Abnormal Attack Stories: Internal Phishing

Abnormal Attack Stories: Internal Phishing

In this attack, attackers compromise an internal account within a company and use it to launch internal phishing attacks.

Quick Summary of Attack Target

Platform: Office 365
Email Security: Proofpoint
Victims: Internal employees
Payload: Malicious link
Technique: Compromised internal account

What was the attack?

  • Setup: Compromised accounts are commonly used by attackers to send attacks because they appear to originate from a trustworthy source, be it from a known partner or an internal account. In this case, the attacker launched an attack from an IP located in the United Kingdom, which is suspicious because this sender never sends from the UK, and the recipient rarely receives emails from there either.
email body
  • Email Attack: The attacker leverages a compromised account to send internal phishing attacks. The email itself is simple and masquerades as an encrypted message notification related to a OneDrive for Business file.
phishing page 1024x636 1
  • Payload: The link goes to a PDF hosted on a Russian domain which guides victims to click on another link to view/download the supposed file. After clicking the second link the victims are taken to a phishing page.
  • Result: Should victims fall for this attack, they risk further compromise within their company as the attacker gains access to more accounts to steal information or launch attacks from.

Why is this attack effective?

content analysis
  • Compromised internal account: By utilizing a compromised internal account, the attacker is able to bypass any external email filtering set in place by the company. In addition, it is easier to deceive recipients of this email as the email appears to be coming from a coworker.
  • Concealed URL: The link in the email is hidden in text of the company’s name, and the link hosted on the Russian domain is concealed in the text “VIEW ONLINE / DOWNLOAD”. After clicking the links, victims are taken to a phishing page tailored specifically to their company.

The post Abnormal Attack Stories: Internal Phishing appeared first on Abnormal Security.

Abnormal Security