put forward a plausible theory.

The Role of Binary SMS in the Suspected Method

Enea suggests that the group likely used a unique form of SMS message known as binary SMS, specifically MM1_notification.REQ. This particular message informs the recipient’s device of an MMS (Multimedia Messaging Service) that is pending retrieval from the MMSC (Multimedia Messaging Service Center).

The Process of Fetching MMS

The process of fetching the MMS involves the utilization of MM1_retrieve.REQ and MM1_retrieve.RES. The former is an HTTP GET request directed to the URL address contained in the MM1_notification.REQ message.

The Significance of User Device Information

What makes this technique particularly interesting is the inclusion of user device information such as User-Agent (distinct from a web browser User-Agent string) and x-wap-profile in the GET request. This data essentially serves as a unique identifier for the device.

Understanding User-Agent and X-wap-profile

Enea explains that the User-Agent in this context is a string that typically identifies the device’s OS and model. The x-wap-profile, on the other hand, points to a User Agent Profile (UAProf) file that outlines the capabilities of a mobile handset.

Potential Exploitation of Device Information

This device information could potentially be used by a threat actor to deploy spyware. They could exploit specific vulnerabilities, customize their harmful payloads to suit the target device, or even design more efficient phishing campaigns. However, it’s important to note that there is currently no evidence to suggest this security loophole has been exploited in recent times.

https://www.infradapt.com/news/meta-exposes-eight-firms-behind-spyware-attacks-on-ios-android-and-windows-devices/

What is Multifactor Authentication?

Multi-factor authentication (MFA) is an advanced security mechanism that requires two or more verification methods from different categories to authenticate a user’s identity for a login or transaction. This approach is much more secure than single-factor authentication, which only requires a username and password. MFA is designed to protect both the user’s credentials and the resources the user can access.

The key components of MFA are:

Something You Know (Knowledge Factor): This is the most common authentication factor, which includes anything that the user knows and can remember. Examples include passwords, PINs, and personal security questions. While passwords are the most common form, they are also the most vulnerable to attacks like phishing and brute force.

Something You Have (Possession Factor): This involves something the user physically possesses. Examples include security tokens, smartphones, smart cards, and key fobs. These devices can generate time-sensitive codes or receive push notifications for authentication. The idea is that even if someone knows your password, they would still need this physical device to gain access.

Something You Are (Inherence Factor): This involves biometrics, which rely on the unique physical characteristics of an individual. Common biometric methods include fingerprint scanning, facial recognition, iris or retina scanning, and voice recognition. These methods are becoming increasingly popular due to their convenience and the fact that they are difficult to replicate or steal.

Somewhere You Are (Location Factor): This factor involves the use of geographical location as a form of authentication. It can be determined through GPS tracking or IP address location. For example, if an access request comes from a location where the user is not usually present, it can be flagged or denied.

The purpose of MFA is multifaceted:

Enhanced Security: By requiring multiple forms of verification, MFA significantly reduces the risk of unauthorized access. Even if a hacker obtains one credential, such as a password, they are unlikely to have access to the user’s physical device or biometric information.

Preventing Identity Theft: MFA makes it more difficult for attackers to impersonate users, thereby reducing the chances of identity theft.

Compliance with Regulations: Many industries have regulations that require enhanced security measures, including MFA, to protect sensitive data.

Building Trust: MFA can help organizations build trust with their customers by demonstrating a commitment to protecting their data.

Adaptability: MFA systems can be configured to balance security with user convenience, adapting to various levels of risk associated with different types of access requests.

Multi-factor authentication provides a robust security framework by combining multiple authentication factors, making it significantly more challenging for unauthorized parties to breach secure systems or data. This not only helps in safeguarding sensitive information but also plays a crucial role in maintaining user trust and complying with regulatory standards.

https://www.infradapt.com/news/what-is-multifactor-authentication/

What is endpoint detection and response

Endpoint Detection and Response (EDR) represents an advanced layer in cybersecurity strategies, focusing on the endpoints or hosts within an organization’s network. It’s a critical tool in the fight against cyber threats, offering a more dynamic and comprehensive approach than traditional antivirus software. Let’s delve deeper into its aspects:

Advanced Threat Detection: EDR systems excel in identifying sophisticated cyber threats, including malware, ransomware, and zero-day exploits. They utilize a combination of signature-based, behavioral-based, and heuristic analysis techniques to detect known and unknown threats. This multi-faceted approach allows EDR to identify anomalies that may signify a security breach, even if the threat itself is not yet known in the cybersecurity community.

Data Collection and Analysis: EDR tools continuously gather vast amounts of data from each endpoint, including system processes, network traffic, file changes, registry settings, and user activities. This data is then analyzed in real-time or near-real-time, leveraging complex algorithms, machine learning, and sometimes artificial intelligence, to detect potentially malicious activities. This continuous monitoring is crucial for identifying threats that slowly evolve over time, which might be missed by periodic scans.

Automated and Manual Response Capabilities: Upon detection of a threat, EDR systems can take immediate, automated actions such as quarantining files, killing malicious processes, or isolating infected endpoints from the network to prevent lateral movement of the threat. Additionally, they provide tools for security analysts to manually intervene, allowing for a tailored response to complex or sophisticated attacks.

Forensics and Investigation Tools: EDR solutions offer in-depth investigative capabilities, enabling security teams to trace back the origin of an attack, understand its execution path, and assess the impact. This forensic data is vital for incident response and to prevent similar attacks in the future. It includes detailed logs, timelines of events, and other contextual information about the threat.

Integration and Collaboration: Effective EDR solutions are designed to seamlessly integrate with other security tools and systems within an organization, such as firewalls, intrusion detection systems, and security information and event management (SIEM) systems. This integration facilitates a coordinated response to threats and enhances the overall security posture by sharing insights and intelligence across different platforms.

User Behavior Analytics (UBA): Many EDR tools incorporate UBA to detect anomalies based on user behavior. This means monitoring for unusual login times, file access patterns, or network requests, which might indicate a compromised user account or an insider threat.

Threat Hunting and Proactive Security: Beyond reactive measures, EDR enables proactive threat hunting. Security teams can use EDR tools to actively search for hidden threats that have evaded initial detection, using the extensive data collected to identify subtle indicators of compromise.

Education and Empowerment of Security Teams: EDR tools also play a role in educating and empowering security teams. They provide rich, contextual information about threats and attacks, which helps in building more effective defense strategies and in training security personnel to recognize and respond to new types of threats.

In conclusion, EDR is an essential component of modern cybersecurity strategies, offering comprehensive protection for endpoints through its advanced detection capabilities, in-depth analysis, automated response mechanisms, and integration with broader security systems. By continuously monitoring endpoint activity and employing sophisticated analytical tools, EDR provides a robust defense against the increasingly sophisticated and varied threats faced by organizations today.

https://www.infradapt.com/news/what-is-endpoint-detection-and-response/

Alert on Rising CACTUS Ransomware Attacks

Microsoft has recently raised an alarm concerning a surge in CACTUS ransomware attacks. These attacks employ malvertising tactics to utilize DanaBot as the initial access point. The DanaBot infections eventually lead to manual keyboard activity by the ransomware operator identified as Storm-0216 (also known as Twisted Spider or UNC2198), which ultimately results in the deployment of CACTUS ransomware. This information was shared by the Microsoft Threat Intelligence team through a series of posts on X (formerly known as Twitter).

The Role of DanaBot and UNC2198

DanaBot, identified by Microsoft as Storm-1044, is a multi-functional tool. It is similar to Emotet, TrickBot, QakBot, and IcedID in its capabilities. It can act both as a stealer and as an entry point for subsequent payloads. UNC2198 has a history of infecting endpoints with IcedID to deploy ransomware families such as Maze and Egregor, as reported by Mandiant, a subsidiary of Google, in February 2021. According to Microsoft, this threat actor has also exploited initial access granted by QakBot infections. The current shift towards DanaBot is likely a consequence of a synchronized law enforcement operation in August 2023, which dismantled QakBot’s infrastructure.

The Current DanaBot Campaign and its Implications

The ongoing DanaBot campaign, first noticed in November, seems to be employing a private version of the information-stealing malware, as opposed to the malware-as-a-service offering. This observation was made by Redmond. The malware transmits the gathered credentials to a server controlled by the actor. This is followed by lateral movement through RDP sign-in attempts, eventually granting access to Storm-0216.

Recent Developments in CACTUS Ransomware Attacks

This announcement from Microsoft comes shortly after Arctic Wolf disclosed another series of CACTUS ransomware attacks. These attacks are actively exploiting critical vulnerabilities in a data analytics platform known as Qlik Sense to gain entry into corporate networks. In addition, a new macOS ransomware strain named Turtle has been discovered. This strain is written in the Go programming language and is signed with an adhoc signature. This signature prevents the strain from being executed upon launch due to Gatekeeper protections.

https://www.infradapt.com/news/alert-on-rising-cactus-ransomware-attacks/

Simple Strategies for Organizing Your Email

An overflowing email inbox can be overwhelming and counterproductive. Keeping your inbox organized is key to managing your digital communication effectively. This guide provides practical steps to organize your email inbox, helping you stay on top of your messages without feeling overwhelmed.

Why Organize Your Inbox?

Reduce Stress: A cluttered inbox can be a source of stress. Organizing it helps reduce anxiety and makes managing emails less daunting.

Improve Efficiency: A well-organized inbox allows you to find important emails quickly and respond in a timely manner.

Prioritize Tasks: By organizing your emails, you can easily identify and prioritize the most important tasks.

How to Organize Your Email Inbox

Unsubscribe from Unwanted Emails:

Regularly unsubscribe from newsletters, promotions, or updates you no longer read. This reduces the volume of incoming mail.

Use Folders and Labels:

Create folders or labels to categorize emails. For example, use separate folders for work, personal, bills, and social updates.

Move emails to these folders to keep your main inbox less cluttered.

Implement Email Filters:

Set up filters or rules to automatically sort incoming emails into designated folders.

This can be done based on the sender, subject line, or keywords.

Regularly Archive or Delete Old Emails:

Regularly review and clear out old emails. Archive those you might need later and delete the ones you don’t.

Set Specific Times for Checking Emails:

Instead of constantly checking your inbox, set specific times of the day for this task. This helps reduce distractions and increases productivity.

Use the Two-Minute Rule:

If an email can be responded to in two minutes or less, do it immediately. This prevents small tasks from piling up.

Take Advantage of Email Tools:

Use tools like snooze, reminders, or templates to manage your emails more effectively.

Conclusion

Effective email management is essential in the digital age. By implementing these simple strategies, you can keep your inbox organized, reduce stress, and improve your overall productivity. Remember, the goal is not to achieve an empty inbox, but a well-managed one that supports your workflow and daily tasks.

https://www.infradapt.com/news/simple-strategies-for-organizing-your-email/

How to clear your browser cache, and why

Introduction

Clearing your browser cache is a simple yet effective way to improve your online experience. Over time, your browser accumulates a significant amount of data, which can slow down your browsing speed and affect the performance of web pages. This article guides you through the easy steps of clearing your browser cache and explains the benefits of this regular maintenance task.

What is Browser Cache?

The browser cache is a temporary storage area on your computer where web browsers keep copies of the web pages you have visited. This storage allows for quicker access to these pages when you revisit them, as the browser can load the stored data instead of downloading everything again. However, this convenience comes with a downside.

Why Clear Your Browser Cache?

Speed Up Your Browser: Over time, the cache can become cluttered with outdated and unnecessary files, which can slow down your browser. Clearing it out helps in speeding things up.

Resolve Loading Issues: Sometimes, cached data can cause issues with how websites are displayed or function. Clearing the cache can resolve these problems.

Enhance Security: Cached data can include sensitive information. Regularly clearing it out can help protect your privacy.

See Latest Website Versions: Websites are constantly updated. A full cache can prevent you from seeing the most recent version of a site.

How to Clear Your Browser Cache

The process varies slightly depending on the browser you use. Here’s how to do it in some of the most popular browsers:

Google Chrome:

Click the three dots in the upper-right corner.

Go to ‘More tools’ > ‘Clear browsing data’.

Choose the time range (select ‘All time’ for a complete clear-out).

Check ‘Cached images and files’ and click ‘Clear data’.

Mozilla Firefox:

Click the three lines in the upper-right corner.

Go to ‘Options’ > ‘Privacy & Security’.

Under ‘Cookies and Site Data’, click ‘Clear Data’.

Check ‘Cached Web Content’ and click ‘Clear’.

Microsoft Edge:

Click the three dots in the upper-right corner.

Go to ‘Settings’ > ‘Privacy, search, and services’.

Under ‘Clear browsing data’, click ‘Choose what to clear’.

Select ‘Cached images and files’ and click ‘Clear now’.

Safari (for Mac):

Go to ‘Safari’ in the menu bar, then ‘Preferences’.

Click on the ‘Advanced’ tab and check ‘Show Develop menu in menu bar’.

From the ‘Develop’ menu, select ‘Empty Caches’.

Conclusion

Regularly clearing your browser cache is a simple yet effective way to maintain the performance and security of your web browsing experience. It’s a quick process that can lead to noticeable improvements in speed and functionality. Make it a habit to perform this task every few weeks or monthly, depending on your browsing habits.

https://www.infradapt.com/news/how-to-clear-your-browser-cache-and-why/

CISA Highlights High-Severity Flaw in Service Location Protocol

The United States Cybersecurity and Infrastructure Security Agency (CISA) has recently included a high-risk vulnerability in the Service Location Protocol (SLP) within its Known Exploited Vulnerabilities (KEV) catalog. This inclusion was made following the detection of active exploitation of this flaw. This vulnerability, designated as CVE-2023-29552 and having a CVSS score of 7.5, is a denial-of-service (DoS) flaw that could potentially be used to initiate large-scale DoS amplification assaults.

Exploring the Vulnerability

According to CISA, the Service Location Protocol (SLP) is plagued by a denial-of-service (DoS) vulnerability. This vulnerability could enable an unauthenticated, remote attacker to register services and use falsified UDP traffic to execute a denial-of-service (DoS) attack with a considerable amplification factor. SLP is a protocol that facilitates the discovery and communication of systems within a local area network (LAN).

Amplification Factor and Potential Exploitation

While the precise details regarding the exploitation of this flaw remain undisclosed, Bitsight had previously cautioned that this deficiency could be manipulated to execute DoS attacks with a high amplification factor. Bitsight stated, “This extremely high amplification factor allows for an under-resourced threat actor to have a significant impact on a targeted network and/or server via a reflection DoS amplification attack.”

Mandatory Mitigations for Federal Agencies

In response to the real-world attacks leveraging this flaw, federal agencies are mandated to implement the necessary mitigations, including the deactivation of the SLP service on systems operating on untrusted networks. These measures must be taken by November 29, 2023, to protect their networks from potential threats.

https://www.infradapt.com/news/cisa-highlights-high-severity-flaw-in-service-location-protocol/

New Threats to Google Workspace and Cloud

Uncovering New Threats to Google Workspace and Google Cloud Platform

In a recent report, Bitdefender, a Romanian cybersecurity firm, exposed a series of innovative attack strategies that could potentially be used against Google Workspace and the Google Cloud Platform. These strategies could be exploited by cybercriminals to launch ransomware, data theft, and password recovery attacks.

Martin Zugec, the technical solutions director at Bitdefender, explained that these attacks could evolve in several ways from a single compromised machine. The attackers could spread to other cloned machines with Google Credential Provider for Windows (GCPW) installed, gain access to the cloud platform with custom permissions, or decrypt locally stored passwords to expand their attack beyond the Google ecosystem.

However, these attacks require the attacker to have already gained access to a local machine through other means. As such, Google has stated that the bug is not eligible for fixing as it falls outside their threat model and aligns with Chrome’s practices of storing local data.

Exploiting the Vulnerabilities in Google Credential Provider for Windows (GCPW)

The attacks fundamentally depend on an organization’s use of Google Credential Provider for Windows (GCPW). GCPW provides both mobile device management (MDM) and single sign-on (SSO) capabilities, allowing administrators to remotely manage Windows devices within their Google Workspace environments and users to access their Windows devices using the same credentials as their Google accounts.

GCPW operates using a local privileged service account named Google Accounts and ID Administration (GAIA) which connects to Google APIs to verify a user’s credentials during the sign-in step and stores a refresh token to eliminate the need for re-authentication.

Attack Scenarios and their Implications

With this GCPW setup, an attacker with access to a compromised machine can extract an account’s refresh OAuth tokens from either the Windows registry or the user’s Chrome profile directory, effectively bypassing multi-factor authentication (MFA) protections. The attacker can then use the refresh token to construct an HTTP POST request to obtain an access token, which can be misused to access, alter, or delete sensitive data linked to the Google Account.

Another exploit, referred to as the Golden Image lateral movement, targets virtual machine (VM) deployments. This method capitalizes on the fact that cloning a machine with pre-installed GCPW also clones the password associated with the GAIA account. Knowing the password to a local account, and having all local accounts share the same password, essentially gives the attacker access to all machines.

A third attack involves gaining access to plaintext credentials by using the access token obtained through the previous technique to send an HTTP GET request to an undocumented API endpoint and acquire the private RSA key needed to decrypt the password field.

Having access to plaintext credentials, such as usernames and passwords, allows attackers to impersonate legitimate users directly and gain unrestricted access to their accounts, potentially leading to a complete account takeover.

https://www.infradapt.com/news/new-threats-to-google-workspace-and-cloud/

Staying Off the Radar with Smart Location Settings

Understanding the Intricacies of Location Tracking

Our devices and applications are increasingly inclined to track our location. This tracking is often used to provide personalized weather updates, suggest restaurants in our vicinity, or to tailor advertisements to our preferences. However, managing these settings can often be a complex task. Moreover, there may be discrepancies in the location histories recorded by our devices. For instance, you might believe that you have disabled location sharing, only to find out that your movements are still being tracked, or vice versa. This article aims to simplify the complexities of location tracking, enabling you to have better control over your privacy settings.

Demystifying Location Tracking

Have you ever turned off location tracking on a device, only to find your location appearing on a map? Or perhaps you’ve noticed gaps in your location history despite having the feature enabled? The answers to these queries lie in understanding the various ways your location can be logged: by your devices, your applications, and the websites you visit.

Consider this: you might have switched off location tracking on your phone, but it could still be active on your tablet. Or, your laptop might be recording your location in the background, even though you believed you had disabled this feature on your applications. To completely enable or disable location tracking, you must consider all these different methods that can track your location.

Google Account as an Example

If you have a Google account, it serves as a good example of how location tracking works. Navigate to your account settings on the web, and select Data and Privacy and then Location History. Choose Devices on This Account, which might reveal devices that you had forgotten about. Any device with a check next to it in this list is recording your movements to your Google account for future reference.

You can click Turn Off to disable this feature, but there are certain exceptions to keep in mind. Your location might still be recorded by your mobile devices, by the Find My Device service that helps you recover lost hardware, and by Google Maps when you’re navigating or searching around your current location. This Location History setting is more of a general switch, affecting features like the Google Timeline and the ability to quickly look up places you visit regularly.

Other Locations Where Your Data Gets Logged

From the main Google account screen, there are several other places where your location gets logged and shared. Click on Data and Privacy, then Web & App Activity to manage location data saved by Google Maps and other apps and websites. Click on People and Sharing, then Manage Location Sharing to see a list of specific contacts who can see where you are through various Google services.

Managing Location Tracking on Mobile Devices

The process of managing your location on Android varies slightly depending on your phone’s manufacturer, but the instructions are generally similar. On Google Pixel devices, for instance, you can navigate to Settings and then select Location. Here, you’ll see the Use Location toggle switch. If you turn this off, none of your apps will be able to know where you are, nor will Google.

If you leave the Use Location toggle switch on, you can customize location access for individual apps on the same screen. Note that you can choose to allow apps to know where you are at all times, or only when the app in question is running in the foreground.

On iOS, the setup is similar. Select Privacy & Security from Settings, and then tap Location Services. Here, you can turn off location tracking for the phone and all the apps on it. If you choose to leave this enabled, you can manage individual app access to your location via the list underneath. As on Android, you can choose when apps have access to your location. Section 1: Managing Your Location Privacy on Mobile Devices

The ability to control the location access of applications on your mobile device is a critical feature. You have the option to restrict an app’s access to your location only while it’s in use, or to grant it permission to monitor your location even when it’s running in the background. However, deleting the location data that has been gathered about you can be a challenging task. This process involves scrutinizing the records and settings of every app that has ever been granted access to your location.

For those who use Google and its applications, the process involves visiting your Google account on the web. From there, you can navigate to either ‘Location History’ or ‘Web & App Activity’ under the ‘Data and Privacy’ section to erase this data from Google’s records. There are also options to set up automatic deletion of this data after specific periods: 3, 18, or 36 months.

Unlike Google, Apple has a different method of logging your movements. It compiles a list of places you frequently visit, like your home or workplace, for quick access in the future. To clear this list on your iPhone, navigate to ‘Settings,’ then select ‘Privacy & Security,’ ‘Location Services,’ ‘System Services,’ and finally ‘Significant Locations.’ Here, you can clear this list and prevent it from populating in the future.

Controlling Location Tracking on Desktop Computers

Desktop computers and laptops, unlike mobile devices, typically don’t come with GPS capabilities. So, they don’t track your location in the same way as your phone. However, applications, websites, and even the operating system can still have a general idea of your location, primarily based on the locations from which you access the internet.

On Windows, you can manage your location settings by opening ‘Settings,’ then selecting ‘Privacy & Security’ and ‘Location.’ Just like on Android and iOS, you can turn off location tracking for individual applications or disable it for the entire computer. This screen also lets you see which apps have been using your location and allows you to erase the log of your travels.

On macOS, the process is slightly different. You need to click the Apple menu and select ‘System Settings,’ ‘Privacy & Security,’ and ‘Location Services.’ The next screen is quite similar to the Windows one, with toggle switches for individual applications and for macOS itself. If you want to clear the list of “significant locations” Apple has saved for you, just like on iOS, you can do so from this screen.

Managing Browser Location Tracking

If location tracking is enabled on your computer and your preferred browser, individual websites like Facebook, Amazon, or Google Search can also determine your location. While this can be useful for providing accurate weather forecasts, there may be instances when you want to turn it off to maintain your privacy.

Each browser has settings for managing website access to your location. In Chrome, you can find these under ‘Privacy and Security,’ ‘Site Settings,’ and ‘Location’ in the settings pane. In Edge, you need to open settings and choose ‘Cookies and Site Permissions’ then ‘Location.’ On Safari on macOS, select ‘Websites’ and ‘Location’ once you’ve opened the settings dialog. However, changing these settings will not affect data these sites have collected in the past. To manage that, you’ll need to visit the options for the individual sites.

https://www.infradapt.com/news/staying-off-the-radar-with-smart-location-settings/

Trending Blogs

Recently Viewed Blogs

Infradapt