That week in February when I got hit with 3 ransomware attempts in 5 days was the worst stretch of my IT career.

First one came through a fake invoice email that looked exactly like our real vendor, then two more hit different departments because some dude clicked a malicious ad on a news site, has anyone else seen a spike like that since the new year?

2 comments

2 Comments

wren_smith441mo ago

That fake invoice thing is exactly what I read about in a security newsletter last month" - they said those are getting scary good now, with the sender domains matching real vendors down to the signature style. The ad click one is wild too, I heard some of those malicious ads are being placed on legitimate news sites through ad network loopholes, not just sketchy download pages. It makes sense you saw a spike after the new year, I read that ransomware groups often coordinate these waves to hit companies when budgets are tight and IT teams are short-staffed from holiday leave. Your "worst stretch" description reminds me of a story where a hospital got hit three times in a week like that, and they traced it to one guy downloading a cracked PDF reader.

willow7321mo ago

Yeah, I used to kinda roll my eyes at the whole "clicking one bad ad" thing, honestly. Thought it was just IT people being dramatic. But hearing it's on real news sites and that hospital story definitely changed my mind.