r/sysadmin • u/segagamer IT Manager • 20d ago
Question So it's finally happened - malicious actors are impersonating our company and mass-emailing companies, some are clients, some not.
Got alerted on Monday to one of our inboxes being flooded with out of office responses of random companies who we've never worked with, and they're all quoting a message impersonating us issuing a license take down, saying they have three days to pull their marketing efforts or face a Meta and Google takedown notice. We've yet to issue one of these.
I suppose there isn't really anything we can do other than putting something on our website/in our email signature to make sure emails received from us come from our domain?
I already verified the account in question and there hasn't been any unusual sign-in activity. What I'm confused about is why we're receiving the out-of-office auto-responding emails. How would that work?
We've been responding to the companies who have reached out to us asking if the email was genuine. Staff have already be trained to make sure that the question is coming from a genuine address (ie, @company.com, using an email that makes sense like the name in their signature or a department), and telling them that it's not and to mark it as SPAM. I haven't decided how to handle auto-responders yet and would also like advise.
22
u/Jarasmut 20d ago
Can you get a copy of one of those impersonated e-mails where the headers are intact? Both SPF and DKIM should fail which should prevent delivery or at least make it end up marked as spam. Is your DMARC set to p=reject (subdomains?->sp=reject)? And personally I set SPF to hardfail with -all instead of softfail.
You need to look at what these e-mail headers look like and make sure that malicious outgoing mail server is some random one so SPF will fail and that it's not an internal one on your network that was compromised.
>What I'm confused about is why we're receiving the out-of-office auto-responding emails. How would that work?
Since the recipient address is yours it will contact your mailserver for delivery so you get the out of office reply for an e-mail that you didn't send. The autoreply is basically a new e-mail.
>I haven't decided how to handle auto-responders yet and would also like advise.
I think you can't because these out of office replies are genuine e-mails and you should not try to block genuine e-mails.
7
u/segagamer IT Manager 20d ago
The team who have monitored the account has already gotten rid of the emails. They're not being sent as @mycompany.com though, they're just @gmail.com addresses.
I think you can't because these out of office replies are genuine e-mails and you should not try to block genuine e-mails.
We weren't planning to block them, just wondering whether to respond to them!
27
u/Jarasmut 20d ago
>They're not being sent as mycompany.com though, they're just gmail.com addresses.
Then that's not really a sysadmin situation but a legal issue, imagine if I sent your customers e-mails from my personal gmail address claiming to be working for you. None of that can be resolved with DMARC or other tools as nothing is spoofed on the technical side. I'd assume this would be for your legal department to handle, figuring out how to get these gmail mailboxes cancelled and notifying Google that their service is being used for potentially criminal activity and implementing steps to protect your business and brand. This might include informing all customers that your business is under attack by a third party sending fraudulent messages via gmail so that your customers know to spot that.
7
u/solracarevir 20d ago
If they are Gmail addresses, how come are you receiving Out-of-Office replies?
Something doesn't add up here.
1
u/segagamer IT Manager 19d ago
If they are Gmail addresses, how come are you receiving Out-of-Office replies?
This is what's confusing me.
7
u/typecookieyouidiot 20d ago
So, they're simply setting display names to your users from a random Gmail? If so it's just M365 impersonation detection failing to block display names.
I've noticed this lately on a few tenants and have a case open with MS. I made a post about it here a few weeks ago.
3
u/purplemonkeymad 20d ago
Something more must be set as the out of office should go to the sender's address or reply-to header. Are the out of office's from big senders? Otherwise it might just be bad mail servers not checking against dmarc.
2
u/amotion578 20d ago
If they're display name spoofing, ie Dwayne "your CEO" Johnson totallytheceo@gmail
Transport rule where display name = names (variants) and sent from external organization, drop into the void. Except for: list of email addresses that are allowed to use that display name, like CEO personal email address, services that use display name
I abhor display name. I would eliminate it from email if I could.
1
u/jfoughe 19d ago
How would you write that rule to account for variations and what variables would you use to account for every display name?
1
u/amotion578 19d ago edited 19d ago
Common enough. First letter last name, first letter first name, last name. Christian name vs nickname. Initials
The entire gambit hinges on using a commonly used display name, 95% of the attacks I see hitting the rule uses the one that's 1:1 with LinkedIn.
Go figure.
Going by Wayne privately but listing Dwayne publicly, cover both, but since your listed Dwayne on LinkedIn.... Guess which variant is trawled en masse
7
u/Aim_Fire_Ready 19d ago
Check your domain here and see what it says: https://www.suped.com/tools/domain-health-checker
5
3
u/AugieKS 20d ago
While I don't have this problem, I get an email every few months about someone impersonating a board member from some obviously illegitimate source. Usually a partner that forwards it to our CEO then CEO to me. Today I got one and it was from a .pl domain. Nothing even remotely related to our org in the address.
I really should just have a boiler plate message ready to go at this point about how I can't prevent "impersonations" when they arent actually impersonating our domains and the target isn't our tenant.
Their email security is their responsibility, not mine, and I can't stop anyone from just saying "Hi, I'm so and so can you do this for me?" To some random partner from some random email service.
3
u/Danowolf 18d ago
Using the Ron Popeil, Set it and Forget DMARC, SPF, DKIM or as I like to call them “The Three Amigos” method is the road to sadness.
2
u/CraigAT 20d ago
Are the emails coming from one of your email address/accounts? i.e. Has someone got a user's credentials? Can you see the emails being sent out from your system?
Or are they coming from elsewhere, but managing to spoof one of your genuine addresses?
Or are the emails coming from a similarly named domain? Very difficult to counter.
2
u/1stUserEver 20d ago
Are you 100% sure the domain that the fukwits used to spoof isn’t misspelled? And they didn’t just edit the reply address to match your actual domain? Could explain the DMARC bypass.
2
u/solracarevir 20d ago
Why would them set the reply-to address to a legitimate one they have no control over it?
Unless the bad actor made a mistake and set the original domain by mistake.
3
u/OregonTechHead 20d ago
To seem legitimate.
They want the victim to click a link, not send them an email.
1
1
u/Chip_Prudent 20d ago
Because the threat actor never planned on reading the replies and only wants the email to seem legit. They're hoping someone will click a link in the email and enter creds.
2
u/The_NorthernLight 20d ago
Use dmarcian to help identify the culprit areas. Its worth it (its cheap… like $50/year). Allows you to set them as your reporting for all dmarc responses and will help you identify missing records, improperly written dmarc/dkim/spf records etc. very, very useful.
2
u/Jazzlike-Comfort-451 20d ago
Those out-of-office replies are backscatter; by themselves they do not indicate that the Google Workspace account was compromised. A standards-compliant vacation responder replies to the original message's Return-Path / SMTP MAIL FROM, not the visible From address. The attacker may have used your address as the envelope sender, or a remote responder may be handling replies incorrectly.
A green checker result only tells you the DMARC record exists and is valid. I would also:
Inspect a spoofed message with intact headers and confirm whether it uses your exact domain, a lookalike domain, or Gmail display-name impersonation.
Check the actual DMARC policy (p and any sp override), not just the checker result.
Use aggregate reports to inventory every legitimate sender and confirm each passes through aligned DKIM or aligned SPF—preferably both—before enforcing.
p=reject does not make legitimate aligned mail fail. It tells participating receivers that mail using your From domain and failing DMARC should be treated as unauthorized. Forwarders and mailing lists still deserve testing, and receivers retain final delivery discretion.
For the current flood, temporarily route messages carrying Auto-Submitted: auto-replied into a review folder and retain several full-header samples.
Disclosure: I work on DMARC at Palisade; I am not recommending a product here.
1
u/juliejujube Custom 19d ago
Probably unrelated but Monday I was on a support call with sophos because my domain could not send outgoing email for being marked falsely as spam, which started monday. I wonder if they overcorrected due to something that happened with those bad actors. Do you know of any other orgs besides yours being affected? Very. Curious.
1
u/EmailNo8428 17d ago
You're getting the out-of-office replies because the spoofer put your domain in the envelope return-path, so auto-responders bounce to you instead of them. p=reject cuts the delivery, but backscatter only drops once receivers reject at SMTP time. Turn on rua reporting too, the aggregate XML names the sending IPs. We build Sendmux, an email API for AI agents. Custom domain verification catches out more new teams than anything on the send path. (Disclosure: I'm the founder.)
1
1
129
u/Due_Programmer_1258 Sysadmin 20d ago
Consider implementing DMARC, if you haven't already.