Many attacks do not make noise. The intrusers can spend weeks within a network before they act, viewing emails, stealing data, or preparing a ransomware. These are the signs that should not be ignored.
1. Posts that no one has sent
Customers or suppliers who receive your messages that you haven’t written, or emails that you don’t remember. It is the classic sign of a committed mail account.
2. Posts that you haven’t created
Attackers create rules to send emails to an external address or to move the security warnings to the paperstore. Check your box rules from time to time.
3. Announcement notifications from strange places
Microsoft 365, Google and many services alert when someone accesses from another country or from a new device. If you get one you don’t recognize, change the password and activate the two-factor authentication.
4. Changed banking data
A provider always sends you a bill with a new account number. It can be a fraud with a suplanted mail or with the real box of the committed provider. Always confirm by telephone.
5. Slow equipment or with the ventilator to the maximum without reason
It can be a program mining cryptocurrencies or sending data out. It’s not always an attack, but it deserves a review.
6. Deactivated antivirus
If the antivirus appears turned off and no one has touched it, it’s a serious signal: many attacks disable it before it acts.
7. New Users or Changed permits
Administrator accounts that no one remember to have created, or users with more permits than they had.
8. Unusual network traffic in the morning
Large data loads outside the working hours can indicate that someone is bringing information.
9. Passwords that stop working
If several people cannot enter at the same time, someone may have changed their credentials.
10. Data of your company in a filter
Passwords or documents of your company that appear on forums or on the dark web. In our free analysis we check if your domain appears in known filters.
What to do if you see something
Do not delete anything and do not notify everyone for the same email that might be committed. Change the affected passwords from a clean team, activate the two-factor authentication and ask for a professional review. If you suspect an ongoing attack, notify us from the emergency form.