SANS Data Incident 2020 – Indicators of Compromise

On Tuesday, August 11, 2020, SANS disclosed a security breach which was the result of a successful phishing campaign. As described in the disclosure found at https://www.sans.org/dataincident2020, the phishing email enticed a single user to install a malicious Office 365 add-in for their account. The O365 add-in caused a forwarding rule to be configured on the victim’s account, which resulted in 513 emails being forwarded to an unknown external email address. In this article, we are publishing specific details and indicators of compromise associated with this attack in the hope that it will help the community detect and respond to any similar attacks.

WARNING: The following information contains links that can be used as Indicators of Compromise for scanning for similar attacks in your own organizations. Do not copy/paste the link into your browser and remove the brackets as that would enable the link. These links might become active again if the attacker realizes individuals are opening their browsers to these sites.

On July 24, 2020, several employees from various parts of the business received an email with the subject:

File “Copy of sans July Bonus 24JUL2020.xls” has been shared with <recipient>

The sender name appeared to come from an Office 365 asset with the name:

no-reply@sharepointonline.com

Here is a screenshot of the redacted phishing email:

The recipient is enticed to click the “Open” button, which initiates the installation of a malicious Office 365 app. Once installed, the app configures an email forwarding rule with numerous keywords associated with financial data. The following are additional IOCs associated with this compromise:

• Link from phishing email that recipients were enticed to click:
  

  https: // officei6zq49rv2p5a4xbq8ge41f1enjjczo[.]s3[.]us-east-2[.]amazonaws [.]com / index[.]html

• Phishing email header's "Return-Path":
  

  root[@]hwsrv-750360[.]hostwindsdns[.]com

• Name of the malicious O365 add-in:
  

  Enable4Excel

  (note that this is very similar to a legitimate Salesforce add-in named Enabler4Excel)
  
• Link contained in the malicious O365 add-in:
  

  https: // iwljzmwhres67fh[.]com / office

• Keywords to invoke forwarding rule:
  

  agreement
  Bank
  bic
  capital call
  cash
  Contribution
  dividend
  fund
  iban
  Payment
  purchase
  shares
  swift
  transfer
  Wire
  wiring info

• External forwarding address:
  

  daemon [@] daemongr5yenh53ci0w6cjbbh1gy1l61fxpd.com

• Forwarding rule name:
  

  Anti Spam Rule