Advanced BEC Scam Campaign Targeting Executives on O365

MITRE Techniques

• [T1566] Spearphishing Link – The victim receives a well-crafted phishing email, appearing from DocuSign, with a legitimate docusign.net from address. “Victim receives a well-crafted phishing email, appearing from DocuSign, with a legitimate docusign.net from address. This was crafted specifically for an individual executive in the organization and is part of an existing phishing campaign targeting executives using Office 365.”
• [T1539] Steal Web Session Cookie – The adversary intercepts MFA and uses the stolen session cookie to assume the victim’s session. “The victim is prompted with a genuine MFA request on their MFA device. After approving the request, the Microsoft server returns a valid session cookie, which the adversary sniffs and can then use to assume the victim’s session.”
• [T1078] Valid Accounts – The compromise involved an executive’s account being used from unusual locations, indicating use of a compromised account. “The compromised account belonged to one of the executives of Foobar… identifying logins by that executive’s account from several suspicious IP addresses.”
• [T1556] Modify Authentication – The attacker uses a Microsoft 365 MFA design flaw to add a new Authenticator app for the compromised user, enabling persistent access. “Attacker uses a design flaw in M365 MFA to create a new Authenticator app for the compromised user… This circumvents various potential security controls… It also allows the attacker to transfer the credentials.”
• [T1083] File and Directory Discovery – The attacker identifies transaction-related correspondence and accesses files (contracts, financial details). “Attacker identifies correspondence related to an upcoming transaction and continues collecting information by accessing files related to said transaction(contracts, financial details, and so on).”