The attacks we are called in to investigate in Bangladesh have shifted. Less opportunistic defacement, far more financially motivated intrusion. Here are the five patterns we see most often, and the controls that actually stop them.
1. Ransomware and double extortion
Modern ransomware crews steal data first and encrypt second, so paying for a decryption key does not stop the leak. The usual entry points are boringly consistent: an exposed RDP or VPN endpoint without multi-factor authentication, an unpatched edge device, or a user who ran an attachment.
What works: MFA on every remote access path, offline or immutable backups that are restore-tested (an untested backup is a hope, not a control), aggressive patching of internet-facing appliances, endpoint detection and response rather than signature-only antivirus, and network segmentation so one compromised laptop cannot reach the file server and the domain controller.
2. Phishing and business email compromise
BEC costs Bangladeshi companies more than ransomware in many cases, and it involves no malware at all. An attacker watches a mailbox for weeks, learns your invoicing language and supplier names, then sends a payment-detail change at exactly the right moment.
What works: MFA on email (phishing-resistant where possible), SPF, DKIM and DMARC configured to reject rather than just monitor, alerts on mailbox forwarding-rule creation, an out-of-band verification rule for any change of bank details, and staff training that is repeated rather than annual.
3. Web application attacks
Public-facing applications remain the most reliable way into an organisation. The findings that lead to real compromise in our engagements are rarely exotic: broken access control (changing an ID in a URL to read someone else's record), injection through a parameter that never gets sanitised, insecure file upload that yields a web shell, and authentication that can be brute-forced because nothing limits attempts.
What works: regular VAPT, a tuned Web Application Firewall in blocking mode, secure coding standards, and dependency scanning in your build pipeline.
4. Exposed cloud storage and misconfiguration
As Bangladeshi companies move to AWS, Azure and GCP, the most common serious finding is not a clever exploit — it is a storage bucket set to public, a database reachable from the internet, an over-permissive IAM role, or a secret committed to a public repository.
What works: a cloud configuration review, least-privilege IAM, mandatory encryption, secret scanning in CI, and alerts on any change that makes a resource public.
5. Supply chain and third-party risk
Your security is your vendors' security. A compromised software update, a developer agency with access to your production server, or an npm package with a malicious maintainer will all bypass your perimeter entirely.
What works: vendor security questionnaires with teeth, contractual right-to-audit, separate credentials per vendor with an expiry date, pinned and reviewed dependencies, and removal of access the day a contract ends.
The pattern across all five: attackers are not defeating strong controls, they are finding the places where controls were never applied — the forgotten subdomain, the service account without MFA, the staging server with production data.
A practical 90-day plan
- Days 1–30: inventory every internet-facing asset and every account with remote access. Turn on MFA everywhere. Confirm your backups restore.
- Days 31–60: run a VAPT against your main application and external perimeter. Fix critical and high findings.
- Days 61–90: set DMARC to reject, deploy EDR, and put 24/7 monitoring in place — either in-house or through a managed SOC.
Oriole Security helps organisations across Bangladesh work through exactly this list. Book a free 30-minute consultation and we will tell you honestly which of the five is your biggest exposure.