When the attacker uses the trust built in conversations.
In Business Email Compromise the attacker can observe exchanges with customers and suppliers, create hidden rules, impersonate an interlocutor and modify payment instructions. Containment must protect the account without losing traces useful for reconstructing the fraud.
Main checks
- anomalous accesses, sessions, IP addresses and geolocations;
- created mail rules, forwarding, delegations and filters;
- OAuth applications and suspicious consents;
- deleted messages, changes to conversations and imitative domains;
- related accounts and possible movements to other mailboxes;
- timeline of fraud-related communications.
Containment
Actions may include session revocation, credential rotation, removal of rules and applications, hardening MFA and conditional access, blocking domains, and auditing the most exposed mailboxes. Financial procedures are being revised to introduce independent confirmations from the compromised channel.
Deliveries
The client receives a timeline, available indicators, list of performed activities and recommendations. When required, evidence can be organized to support legal advisors, insurers or competent authorities, in compliance with the assignment received.