Amidst recent rises in business email compromise (BEC) campaigns, the Todyl Threat Research team has uncovered a similar emerging threat: email account compromise, or EAC.
EAC is a specific subset of BEC, relying on full account takeover (ATO) as a means for attacking an organization from within. In an EAC scenario, an attacker first gain access to an individual’s email account through:
Once inside, the real attack begins, shifting into BEC. The bad actor uses emails, calendar invites and meetings, company directories, and shared files to study the victim and develop an understanding of who they are and how they operate. Attackers will even build forwarding rules to ensure a constant flow of information, tweaking account permissions to avoid detection and maintain access.
Once they understand their victim, the attacker assumes their identity. They will mimic the user’s behavior, sending emails and responses in a timely manner, making them almost indistinguishable from the victim. This differs from other BEC approaches that use spoofing and other detection tactics to trick people into thinking something is legitimate. Instead, the attacks come directly from a legitimate account, controlled by a bad actor like a puppet.
Artificial intelligence is already being used to create convincing wording for phishing and other BEC campaigns, but it takes an even more sinister turn in the case of EAC. Specifically, AI deepfakes and voice cloning now give attackers even more ways to fully impersonate EAC victims. The result is even more convincing mimicry, making it difficult for blue teams to discern that an account is compromised.
While defending our partners, the Todyl Threat Research team noticed a few key commonalities across EAC cases like this one.
As discussed earlier, inbox forwarding rules are often used in EAC attacks to obscure an attacker’s activity. Specifically, our teno thankam found that a bad actor will use these rules to hide emails they have sent as the victim. For example, an attacker will move a sent email to lesser used folders such as the RSS or Conversation History folders. That way, they can use these emails for other BEC attacks without losing record of conversations for maintaining their victim profile.
Attackers will determine where to route these emails based on the information gathered in their initial reconnaissance. One scenario would be a user who rarely if ever checks their Spam or Junk folders. The attacker’s emails can be stored there, hiding in plain sight, and then automatically deleted after 30 days, leaving no trace.
Although not definitive, our team noticed that these rules will usually be named with 1-3 characters, such as:
According to our team’s findings, more active/enterprising attackers will take a step further. Instead of rerouting sent emails to an unused folder, they will actively delete the email from Sent, and then quickly remove it from the Deleted Items folder as well. This removes any apparent evidence of their activity, leaving the victim none the wiser.
Here is an example case:
Because attackers go to great lengths to hide their activities, detecting and stopping EAC can be difficult. Amongst the cases we’ve seen so far, here are a few prevailing trends to look for within your SIEM:
You can also search for abnormal forwarding rules, especially ones with naming conventions like those detailed above. Other potential signs of this type of account compromise include:
Thanks to the efforts of our Threat Research team, the Todyl Platform is already tuned to detect these indicators of compromise to help you root out and stop potential EAC threats. With Microsoft Entra ID and Google Workspace integrations, Todyl helps you uncover and address email-based threats quickly to prevent EAC from happening within your environments.
To learn more, contact us to see how you can get started proactively defending yourself and your clients from these threats. You can read what other new and emerging threats our team are tracking—and how to stop them—on our threat intelligence feed.
Keira Stevens is a Senior Security Research Engineer at Todyl, where she spends most of her time writing and tuning detection rules, and researching threats seen at Todyl. She has almost two decades of experience in the security field that includes giving talks at conferences, writing papers and publishing blogs. Keira as helped stop APT actors attacking companies, working with LE on criminal group takedowns, and mentor new people coming into the security field. When not at work Keira likes to spend time with her family and smashing buttons in online video games.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。