In March and April a lot of companies in the EU were forced to quickly come up with solutions for work from home for large number of employees.This opened new attack vectors were those employees now working from home became primary targets for attackers.Since the beginning of the pandemics INFIGO IS worked on a dozen of incidents that affected medium and large size companies in the region.This presentation will go through results of incident responses performed by INFIGO. We will take a look at some of the common and not so common tactics, techniques and procedures used by real-world attackers that were identified in attacks against companies in the region.