0

Since yesterday, one of my work email addresses is used to send spoof emails with phishing attachments. SPF and DKIM was configured on my domain name but not DMARC, but since yesterday in the evening, everything is configured and I received a report this morning, so this point is ok. But this is not the main problem.

The scam email was sent almost only to the contact list and history used with this address (some suppliers), and the body was signed with the name of my coworker using this address and appeared really believable (like asking to confirm availability of some products listed in the attachment). So the hackers have had access at some point to the content of our mailbox, they are not only using our address to send some viagra related links, but in this case, why aren't they just using our credentials to send the mails ?

I am as confused as worried and I don't know where to look. I already have changed all passwords of all our domain email addresses ; the email address used by the hackers was logged in a few devices, all of them run on ubuntu except one on windows: this is obviously the main suspect (no offense haha), so I disconnected it from the network and ran an analysis but everything seems ok...

Everything appears to be ok from my point of view but knowing that someone somehow managed to watch our mailbox content really worry me, so I now rely on you and your ideas about this situation.

Thank you everyone for your attention, I may have forgot to tell you some details so don't hesitate to ask me.

1 Answer 1

0

This sort of malware (e.g. Horabot) tends to harvest contacts and message content from Outlook but not credentials, which are harder to extract—and might not work given MFA or when connecting from another host. Email Account Compromise (EAC, aka Account Takeover, ATO) is a nasty beast. It's harder to facilitate and will attract more attention (and the industry is getting better at detecting it). An attacker blasting out pharma spam is far more likely to get away with it than another bad actor compromising accounts and abusing their reputations.

Remember that it's not necessarily you system that was compromised; it could have been anybody you correspond with (how about that coworker?), probably somebody running Outlook on Windows. Another possibility is that your mailbox provider's servers were compromised.

Changing your passwords is a good safety measure, as is performing a more in-depth malware scan of your Windows system. I'm rusty at the Windows game, but maybe rebooting into Safe Mode and then performing your most in-depth scan will catch what evasive malware might otherwise be able to hide. It's still a crap-shoot, as I believe at least some of this sort of malware actually removes itself (or intentionally fails to survive a reboot) after it has exfiltrated your data.

Since this is work-related, you should absolutely mention this to your information security team (or whatever team serves that role), as it's probably wise to do a broad scan of the network, review the security of the servers in question, and A/V scan any system that has had access to the message(s) that were quoted in the spam.

Maybe you're ready for DMARC as well.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .