Cybersecurity Awareness Month: Why DIB inboxes are targets right now

by Damion Martin, Head of Security & IT, ATX Defense

We're winding down Cybersecurity Awareness Month, a campaign originally launched in October 2004 by the Department of Homeland Security and the National Cyber Security Alliance. This year, CISA's theme is "Securing the Next 250" to align with America's 250th anniversary, while the National Cybersecurity Alliance is focusing on the theme "Don't Make It Easy for Them."

I talk to our ATX Defense employees year-round about why making things hard for attackers actually matters for our company. It's something other companies in the Defense Industrial Base (DIB) should be focusing on too.

Recently, someone on our team received an email from a compromised account at one of our actual vendors. The email included a link to a login page. Instead of blindly typing in their password, the employee trusted their gut, verified the request, and flagged it to me immediately. We've also had team members hit pause and ask for a security review before connecting new AI tools to their inbox and our CRM.

That is exactly the mindset all employees in the DIB need, because if you work in or around defense programs, you are a collection target. Recent government reports have made it very clear what nation-state actors are trying to take from companies like ours:

  • Over the summer, agencies like CISA and the FBI issued warnings about a Russian group (LAUNDRY BEAR) specifically targeting the DIB. Their goal isn't necessarily to drop ransomware. They want our conversations. They've been setting up fake defense conference pages and silently stealing sessions when people sign in.

     

  • Google's threat intelligence team recently flagged several suspected Russian clusters going after military and defense companies. Their tactic is simple but effective: send out a fake file-sharing link that eventually asks the user to "Continue with Google." Once the user clicks, they're taken to a real Google login page, but behind the scenes the attackers are stealing the access token. They only need one person to think the message looks normal.

     

  • Earlier this month, federal and allied intelligence services described similar tactics from Chinese state-sponsored operators. They want into your mail, they want your credentials, and they want to pull down entire mailboxes.

The prize they are chasing sits in our inboxes, our files, and any third-party tools we connect to our accounts. Every employee is a target, regardless of seniority or the type of work they do. 

I urge all defense-related workers to commit to taking two simple steps that protect data:

1. Trust Your Gut and Report It

If an email, text message, or chat looks slightly off, report it to your security lead. This includes messages that feel silly or harmless and especially the ones where you might have already clicked a link and would rather not admit it. I read the threat reports and see what hits our network. Your "weird email" might be the exact lure these groups are using. Believe me, your security team would rather take a minute to review a harmless message than miss the one that matters.

2. Think Carefully About App Connections

When you are asked to connect an outside tool or AI app to your internal tools, it isn't just a simple settings change. Clicking "Allow" gives that tool the same reach and access that you have. What you can open, it can open. What you can change, it can change.
Before requesting a new connection, take a moment to think about the downstream effects. What data is it asking to read? Whose customer emails does it include? What happens to the company if that vendor gets compromised later?

It Comes Down to the Everyday Actions

It's easy to read about nation-state groups and assume the fight happens somewhere far above our desks, in government agencies, threat intel teams, or expensive security tools. Those things matter, but none of the attacks above start there. They start with a mundane email that looks like it's from a vendor, a file-share link before your second cup of coffee, a pop-up asking you to "Allow" a new app so you can get back to work.
That's why our best defense isn't a single product or an annual training. It's the small decisions we all make every day.

Cybersecurity Awareness Month ends tomorrow, but the attackers aren't taking November off. Keep those habits going, keep the questions coming, and keep making it hard for them.