United States Law Enforcement Authorities have identified a Business Email Compromise (BEC), focused on healthcare, professional services, higher education, and real estate closing companies. BEC attacks have evolved over the last couple of years from sending phishing emails to millions of targets, to sending spear phishing emails to a few hundred. The spear phishing is targeting individuals that are involved with a company\u2019s financial decisions with the intention of compromising that corporate officer\u2019s email account. The attackers are focusing specifically on Office 365 as many of the security features that product offers are turned off by default.<\/p>\n
The spear-phishing email will appear to be an email link to an encrypted document. Once the user clicks on that link, it will ask for their user credentials for Office 365 which is a cloud-based software service. Once the user enters their credentials, the attacker captures their user\/password and will then have access to their Outlook email account without installing malware or remote software on their computer. Here is an example of the fake login request:<\/p>\n
Once the account is compromised, the attacker views the inbox and sent messages, which may include invoice forms, to gather intelligence about the flow of money during legitimate business transactions.<\/p>\n
The attacker will then change the mail rules associated with the victim\u2019s email account. Here are examples of some mail rules that are being changed:<\/p>\n
\u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 The attacker will have emails forwarded to their own email account to gain real-time intelligence on the compromised user, customers, other employees, vendors, etc.<\/p>\n
\u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Alternatively, attackers are forwarding emails with key subject lines that they are interested in.<\/p>\n
\u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Once sufficient Intel is gathered, there are a few attack methodologies USSS has observed. For example:<\/p>\n
1.\u00a0 \u00a0 \u00a0 \u00a0 \u00a0The attacker logs into the compromised account and sends spear phishing emails to other victims to compromise or have them forward the money to the attacker\u2019s bank account<\/p>\n
2.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 The attacker creates an email account that appears to be from the compromised user (example: JohnDoeUSFinancial@gmail.com) and sends the BEC email having money transferred to another account<\/p>\n
\u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Move Emails:<\/p>\n
Similar to email forwarding, attackers will move emails to the Notes, Junk Email, or RSS Subscriptions folders.<\/p>\n
\u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Change Privileges:<\/p>\n
If the attacker compromises an admin account, they will elevate the privileges of a compromised user so they can read emails from an admin account.<\/p>\n
\u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Delete Emails:<\/p>\n
Attackers have also been known to create a rule to delete inbound emails from certain email accounts (other possible phishing victims, banks, etc.), so the user is not alerted that his\/her email account has been compromised.<\/p>\n
Below are tips to follow once a company suspects or confirms that it has been a victim of a BEC:<\/p>\n
<\/p>\n
1.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Block the User\/Attacker from Signing-in:<\/strong><\/p>\n \u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Open the \u201cOffice 365 Admin Center\u201d \u2013> \u201cUsers\u201d<\/p>\n \u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Select the employee that you want to block, and then choose \u201cEdit\u201d next to \u201cSign-in Status\u201d in the user pane<\/p>\n \u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 On the \u201cSign-in status\u201d pane, choose \u201cSign-in blocked\u201d and then \u201cSave\u201d<\/p>\n \u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 In the \u201cOffice 365 Admin Center\u201d, in the lower-left navigation pane, expand \u201cAdmin Centers\u201d and select \u201cExchange\u201d<\/p>\n \u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 In the \u201cExchange Admin Center\u201d, navigate to \u201cRecipients\u201d -> \u201cMailboxes\u201d<\/p>\n \u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Select the user, and on the user properties page, under \u201cMobile Devices\u201d, click \u201cDisable Exchange ActiveSync\u201d and \u201cDisable OWA\u201d for Devices and answer \u201cYes\u201d to both<\/p>\n \u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Under \u201cEmail Connectivity\u201d, \u201cDisable\u201d and answer \u201cYes\u201d.<\/p>\n 2.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Remove the Compromised Account From All Admin Groups:<\/strong><\/p>\n \u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Sign in to the \u201cOffice 365 Admin Center\u201d with a global administrator account and open \u201cActive Users\u201d<\/p>\n \u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Find the suspected compromised account and manually check to see if there are any administrative roles assigned to the account<\/p>\n \u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Open the \u201cSecurity & Compliance Center\u201d<\/p>\n \u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Click \u201cPermissions\u201d<\/p>\n https:\/\/docs.microsoft.com\/en-us\/office365\/securitycompliance\/responding-to-a-compromised-email-account<\/p>\n \u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Manually review the role groups to see if the suspected compromised account is a member of any of them. If it is:<\/p>\n a. Click the role group and click \u201cEdit Role Group\u201d<\/p>\n b. Click \u201cChose Members\u201d and \u201cEdit\u201d to remove the user from the role group<\/p>\n 1.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Open the \u201cExchange Admin Center\u201d<\/p>\n 2.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Click \u201cPermissions\u201d<\/p>\n 3.\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Manually review the role groups to see if the suspected compromised account is a member of any of them. If it is:<\/strong><\/p>\n a. Click the role group and click \u201cEdit\u201d<\/p>\n b. Use the \u201cMembers\u201d section to remove the user from the role group<\/p>\n \u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Reset Password:<\/p>\n Have the admin reset the password for the compromised user account.<\/p>\n Make sure the admin does not email the new password to the user account.<\/p>\n At this point, Multi-Factor Authentication is highly recommended.<\/p>\n \u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Remove Email Rules:<\/p>\n Open the \u201cOffice 365 Admin Center\u201d \u2013> \u201cActive Users\u201d<\/p>\n Review the compromised email account and expand \u201cMail Settings\u201d<\/p>\n Look for \u201cEmail Forwarding\u201d, click \u201cEdit\u201d and remove any suspicious forwarding addresses<\/p>\n \u2022\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Review Email Inbox Rules:<\/p>\n Log into the compromised account, click settings (the gear icon at the top) and then click \u201cMail\u201d<\/p>\n Click \u201cInbox and Sweep Rules\u201d and review the rules<\/p>\n Delete any suspicious rules<\/p>\n Once the compromised account is secured, the victim company should have the user of the compromised account perform a virus scan. Once the scan is complete, allow the user to log into their account.<\/p>\n As of October 2018, a security update patch for Office 365 now enables logs by default, but it is worth mentioning to the victims to check their logs \u2013 both global and account-based. Make sure that Audit Logging is turned on.<\/p>\n The admin should disable automatic email forwarding. If the company is not able to disable email forwarding on all email accounts, then they should monitor the email forwarding rules by reviewing audit logs.<\/p>\n The admin should fine-tune the threat management policies in the Office 365 Security and Compliance Center. The Security and Compliance Center includes reports and dashboards that you can use to monitor users\u2019 settings.<\/p>\n Companies that receive BEC emails should preserve the emails to provide to investigators for header information- even if the attack was unsuccessful.<\/p>\n","protected":false},"excerpt":{"rendered":" Emerging Business Email Compromise (Phishing Scam) United States Law Enforcement Authorities have identified a Business Email Compromise (BEC), focused on healthcare, professional services, higher education, and real estate closing companies. BEC attacks have evolved over the last couple of years from sending phishing emails to millions of targets, to sending spear phishing emails to a […]<\/p>\nOther Remediation Steps:<\/h3>\n