Careful: The “Geek Squad” may just be a bunch of bullies.

A January advisory from CISA noted that federal employees have been targeted with bogus emails from the help desk. Along with the crafty phishing email, this new take on tech support scams entices users to download a legitimate and favorite IT support tool: remote monitoring and management (RMM).

With attackers intent on finding ways to remote-in, companies that use RMM software, like many managed service providers (MSPs), are high-value targets, and IT pros must be especially cautious about ways to restrict and monitor the products’ use.

“The guys who are answering the email are the same people that are logging in and supporting customers, so if I get your credentials…now I can pivot into the entire customer base,” said Brian Haugli, CEO at the cybersecurity services company SideChannel.

CISA says. In October 2022, CISA identified a “widespread cyber campaign involving the malicious use of legitimate RMM software,” which began with a phishing email that said:

Your subscription with GEEK SQUAD will Renew Today and $399.99 is about to be Debited from your account by Today.

Since at least June 2022, cyber-criminal actors have sent help-desk-themed phishing emails to federal staff’s personal and government email addresses, according to the advisory. In a successful execution of the attack, a target end-user would call a number in the email, where the threat actor would convince the victim to download RMM software.

Read more here.—BH

Do you work in IT or have information about your IT department you want to share? Email [email protected].

It seems like every aspect of cybersecurity and IT is about protecting yourself from threats, but sometimes the best defense is a good offense. A career in penetration testing—the art of simulating adversarial cyber and social engineering attacks on a target to see just how tight their security really is—might be for you.

While it might be tough to make a name for yourself, just like a computer network, there are many different ways to break into (get it?) the field. IT Brew spoke with four experts on their advice for anyone looking to pivot their career towards ethical subterfuge.

Thomas Richards, principal software security consultant at Synopsys’s Software Integrity Group

Richards told IT Brew his “first and honestly, worst pen test ever” was for a former employer planning to switch from Windows-based to mobile-based software to run their business, which he found had several protocol-level issues. He subsequently got certified in offensive security and has since published over a dozen vulnerabilities, at least half of which were critical severity.

Richards advises prospective penetration testers to apply their existing knowledge of networks and systems towards hands-on experimentation.

“Underneath, we all need the same foundation of knowledge of networks and how they work, and have experience building and managing and maintaining them,” Richards said. “That knowledge then allows us to really home in on, ‘Okay, well, this is probably a bad design, there’s a vulnerability here,’ or even, ‘From experience, I know no one ever flips this switch.’”

“There are so many trainings available, and labs, and capture-the-flag events, and conferences, where you can go and just start networking with people,” he added. “These are all the things I look for when I get a résumé for someone coming up.”

Keep reading here.—TM

Do you work in IT or have information about your IT department you want to share? Email [email protected]. Want to go encrypted? Ask Tom for his Signal.

Today’s top IT reads.

Stat: 56 out of 61. That’s the number of UK firms in the world’s largest-ever four-day workweek trial that are keeping the policy in place, even though the study has ended. (the Washington Post)

Quote: “Our reliance on cables that are no wider than a garden hose is a surprise to many, who regard satellites as the main means of communication…The ‘cloud’ is not in the sky—it is under the sea.”—Mike Clare, National Oceanography Centre researcher, on the risk of damage to intercontinental fiber-optic cables due to climate change (Scientific American)

Read: Supreme Court justices admit that maybe they’re not the best-equipped party to make major revisions to Section 230. (CNBC)

Top-notch talent: No mission is impossible with the right freelancers on your team. Find world-class talent for your most mission-critical projects in less than 48 hours with Toptal.*

^{*This is sponsored advertising content.}