Huntress Disrupts Microsoft 365 BEC Attack Using Hidden Inbox Rules
Summary
Huntress says it detected and stopped a suspected BEC attack on a U.S. logistics company, where an intruder used Microsoft 365 inbox rules to hide vendor emails and redirect payment discussions.
Key points
- Huntress reported detecting a successful login to a compromised account from an IP address geolocated to Kaduna, Nigeria.
- The intruder created multiple inbox rules, including rules moving messages into Outlook’s rarely checked Conversation History folder and marking messages as read.
- Rules affected employees at four companies, with forwarding set up for vendor finance and operations staff; the suspected goal was to divert invoice payments.
- Huntress said rule names such as “jkhjg” and “m,bvc” may suggest manual creation, though this was presented as an indication, not a certainty.
- The article recommends scrutinizing rules that move mail to Conversation History, especially when paired with short, nonsensical names and mark-as-read actions.
- Huntress said its SOC detected and thwarted the attack; the article does not report that funds were successfully diverted.
Article Details
- Attack Vectors
- A compromised Microsoft 365 account was used to create inbox rules that moved vendor emails into the rarely viewed Conversation History folder and marked them as read.
- Forwarding rules were set up for vendor employees involved in finance and operations, with the suspected goal of intercepting payment information and diverting funds.
- Defensive Notes
- Closely scrutinize inbox rules that move emails to the Conversation History folder.
- Investigate inbox rules with short, nonsensical names, especially when they also mark messages as read.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 102[.]129[.]153[.]110 | IP address associated with the attacker session that created inbox rules for the compromised account. |
| IPV4 | 102[.]88[.]63[.]112 | IP address reported for the first successful login to the compromised account; Huntress associated it with the suspected attacker session. |
MITRE ATT&CK
T1078.004 · Cloud AccountsThe article identifies valid cloud accounts; the incident involved a successful login to a compromised Microsoft 365 account.T1114.003 · Email Forwarding RuleThe attacker created forwarding rules for vendor employees’ email, reportedly to intercept payment-related communications.
Vendors
Products
Microsoft 365 Apps for EnterpriseHomeBlogThwarting Financial Fraud: Shutting Down Hackers in Microsoft 365Microsoft TeamsThe Conversation History folder in Outlook is used by Microsoft Teams and does not normally contain emails. The reason this folder was likely chosen by the attacker is that users rarely browse this folder. MarkingOutlookThe Conversation History folder in Outlook is used by Microsoft Teams and does not normally contain emails. The reason this folder was likely chosen by the attacker is that users rarely browse this folder. Marking
Countries
ChinaMultiple inbox rules were created within the session, affecting email addresses from four different companies: the US logistics company, a clothing brand company, and logistics companies based in Switzerland and ChinaNigeriaThe first successful login to the compromised account was detected from an IP address 102.88.63[.]112 in Kaduna, NigeriaSwitzerlandMultiple inbox rules were created within the session, affecting email addresses from four different companies: the US logistics company, a clothing brand company, and logistics companies based in Switzerland and China
Industries
ClothingMultiple inbox rules were created within the session, affecting email addresses from four different companies: the US logistics company, a clothing brand company, and logistics companies based in Switzerland and Chinalogisticsnew MDR for Microsoft 365 solution, Huntress identified and thwarted a BEC attack against a US-based logistics company. The targeted company regularly liaises with various global vendors, one of which became the