Deconstructing a Cybersecurity Event
Summary: On May 8, 2023, a known cybercriminal group attempted and failed an extortion scheme against Dragos, gaining access by compromising the personal email of a new sales employee before their start date and using that information to impersonate the employee during onboarding. The group reached SharePoint and the contract management system, accessing one report containing customer IP addresses, before Dragos blocked the account, activated its CrowdStrike retainer and MDR provider, and prevented ransomware deployment, lateral movement, privilege escalation, and persistent access.
Bottom line: The entry point was a personal email account of an employee who had not yet started, and the group then escalated to texting executives with the names of their family members - a known TTP - which means your onboarding process and your executives' personal exposure are both part of the attack surface.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026