Bosses Panic-Buy Spy Software To Keep Tabs On Remote Workers

An anonymous reader quotes a report from Bloomberg: With so many people working remotely because of the coronavirus, surveillance software is flying off the virtual shelves. "Companies have been scrambling," said Brad Miller, CEO of surveillance-software maker InterGuard. "They're trying to allow their employees to work from home but trying to maintain a level of security and productivity." Along with InterGuard, software makers include Time Doctor, Teramind, VeriClock, innerActiv, ActivTrak and Hubstaff. All provide a combination of screen monitoring and productivity metrics, such as number of emails sent, to reassure managers that their charges are doing their jobs.

ActivTrak's inbound requests have tripled in recent weeks, according to CEO Rita Selvaggi. Teramind has seen a similar increase, said Eli Sutton, vice president of global operations. Jim Mazotas, innerActive's founder, said phones have been ringing off the hook. Managers using InterGuard's software can be notified if an employee does a combination of worrisome behaviors, such as printing both a confidential client list and a resume, an indication that someone is quitting and taking their book of business with them. "It's not because of lack of trust," Miller said, who compared the software to banks using security cameras. "It's because it's imprudent not to do it." The software can also be a way for employers to grant more flexibility to workers to fit their jobs around other parts of their lives. It may also let managers spot areas that are overstaffed or where they may need additional hands. Sutton from software maker Teramind says employers worried about workers' every moves might have a bigger issue to deal with. "It's not about spying on the user," Sutton said. "If you hired them, you should trust them. If you don't, they have no reason to be part of the organization."

Have you been required to use surveillance software while working from home? If so, which software is your employer using?

Read more of this story at Slashdot.

nmap -sV --script vuln -p- <target-network>

tail -f /var/log/suricata/fast.log | grep <cve>

Check Vendor Security Advisory Bulletin

title: Detect Exploitation - Bosses Panic-Buy Spy Software To Keep Tabs On Remote Workers
id: e9fb9958-55e4-4fd2-a380-f37efd733f51
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-27
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-27"
        description = "YARA Signature for "
    strings:
        $str = "Bosses Panic-Buy Spy Software " ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Bosses Panic-Buy Spy Software To Keep Ta")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*Bosses Panic-Buy Spy Software To Keep Ta*"

CommonSecurityLog
| where Message has "Bosses Panic-Buy Spy Software To Keep Ta"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc