Sygnia’s incident response exposed a global BEC operation that used Adversary In The Middle (AiTM) to bypass Office365 authentication and persist on compromised accounts, enabling data exfiltration and mass phishing across dozens of organizations. The firm developed a CTI enrichment toolkit to help security teams analyze suspicious IOCs encountered during daily monitoring and detection. Hashtags: #AiTM #AdversaryInTheMiddle #FormBook #lenstax #patrickaweller #compositseone #id82882 #StewJeanne #63_250_35_33
Keypoints
- A BEC attack leveraged an AiTM technique to bypass Office365 authentication and gain persistence in a victim’s account.
- The attacker exfiltrated data and used the access to propagate phishing to other employees and targeted organizations.
-
MITRE Techniques
- [T1566.002] Spearphishing Link – A phishing email leading to a fraudulent Office365 authentication page and an AiTM flow that steals credentials. Quote: ‘A phishing email was sent to one of the client’s employees, originating from a legitimate mailbox of an external company, assumed to be previously compromised.’
- [T1134] Access Token – AiTM forwarded authentication and MFA challenges to Microsoft while stealing the session token to enable access. Quote: ‘…forwarding the client authentication and MFA challenge to a legitimate Microsoft authentication service while stealing the acquired session token as well as the credentials to enable access to the account.’
- [T1078] Valid Accounts – Use of stolen tokens and manipulation to persist in the compromised Azure account. Quote: ‘logged into the victim’s account using the stolen token and added a new MFA device to gain persistent access.’
- [T1566.003] Spearphishing via Service – The attacker used the compromised account to send additional phishing emails to dozens of recipients. Quote: ‘the threat actor used this access to send new phishing emails containing the new malicious link to dozens of the client’s employees as well as to additional targeted organizations.’
- [T1036] Masquerading – Anti-forensic/anti-analysis steps, including a Cloudflare-driven “I’m not a robot” wall to hinder scraping and analysis. Quote: ‘an anti-forensic method which prevents tools such as urlscan.io, VirusTotal and other similar engines from scraping the site…’
- [T1583.001] Domain Registration – Infrastructure built around registrant data and domain registrations (e.g., Stew Jeanne) used for phishing hosting. Quote: ‘Current WHOIS record shows it was updated… and registered under NAMECHEAP INC with privacy restrictions’
Indicators of Compromise
- [Domain] – lenstax[.]com (phishing landing page domain), patrickaweller[.]com (new phishing landing page), id-82882[.]com (infrastructure domain), compositseone[.]com (fraudulent authentication site), id840902[.]com (Cloudflare-related anti-forensics domain)
- [IP] – 179.61.228[.]187 (login source, Australia, PIA VPN), 63.250.35[.]33 (malicious IP with broad domain resolution)
- [Domain] – 63.250.35[.]33 family of connections and associated domains (risk indicators from OSINT)
- [URL/Website] – Cloudflare-based anti-automation links (I’m not a robot) and fraudulent Microsoft auth page
- [File/Hash] – 100+ malicious files observed communicating with the malicious IPs (exact hashes not listed) and 2 more hashes
Read more: https://blog.sygnia.co/cracking-global-phishing-campaign-using-threat-intelligence-toolkit