What is an Adversary-in-the-Middle Attack?

Threat actors are increasingly utilizing advanced phishing toolkits and techniques to carry out Adversary-in-the-Middle (AitM) attacks. These attacks involve the use of a proxy to a legitimate service, where the attacker’s webpage mimics the expected site. While the victim believes they are visiting the legitimate site, they are actually interacting with the attacker’s device, allowing the malicious actor to monitor all interactions and control the authenticated session, ultimately gaining access to the user’s account [1][2].

This blog will explore how Darktrace detected AitM techniques being leveraged in a Business Email Compromise (BEC) attack that used the widely used and trusted cloud storage service, Dropbox, for delivery. Dropbox’s popularity has made it a prime target for attackers to exploit in recent years. Threat actors can exploit the service for various malicious activities, including distributing malware and exposing sensitive information.

Attack Overview

In these types of AitM BEC attacks, recipients are often targeted with Dropbox-related emails, featuring subject headings like ‘FirstLast shared "Filename" with you,’ which suggest an individual is sharing an invoice-related attachment. These email subjects are common in such attacks, as threat actors attempt to encourage victims to access Dropbox links by masquerading them as legitimate files.

While higher priority users are, of course, targeted, the scope of these attacks remains broad. For instance, if a lower priority user is targeted by a phishing attack or their token is stolen, an attacker can still attempt BEC for further malicious intent and financial gain.

In October 2024, a Darktrace customer received a phishing email from a seemingly legitimate Dropbox address. This email originated from the IP, 54.240.39[.]219 and contained multiple link payloads to Dropbox-related hostnames were observed, inviting the user to access a file. Based on anomaly indicators and detection by Darktrace / EMAIL, Darktrace recognized that one of the payloads was attempting to abuse a legitimate cloud platform to share files or other unwanted material with the recipient.

Following the recipient’s engagement with this email, Darktrace / IDENTITY identified a series of suspicious activities within the customer’s environment.

AitM attacks allow threat actors to bypass multi-factor authentication (MFA). Initially, when a user is phished, the malicious infrastructure captures both the user’s credentials and the token. This includes replaying a token issued to user that has already completed the MFA requirement, allowing the threat actor to satisfy the validity of the requirement and gain access to sensitive organizational resources. Darktrace is able to analyze user activity and authentication patterns to determine whether MFA requirements were met. This capability helps verify and indicate token theft via AitM.

Darktrace observed the associated user account making requests over Microsoft 365 from the IP 41.90.175[.]46. Given the unusual nature and rare geolocation based in Kenya, Africa, this activity did not appear indicative of legitimate business operations.

‍

Further analysis using open-source intelligence (OSINT) revealed that the endpoint was likely associated with a call-back proxy network [3]. This suggested the presence of a network device capable of re-routing traffic and harvesting information.

Darktrace also detected that the same SaaS user was logging in from two different locations around the same time. One login was from a common, expected location, while the other was from an unusual location. Additionally, the user was observed registering security information using the Microsoft Authenticator app, indicating an attempt by an attacker to maintain access to the account by establishing a new method of MFA. This new MFA method could be used to bypass future MFA requirements, allowing the attacker to access sensitive material or carry out further malicious activities.

‍

Ultimately, this anomalous behavior was escalated to the Darktrace Security Operations Centre (SOC) via the Managed Detection & Response service for prompt triage and investigation by Darktrace’s SOC Analysts who notified the customer of strong evidence of compromise.

Fortunately, since this customer had Darktrace enabled in Autonomous Response mode, the compromised SaaS account had already been disabled, containing the attack. Darktrace’s SOC elected to extend this action to ensure the malicious activity remained halted until the customer could take further remedial action.

Conclusion

AitM attacks can play a crucial role in BEC campaigns. These attacks are often part of multi-staged operations, where an initial AitM attack is leveraged to launch a BEC by delivering a malicious URL through a trusted vendor or service. Attackers often attempt to lay low on their target network, sometimes persisting for extended periods, as they monitor user accounts or network segments to intercept sensitive communications.

In this instance, Darktrace successfully identified and acted against AitM techniques being leveraged in a BEC attack that used Dropbox for delivery. While Dropbox is widely used for legitimate purposes, its popularity has also made it a target for exploitation by threat actors, who have used it for a variety of malicious purposes, including delivering malware and revealing sensitive information.

Darktrace’s Security Operations Support service, combined with its Autonomous Response technology, provided timely and effective mitigation. Dedicated Security Operations Support analysts triaged the incident and implemented preventative measures, ensuring the customer was promptly notified. Meanwhile, Darktrace swiftly disabled the compromised SaaS account, allowing the customer to take further necessary actions, such as resetting the user’s password.

This case highlights the capabilities of Darktrace’s solutions, enabling the customer to resume normal business operations despite the malicious activity.

Credit to Justin Torres (Senior Cyber Analyst), Stefan Rowe (Technical Director, SOC) and Ryan Traill (Analyst Content Lead)

‍

Appendices

References

1.    https://www.proofpoint.com/us/threat-reference/man-in-the-middle-attack-mitm

2.    https://thehackernews.com/2024/08/how-to-stop-aitm-phishing-attack.html

3.    https://spur.us/context/41.90.175.46

Darktrace Model Detections

Darktrace / NETWORK Model Alert(s):

SaaS / Compromise::SaaS Anomaly Following Anomalous Login

SaaS / Unusual Activity::Multiple Unusual SaaS Activities

SaaS / Compromise::Unusual Login and Account Update

SaaS / Compromise::Login From Rare Endpoint While User Is Active

SaaS / Access::Unusual External Source for SaaS Credential Use

SaaS / Email Nexus::Unusual Login Location Following Link to File Storage

SaaS / Access::MailItemsAccessed from Rare Endpoint

Darktrace/Autonomous Response Model Alert(s):

Antigena / SaaS::Antigena Suspicious SaaS Activity Block

List of Indicators of Compromise (IoCs)

(IoC - Type - Description)

41.90.175[.]46 – Source IP Observed with Suspicious Login Behavior

MITRE ATT&CK Mapping

(Technique Name - Tactic - ID - Sub-Technique of)

Cloud Accounts - DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS - T1078.004 - T1078

Email Accounts - RESOURCE DEVELOPMENT - T1586.002 - T1586

Cloud Service Dashboard - DISCOVERY - T1538

Compromise Accounts - RESOURCE DEVELOPMENT - T1586

Steal Web Session Cookie - CREDENTIAL ACCESS - T1539

Darktrace has been recognized in the first ever Gartner Magic Quadrant for Email Security Platforms (ESP).  As a Challenger, we have been recognized based on our Ability to Execute and Completeness of Vision.

The Gartner Magic Quadrant for Email Security is designed to help organizations evaluate which email security solutions might be the best fit for their needs by providing a visual representation of the market vendors and the strengths and cautions of different vendors. We encourage our customers to read the full report to get the complete picture.

Darktrace / EMAIL has a unique AI approach to identifying threats, including NLP and behavioral analysis, instead of traditional security measures like signatures and sandboxing – providing protection against advanced attacks like Business Email Compromise (BEC) and spear phishing. We believe our AI-first approach delivers high-quality solutions that our customers trust, allowing them to stay ahead of sophisticated threats that other tools miss.  

We’re proud of Darktrace’s rapid growth, geographic scale, and ability to execute effectively in the email security market, which reflect our commitment to delivering high-quality, reliable solutions that meet the evolving needs of our customers.

What do we believe makes Darktrace the fastest growing email security solution on the market?

An AI-first approach to innovation: Catching the threats others miss

As one of the founders of the ICES category, Darktrace has a long history of innovation, backed by over 200 patents. While other email security solutions are only just starting to apply machine learning (ML) techniques to outdated methods like signature analysis, reputation lists, and sandboxing, Darktrace has redefined the approach to email threat detection with its pioneering AI-driven anomaly detection engine.

Traditional ESPs often miss advanced threats because they rely on rules and signatures that focus on payloads and blindly trust known sources. This approach requires constant updates and frequently fails to detect threats like Business Email Compromise and Spear Phishing. In contrast, Darktrace / EMAIL uses advanced anomaly detection to identify the most sophisticated threats by focusing on unusual patterns and behaviors. This innovative approach has consistently delivered superior detection, stopping on average 58% of the threats that other solutions in the security stack miss.¹

But our AI-first approach doesn’t stop at the inbox. At Darktrace, we transcend the limitations of traditional email security by leveraging a platform that unifies insights across multiple domains, providing robust protection against multi-domain threats. Our award-winning solutions defend the most popular attack vectors, including email, messaging, network, and identity protection. By combining signals from all domains, we establish unique behavioral profiles for each device and user, significantly enhancing detection precision.  

This pioneering approach has led to introducing industry-first advancements like QR code analysis and automated incident investigations, alongside game-changing functionality including:

• Microsoft Teams security with advanced messaging analysis: The ability to identify critical early phishing and insider threats across both email and Microsoft Teams messaging.  
• AI analyst narratives for improved end user reporting: that reduces phishing investigations by 60% by exposing unique narratives that provide the context of each received email and give feedback to each employee as they interact with their mail.²
• Mailbox Security Assistant: to perform advanced behavioral browser analysis and stop malicious links within webpages, detecting and remediating 70% more malicious phishing links than traditional tools.³  
• AI based, autonomous data loss prevention: to immediately secure your organization from misdirected emails, insider threats, and data loss—both classified and unclassified- without any administrative overhead.

Customer trust that fuels exponential growth

With almost 5,000 customers in under 5 years, we've doubled the growth rate of other vendors in the email security market. Our rapid market penetration, fueled by customer satisfaction and pioneering technology, showcases our revolutionary approach and sets new industry standards. 

Darktrace’s exceptional customer retention is fueled by an unparalleled customer experience, extensive regional support, dedicated account teams, and cutting-edge scalable technology. We pride ourselves on having a global network with local expertise, consisting of 110 worldwide offices which provide local language and technical support to offer multilingual, in-house assistance to our customer base.

Check it out – Darktrace / EMAIL has the highest percentage of 5-star ratings with a 4.8 rating on Gartner® Peer Insights™.⁴

Supporting every stage of your email security journey

Darktrace / EMAIL supports your security maturity journey, from first time security buyers to mature security stacks looking to augment their existing ESPs – by handling advanced threats without extensive tuning. And unlike other solutions that create a siloed and parallel solution, it works harmoniously with native email providers to create a modern email security stack. That’s why Darktrace performs well with first-time email security buyers and has strong renewal rates.

Integrating with Microsoft and Google via API, we replace traditional Secure Email Gateways (SEGs) with a modern, comprehensive email security stack. By combining approaches, our solution merges attack-centric analysis, which learns attack patterns and threat intelligence, with a business-centric approach that understands user behavior and inbox activity to deliver a unified stack that defends the entire threat spectrum – leading Darktrace to be recognized as Microsoft Partner of the year UK 2024.  

Our user-friendly, self-learning AI solution requires minimal tuning and deployment, making it perfect for customers looking for a highly usable but lightly configurable solution that will accompany them throughout their lifetime as they mature their email security stack in line with the evolving threat landscape.

Learn more

Get complimentary access to the full Gartner® Magic Quadrant™ for Email Security Platforms here.

To learn more about Darktrace / EMAIL or to get a free demo, check out the product hub.

References

¹ From September 1 – December 31 2023, 58% of the phishing emails analyzed by Darktrace / EMAIL had already passed through native spam filtering and email security controls. (Darktrace End of Year Threat Report 2023)

² When customers deployed the Darktrace / EMAIL Outlook Add-in there was a 60% decrease in incorrectly reported phishing emails. Darktrace Internal Research, 2024

³ Once a user reports phishing that contains a link, an automated second level triage engages our link analysis infrastructure expanding the signals analyzed. Darktrace Internal Research, 2024

⁴ Based on 252 reviews as of 19th December 2024