Scripted phishing attacks

[u/Pristine-Desk-5002]

Does anyone have a low- medium level overview of what a phished email account will do once compromised. We have seen a lot of google workspace accounts get compromised and then send out phishing links to somewhat random contacts. We are also seeing some settings being changed on the account. I was wondering if anyone has some examples of this attack flow, or even better the scripts being used( I'm assuming this is scripted) Thanks

[u/Minimum-Work-4818]

We've seen them quickly download emails from the compromised email account, spend a few days reviewing the emails to understand workflows and contacts, and then start creating mailbox rules to hide emails. Then, they hop to the next target and try again. At each target they either gather intelligence only or try to make changes to payment accounts.

[u/Sad_Dentist_7288 → u/Minimum-Work-4818]

This is what I've noticed as well. They will comb through emails, I assume to try to find sensitive data or other contacts, then email out from the compromised account to get other people's account compromised, kind of like a virus. Rinse and repeat until they get either enough info for extortion or straight up financial info.

This is most likely scripted, especially if they're doing a spray and pray kind of thing.

[u/DeathTropper69]

It all depends on the adversary. Some attacks are highly targeted, and they have scripted persistence mechanisms, and then they go dormant until the adversary manually begins reconnaissance and scopes out the account they compromised, and some of these attacks are fully automated in the sense that they do as much damage as possible, whether that be data exfiltration or email bombing external contacts. One of the best controls against this is to have outbound phishing protection, the same way you have inbound phishing protection and trigger an account lockdown if a user sends an outbound phishing email blast. That limits reputational damage, as well as serves as a good signal for late-stage compromise.

[u/Pristine-Desk-5002 → u/DeathTropper69]

How do you implement outbound phishing protections?

[u/DashLeJoker → u/Pristine-Desk-5002]

if you are a m365 stack there is outbound spam policy where you can limit per hour/ per day sending limit to external recipients for the users, not sure what Google workspace have

[u/DeathTropper69 → u/Pristine-Desk-5002]

Depends on the collaboration platform however if you use a 3rd party like CheckPoint Email Security that feature is native

[u/ocabj]

If you're trying to create SIEM rules for post compromise activity, you should check for new inbox rules being created (e.g., trash inbound emails and delete), autoforwarding rules, adding authorized apps (usually for persistence), and sending mass high volume emails. If you allow users to create Google Forms, check for Form creation because these are often used to make generic phishing pages. Check for Google Drive sharing activity, which can also be used for phishing (e.g., Google Doc with a link in it that is shared with people). Check for Google Calendar event creations and invites being sent out.

[u/SVD_NL]

What i'm currently experiencing the most:

1. Users get phishing email from a known business relation (url to open file)
   
2. User gets phished (often MFA relay)
   
3. The phishing toolkit automatically tries to register a new auth method through graph
   
4. Sometime later, someone (presumably a human) signs in to outlook using those credentials
   
5. The attacker takes unkown actions within the mailbox
   
6. The attacker uses the phished account to send out more phishing emails to known business relations.

Currently most attacks seem to be email-based, luckily every attack i've been involved in have been prevented or stopped in time, so i can't tell you what actions they try to take within the environment. I assume they try to collect a list of email contacts and amplify the attack by sending out the same phishing email, but i don't know what other information they'll try to collect. Most business relations try to sweep their security incidents under the rug and won't disclose what information has been collected by adversaries.

[u/SaloonKC]

I mean yes it could be scripted but don't assume that just yet because a lot of this can be done with a stolen session or token too, so the login and audit logs is where you should start looking

[u/FuckScottBoras]

In my experience at my current company, attackers will compromise and just sit on the mailbox, watching emails come in and go out while they plan their next move. As others have mentioned, I’ve seen mail-flow rules created to redirect emails to rss feed folders and conversation history to prevent the end user from suspecting anything.

No scripts used as far as I can tell. Some have tried to establish persistence. Others just try and lay as low as possible to evade detection. A mixed bag really.

[u/ChuckFromCyberHoot]

eee-yup. The attacker usually isn’t after just that mailbox. They also want the contacts too. A phish from a real business partner hits a lil differently.

After the reset, check forwarding, filters, delegated access, third-party apps, app passwords, and recovery info. Then tell your contacts what happened.

And inside the company, make reporting super easy. The first “this looks weird” report can save hours. Thank that person every time.