Blue Team Diaries: Recruit — Out today, read for free this week!

Read the new episode of Blue Team Diaries, free to download on Amazon Kindle this week. Get started with the first chapter right here!

Mike Sheward
11 min readJan 3, 2022
Blue Team Diaries: Recruit

Download the full story on Kindle, free for all this week: https://mybook.to/btd-recruit.

Happy to announce the latest release in the Blue Team Diaries series. “Recruit” sees the Blue Team find themselves in the right place at the right time to help unravel the reason why supposed new hires that no one is expecting keep showing up at the office.

To get started, you can read the first chapter right here!

Blue Team Diaries: Recruit — Chapter One

My favorite thing to do after arriving at the office was to promptly leave it. Specifically, I enjoyed leaving to go get coffee from the good coffee place across the street. The office-provided coffee was pretty bad, and if you emptied the machine, you’d be bound by office law to fill it up again. I didn’t want any part of inflicting that pain upon my fellow corporate citizens, so always preferred sourcing my caffeine externally. I liked to head out within about 30 minutes of arriving, just enough time to identify any minor fires that had manifested in my inbox overnight and dampen them down, but not long enough to really get stuck into a project.

My trips to the coffee place would rarely be taken solo. I’d usually be accompanied by Kirsten, my work spouse. We’d use the walk to catch up, strategize, and generally talk shit about the people we didn’t like at work. If anyone asked, technically it was a daily stand-up meeting.

Today was no exception, and about twenty minutes after I’d arrived, I was heading down the stairs with Kirsten to get our fill of expensive, but decent, coffee.

It was a Monday morning, so we had a whole weekend’s worth of bullshit to catch up on. We started with sports, followed by the activities we’d done over the weekend. Kirsten led a much more active life than I did, so her list of weekend activities was always more interesting.

Standing in a long line at the coffee place, we both had sufficiently good OpSec, so as to scan our surroundings for any of the folks we might potentially be about to discuss.

“Good morning, how are you both today?” Asked our loyal barista, who we’d spoken to nearly every single day for the last three years, yet still weren’t quite confident enough in knowing their name to fully commit to saying it out loud.

“Good thanks, and you?” Kirsten responded.

“Oh yeah, you know,” came the reply.

Kirsten and I both looked at each other, we almost certainly didn’t know.

“Oh yeah, we know,” I said, unconvincingly.

Coffee exchanged hands, and we began the short walk back to the office.

Our office occupied the entire eleventh floor of a high-rise building. On the way back, we always aspired to climb the stairs we’d previously descended on our way to get coffee, but rarely were our aspirations met, so the elevator would have to suffice.

We’d cram into the elevator alongside our fellow soggy commuters, stand in silence, clinging onto the hope that they would leave the elevator before our floor, so we wouldn’t have to quietly say ‘excuse me’ and slide past. Most of the time people would get off at the fifth floor, as that contained the main entrance to the largest office in the building. It was a giant law firm, whose lunch orders would frequently accidentally make their way up to our office, but rarely made it back down again. Today was our lucky day, our elevator buddies got off on the fifth floor, and we had a straight shot to the doors when we got to ours.

Upon exiting the elevator, our typical routine would be to head up the corridor to our reception area and ask Frankie, our office manager, how his day was going. We always felt bad for him, because he sat alone all day at the front desk, while the rest of us were in the office proper, tucked away behind a set of locked doors. In downtown Seattle, the locked doors were always a welcome feature.

Not wishing to deprive Frankie of the wonderful social experience that was interacting with Kirsten and Six, we’d lean against the desk and listen to what he had to say for a bit. Today, however, it appeared we wouldn’t get that opportunity.

Frankie had a visitor he was signing in, so instead of interacting with him, we gave a small wave from behind the back of whoever was going through the visitor registration process, and continued back to our desks. As we walked past, it became clear that something might be a little off. Frankie looked discombobulated and was furiously clicking around on his computer.

“And I’m sorry, who is your hiring manager?” We heard him ask the visitor, a larger set man who was probably in his late forties.

“I don’t know, they never said, all I know is Leah Jazlyn is the recruiter I’ve been working with the last few weeks, and she told me to come here today for my first day,” the man replied.

“Ok, let me reach out to Leah, I’m sorry, we weren’t expecting any new hires today, so I don’t have anything ready for you,” said Frankie.

Kirsten and I opened the door into the main office, fresh from overhearing the conversation, as soon as we were out of earshot, we began discussing what we’d just heard.

“Well that’s a pretty crappy experience,” I said. “Showing up for your first day on the job only to be told we weren’t expecting you!”

“Yeah, but something isn’t right there,” Kirsten responded, “Leah Jazlyn? She’s based in Atlanta, she wouldn’t be recruiting for a role in Seattle would she?”

I shrugged my shoulders, I’d learned long ago it was not worth trying to track the operational procedures of our HR department. I mean, I wasn’t sure that they did so themselves, so why should I?

“I gotta go listen to this some more to see how it plays out, come on,” said Kirsten, beckoning me back out to the reception area. Her curiosity getting the better of her.

The layout of the office meant we could stand out of sight from the front desk around a corner, but still be able to hear what was going on. Like two spies, albeit spies with a giant overpriced coffee in hand. We stood still and listened to the conversation developing.

“I don’t know what to tell you, sir, Leah says she hasn’t been working with anyone who is starting today, and I have no record of you starting either.”

“Well, she’s lying then, I have emails I can show you from her, I don’t understand,” the man responded, his tone getting increasingly annoyed. “Let me find them..”

It was at this point Kirsten decided to break cover, dragging me out alongside her.

“Everything okay out here, Frankie?” she asked.

“We’re having a little bit of a tricky time finding a record of this gentleman who believes he’s starting with us today,” Frankie responded, semi-distracted while flicking through various computer screens.

“Here are the emails, see?” said the man, flashing his iPhone briefly in our direction before pointing it back towards Frankie.

“Sorry Sir, what was your name?” Kirsten asked. I could tell she sensed the man was starting to get a little irate and was going to try and calm him down.

“John Larson,” the man replied, “it’s supposed to be my first day as an outbound sales rep.”

“Ok John, let me go and have a chat with a couple of other folks on that team, and see if I can find out what’s going on here.”

“Thank you,” replied John.

“Would you like a coffee while you wait?” I asked, trying to be somewhat useful.

I was anticipating that John might be in for a long delay, based on the fact that his supposed recruiter was claiming not to know who he was.

“Oh yes please, thank you for offering”

He pointed towards the coffee cup that I was holding. “Will it be from the same place as yours? I love that place, I’d do a caramel latte, please.”

Of course, I’d been planning on simply offloading some of the mediocre office coffee onto our visitor, however, I’d forgotten that I was still holding my branded coffee cup from the good coffee place. Rather than being a complete cheapskate, and also not wanting to compound John’s overly lame start to the day, I played off that I’d absolutely intended to go back to the same coffee place I’d just come from. Witnessing this debacle, Kirsten smiled. I locked eyes with her as I began my self-inflicted side quest, to return to the good coffee place where I’d pick up a fancy coffee for John. I would definitely be expensing this one though.

I was on my way back, Caramel Latte firmly in hand when I got a text from Kirsten.

“No one has a clue who this guy is, this is very strange,” it read.

My mind began to go to all the places you’d expect a Blue Teamer’s mind to go. Were we being socially engineered? But why, it’s not like we’d just let the guy into the office and give him a job. Had someone gotten into Leah’s email? If so, why would they have just reached out to a random applicant and offered them a job? Each avenue I ventured down in my brain didn’t make sense. It was still early of course, so I was confident that once I’d woken up a bit more, I’d be able to conjure up a better theory. We also had the relatively unique proposition of being able to investigate with the help of a person standing in front of us.

I emerged from the elevator to find John, looking perturbed, but somewhat more relaxed on one of our comfy office couches. I handed him his coffee.

“Let me go find out what is going on,” I said, handing it to him.

“Thank you so much,” he replied.

Heading through the door, I found Kirsten and Frankie, having a discussion in a conference room.

“Six, no one knows who this guy is. He says he has emails from Leah though,” Kirsten said.

“Well, let’s see if we can get a look at those emails then,” I responded. “I’m very suspicious of course, we need to be wary of motives here.”

Kirsten nodded, and the three of us left the conference room and headed back to the reception area where we could begin the process of figuring out exactly what had led to this gentleman being in our presence.

“John, by way of a proper introduction, my name is Six, and this is Kirsten, and we’re on the security team here at Syntatic. We’d like to take a look at the emails you got from Leah if that’s ok with you?”

“Sure, that’s absolutely fine, I’d welcome that actually,” John replied, beckoning us to view his iPhone screen in a close-up fashion. “Here is the email I got telling me when to start and where to go.”

Sure enough, there was a very official-looking email claiming to be from one of our recruiters, instructing John to be at our office at the date and time he had dutifully arrived at. The view on the phone didn’t allow me to see the full email address of the sender, just the name, Leah Jazlyn, but I could tell from the opening line of the email that something wasn’t quite right.

“Thank you, I can confirm the payment has been received, and you’re all set to start with us,” it read.

“John, what is the payment mentioned in this email?” I asked.

“Oh, that was the $500 equipment deposit they said I’d need to pay to use for the laptop and stuff,” he replied.

“Oh no,” said Kirsten, rolling her eyes. “John, our company would never make you pay any sort of fee, or deposit before starting here, I believe you have been scammed, unfortunately.”

For a brief few moments, you could hear a pin drop, before John got fired up.

“No, this is a real email from your recruiter, I have others, I even did a video interview with them for Christ’s sake.”

“A video interview?” I asked.

“Yes, over Zoom, I met with them a week or so ago.”

I wanted to expand the sender’s email address to confirm my suspicions that this was in fact sent by a fake Leah and not the Leah who worked out of our Atlanta office. I asked John if it was okay for me to handle his phone, he agreed.

The email address was very clearly from a domain that was similar, but not the same, as our own.

“If you look closely John, the domain in the email address here isn’t ours. I’m afraid you are the victim of a scam.”

“What do you mean, that’s the name of the company right? Syntatic? It says Syntatic right there!”

He was right, it did say Syntatic, but it also said “.cc” which was not a top-level domain that we used at all. If my memory served me correctly, it was a top-level domain associated with a small, Australian-owned island.

“Unfortunately, people register similar domain names to legitimate companies all the time,” explained Kirsten, “and that seems to be what has happened here.”

“How do you explain the Zoom interview then?” John asked.

“Anyone can set up a Zoom account, for free,” I added.

It was starting to dawn on John that he had been duped, and we all felt bad for him. Not only was he $500 out of pocket, but he was also not starting the new job he thought he had. Scammers make me sick.

“I’m sorry,” I said, “this is a really shitty scam.”

John sighed.

“Well, I suppose I should be getting out of your hair then, thanks for the coffee.”

We all apologized once more, but before John walked out into the rainy Seattle streets, and out of our lives forever, Kirsten had one last request.

“John, could you forward all of those emails to us, I’d like to take a look in more detail.”

“Oh sure,” he replied.

Kirsten assisted John in sending all the communications he had to us. She also provided him with some advice about reporting the scam to law enforcement. As John left, Kirsten and I headed back to our desks.

“I feel terrible for that guy, I’d be amazed if he ever gets that money back,” Kirsten said.

“Imagine thinking you’re about to start a job, and then getting there and finding out it’s not real,” I replied, “I’m not sure how I’d cope with that to be honest, at least he kept his head, can’t say I’d do the same.”

“How many others do you think there are?” Kirsten asked. I stopped in my tracks.

“Well, I hadn’t thought about there being others, but now you’ve planted that seed, I guess it makes sense to prepare.”

The question was, how could we prepare for others, what could we do, how many more ‘recruits’ would show up at the office thinking they were about to start a job with us?

“I’d take a laptop full of ransomware over this shit any day of the week,” I said, longingly.

Ready to read the rest of the story? Download the full story on Kindle, free for all this week: https://mybook.to/btd-recruit.

--

--

Mike Sheward

Information security professional specializing in SecOps, IR and Digital Forensics. Author of the Digital Forensic Diaries, and now, the Pen Test Diaries.