Practical guidance, threat alerts, and case studies from the field.
The email arrives from notifications@ceipalmail.com. SPF passes. DKIM passes. DMARC passes. Your spam filter sees a legitimate message from a trusted applicant tracking system used by thousands of staffing agencies worldwide.
An unsolicited job offer for an "IT Operations Coordinator" at $62,306.74 CAD/year. A company called TsunadeQ Systems Inc. claiming offices in Edmonton's Manulife Place. An "online interview" portal at interview365.net. Every element looked plausible at first glance —…
The "X12 Digital Systems" campaign represents a meticulously engineered employment fraud operation targeting Calgary IT professionals. This synthetic entity combines stolen corporate identities, impossible geography, and advanced quishing tactics to exploit job seekers. Every claimed business attribute—from corporate…
How Fraudsters Built, Deployed & Burned a Fake Company in Under 4 Days
I wrote the original piece after years of volunteering and working inside a nonprofit sector, shoulder-to-shoulder with people who would give you their last ounce of energy to keep services running. What I saw was inspiring—and a little…
I've spent years inside a nonprofit watching heroic teams hold services together with fragile systems. Every dollar on IT felt like a dollar away from the mission—and that paradox left us with aging tools, single points of failure,…
I've observed a troubling pattern that prevents even the most dedicated nonprofit organizations from reaching their full potential.
When the City of Hamilton suffered a ransomware attack on February 25, 2024, it marked a sobering milestone in Canadian municipal cybersecurity. The attack crippled roughly 80% of Hamilton's network, impacting services from business licensing to the fire…
Several months ago I assessed a local nonprofit Active Directory environment using PingCastle. The results were sobering: a risk score of 100/100, with issues like an unchanged KRBTGT account (Golden Ticket risk), too many privileged accounts, hundreds of…
In a recent case, I collaborated with a non-profit organization to unravel a classic password spray attack scenario. The organization's Executive Director faced a staggering 1,159 unauthorized sign-in attempts within a few hours.