You cannot approach Isabella as an outsider. She would ignore you, or report you. Five years ago a ransomware crew would simply have sprayed Blackridge's mail servers with malicious Word files, but modern Endpoint Detection and Response catches automated malware instantly. The human element is the only vulnerability a patch cannot fix. It is exactly why the syndicate hired you: you have to sound like part of Blackridge itself. This is where your back-office access becomes the most useful thing you own. As a third-party contractor, your firm holds a managed-services agreement with Blackridge that grants user-provisioning rights inside their directory, the system that decides who has an account, in which department, with what access. It exists so your firm can onboard and offboard Blackridge staff without burdening their IT team. A routine arrangement. Most large firms have one. You open the provisioning panel and create a new account. A name. A department. A title. > `[email protected]` > **Risk Analyst, Risk Oversight** > Department: Risk Oversight > Reports to: *(left blank, provisioned as a secondment)* The moment you save it, the directory does the rest: a live mailbox, and within minutes Elliot Cinder appears in the company's internal address book, the one that fills every employee's autocomplete. This is not a spoofed address or a look-alike domain. It is a real Blackridge mailbox on Blackridge's own servers, passing every internal check without a flag. When Isabella gets a message from `[email protected]`, her mail client shows it like any other internal note: no warning banner, no external-sender label, no quarantine. See also: [[Glossary#Pretexting]] ![[elliot-cinder-persona-card.svg|EX-04, Elliot Cinder persona rules]] You design the persona with care. Not a senior executive; that invites scrutiny. Not junior staff; that invites dismissal. Something quieter: an internal risk analyst who watches dashboards and sends cautious notes. Neutral tone, procedural language, no strong opinions. A message that belongs in the system because it does. The goal is not to impress Isabella. It is to be one more internal note she has to process on a busy day. The account is live. The mailbox is active. The identity is ready. You hover over the portfolio file, then stop. The voice needs to be sharper before you use it. [[Cybercrime/The_Phisherman/Refine Internal Persona|Refine Internal Persona]] --- [[Study Blackridge Portfolio]] <details> <summary>🔎 Behind the curtain: the contractor who holds the keys</summary> <p>This is one of the most realistic moves in the whole game. Large firms hand parts of their IT to outside contractors, and those contractors often hold deep access, including the right to create accounts. That turns the supplier into a back door: compromise the vendor, and you inherit trusted access without ever "hacking" the target. Supply-chain and third-party access abuse sits behind some of the biggest incidents of recent years, and investigators have also exposed schemes where fake remote "employees" were planted inside Western firms to win exactly this kind of insider foothold.</p> <p><b>Defender's lesson:</b> treat contractor and vendor access like your own crown jewels: least privilege, strong identity checks, and alerts when a supplier account suddenly creates or changes users.</p> </details>