Vishing Attack Compromises Hospitality Customer’s Network After Employee Approves MFA Prompt

Summary

A hospitality customer confirmed an attacker used caller-ID spoofing to trick a remote employee into approving MFA, then accessed the network through the VPN. Darktrace detected reconnaissance and attempted lateral movement and applied containment actions.

Key points

On August 12, 2024, an attacker spoofed the organization’s IT support number and persuaded a remote employee to approve an MFA prompt.
The attacker used the employee’s credentials and VPN access; a different hostname on the employee’s static IP helped identify the login as anomalous.
The attacker conducted LDAP and hostname reconnaissance, port scanning, and reverse DNS lookups.
Numerous failed NTLM authentication requests using a generic Windows credential suggested an attempt to brute-force access and move laterally.
Darktrace’s Cyber AI Analyst correlated the activity into an incident investigation.
Configured autonomous response actions blocked outgoing traffic and connections to ports 445 and 9401, and enforced the user’s normal pattern of activity.
The article says the attacker’s motivation was unknown and reports that the response prevented further activity; it does not report confirmed data theft or business disruption at this customer.

Article Details

Victim Organization: Not disclosed; a customer in the hospitality sector
Incident Type: Vishing-induced unauthorized network access, followed by reconnaissance and attempted lateral movement
Incident Date: 2024-08-12
Disclosure Date: 2024-10-03
Operational Impact: The threat actor gained network access and performed reconnaissance and failed NTLM authentication attempts. Darktrace applied mitigative actions that contained most activity and prevented further activity; no operational disruption or data loss was reported.
Ransom Or Extortion: None reported
Claim Status: confirmed