Full Report
In this blog, explore how Huntress caught an attempt at financial fraud through business email compromise (BEC) in Microsoft 365.
Analysis Summary
# Incident Report: Business Email Compromise and Financial Fraud Attempt
## Executive Summary
Huntress MDR identified a Business Email Compromise (BEC) incident targeting a US-based logistics company, originating from a threat actor in Nigeria. The attacker successfully gained access to a corporate account and implemented malicious inbox rules to intercept and hide communications between the victim and global vendors. The intervention by the Huntress SOC prevented potential financial loss through diverted wire transfers and fraudulent invoice manipulation.
## Incident Details
- **Discovery Date:** July 2023 (during product beta phase)
- **Incident Date:** July 2023
- **Affected Organization:** Not disclosed (US-based logistics company)
- **Sector:** Logistics
- **Geography:** United States (Victim), Nigeria (Attacker source)
## Timeline of Events
### Initial Access
- **Date/Time:** July 2023
- **Vector:** Likely credential theft (specific method not disclosed, but resulted in a successful login).
- **Details:** The first successful unauthorized login was detected originating from IP address `102.88.63[.]112` in Kaduna, Nigeria.
### Lateral Movement
- **Details:** The attacker utilized the compromised account to monitor communications with external vendors. They targeted global logistics partners in Switzerland and China, as well as a clothing brand, attempting to expand the scope of the fraud across the supply chain.
### Data Exfiltration/Impact
- **Details:** The attacker attempted to intercept invoices and payment information. By moving legitimate vendor emails to hidden folders and marking them as read, they prepared to spoof communications and provide fraudulent bank routing details for fund diversion.
### Detection & Response
- **How it was discovered:** Huntress SOC received an alert for a suspicious login from a Nigerian IP address.
- **Response actions taken:** The SOC traced the user activity, identified the creation of malicious inbox rules, and alerted the client to remediate the account and delete the rules.
## Attack Methodology
- **Initial Access:** Compromised credentials.
- **Persistence:** Creation of malicious inbox rules (e.g., rules named "jkhjg" and "m,bvc") to manage and redirect incoming mail.
- **Privilege Escalation:** Not applicable (used existing user privileges to manipulate mail).
- **Defense Evasion:** Emails were automatically moved to the "Conversation History" folder—a folder used by MS Teams that users rarely check—and marked as "Read" to hide the attacker's presence.
- **Credential Access:** Likely obtained via phishing or credential harvesting prior to the incident.
- **Discovery:** Monitoring email threads for mentions of "Accounts Payable," "Invoice," and "Routing Numbers."
- **Lateral Movement:** Inter-organizational targeting by interacting with external vendor contacts.
- **Collection:** Intercepting financial documents and communication strings.
- **Exfiltration:** Not applicable (focused on redirection of funds).
- **Impact:** Financial fraud via wire transfer diversion (Thwarted).
## Impact Assessment
- **Financial:** Potential loss of tens to hundreds of thousands of dollars in redirected payments (Prevented).
- **Data Breach:** Compromise of sensitive business communications and financial documents (Invoices).
- **Operational:** Minimal disruption due to rapid detection, but required account resets and audit of financial records.
- **Reputational:** Potential damage to vendor relationships if fraudulent invoices had been successfully processed.
## Indicators of Compromise
- **Network Indicators:**
- `102.88.63[.]112` (Kaduna, Nigeria)
- `102.129.153[.]110` (Associated with malicious rule creation)
- **Behavioral Indicators:**
- Creation of inbox rules with nonsensical names (e.g., "jkhjg", "m,bvc").
- Automatic moving of emails to the "Conversation History" folder.
- Logins from anomalous geographic locations (Nigeria/Florida) within the same session.
## Response Actions
- **Containment:** Identifiction of the compromised session and notification to the user.
- **Eradication:** Removal of the malicious inbox rules and resetting of the compromised account credentials.
- **Recovery:** Review of all sent/received mail during the compromise period to ensure no fraudulent payments were initiated.
## Lessons Learned
- **Visibility is Key:** Attackers often use obscure folders (like Conversation History) to hide their tracks; monitoring for activity in these areas is vital.
- **Rule Monitoring:** Automated alerts for the creation of new inbox rules (New-InboxRule) can serve as an early warning for BEC.
- **Geographic Anomalies:** Logins from high-risk regions or impossible travel scenarios remain a primary indicator of account takeover.
## Recommendations
- **Enforce Multi-Factor Authentication (MFA):** Ensure MFA is required for all users, particularly for logins from new devices or locations.
- **Disable Legacy Authentication:** Prevent attackers from bypassing MFA through older protocols.
- **User Training:** Educate employees, especially in finance/logistics, to verify bank detail changes via a secondary, out-of-band communication channel (e.g., a phone call).
- **Regular Audit:** Periodically review inbox rules and forwarding settings across the organization.