Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/30/2017
02:20 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
0%
100%

Office 365: A Vehicle for Internal Phishing Attacks

A new threat uses internal accounts to spread phishing attacks, making fraudulent emails even harder to detect.

Cybercriminals go where the users are. Office 365, which has more than 100 million active monthly subscribers, has become a hotspot for compelling and personalized cyberattacks. Users trust emails from coworkers, especially those with the correct corporate email address.

Traditional phishing attempts have red flags: suspicious attachments, bold requests, misspelled words, questionable email addresses. Users know how to react to these. But what happens when attacks are more personalized, with legitimate addresses and reasonable requests?

These have become more popular and tougher to spot, says Asaf Cidon, spearphishing expert at Barracuda. The company recently released a report on a threat he calls Account Compromise. Once they have an employee's Office 365 account information, threat actors can craft realistic-looking messages and send them from an account their victims trust.

Attackers primarily steal credentials using traditional methods, he continues. Most rely on phishing or spearphishing to send victims to fraudulent websites, where they are prompted to reset their Office 365 credentials. Some buy users' credentials on the dark web.

"What's new is what happens after they get access to the accounts," Cidon says. Threat actors can conduct several types of attacks after they gain a foothold in an organization.

In one common scenario, an attacker sets forwarding rules on an Office 365 account to send emails to an account they control. From there, they can both steal data and monitor the user's internal and external communication patterns so they can plan future attacks.

Threat actors also impersonate their victims and send emails to other employees with the goal of collecting data. Some send emails with PDF attachments that can only be opened with a username and password. Some send an invoice for payment that requires logging into a web portal, where they have to log in with a corporate email address and password.

Damage could potentially extend outside the organization. Cidon explains a scenario in which an attacker, impersonating an employee, used their access to request a wire transfer from a partner company. The employee in the scenario didn't even realize the transfer was happening.

"This is an evolution of spearphishing - we're seeing more and more sophistication," he says. A couple of years ago, cyberattackers primarily targeted executive employees. These new Office 365 threats are putting all employees at risk.

"With this attack, they're just trying to get in and once they're in, a lot of the employees getting targeted are not high-level. It's not just executive targets," Cidon continues.

There are red flags that signify a company is targeted in one of these attacks. Oftentimes the IP addresses used to log into corporate accounts come from other countries, he says, and looking at the log can identify geographical anomalies. It also helps to keep track of your email account to see when emails are getting forwarded or sent to unfamiliar addresses.

Cidon advises security leaders to train employees on how to spot phishing attacks to prevent attackers gaining initial access. He also advises adding security layers like multi-factor authentication to Office 365 to lessen the chance of a break-in.

"Traditional email security systems are going to be almost useless in stopping this," he says, noting how most tools look at the API of the email provider. "Once an attacker is in, they don't see internal emails … only the external emails coming in."

Related Content:

Learn from the industry’s most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Click for more info and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
EKFletcher
50%
50%
EKFletcher,
User Rank: Apprentice
9/4/2017 | 11:47:37 AM
IP addresses outside the US
Nice information.  Thank you. 

How can someone with a list of IP addresses showing where the users have signed in from take that and easily tell what IPs are from another contry?  If you have hundreds of IPs, it would be a daunting task to discover if any IPs were from another contry.

Thanks! 
Cloud Security Threats for 2021
Or Azarzar, CTO & Co-Founder of Lightspin,  12/3/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Assessing Cybersecurity Risk in Todays Enterprises
Assessing Cybersecurity Risk in Todays Enterprises
COVID-19 has created a new IT paradigm in the enterprise and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27772
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in coders/bmp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned int`. This would most likely lead to an impact to application availability, but could po...
CVE-2020-27773
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/gem-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned char` or division by zero. This would most likely lead to an impact to appli...
CVE-2020-28950
PUBLISHED: 2020-12-04
The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges during installation process.
CVE-2020-27774
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of a too large shift for 64-bit type `ssize_t`. This would most likely lead to an impact to application availability, but co...
CVE-2020-27775
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned char. This would most likely lead to an impact to application availability, but c...