Blog
/

Inside the SOC

/
July 11, 2023

Detecting and Responding to Vendor Email Compromises (VEC)

Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
11
Jul 2023
Learn how Darktrace detected and responded to a March 2023 Vendor Email Compromise (VEC) attacks on customer in the energy industry. Read more here!

Threat Trends: Email Landscape

As organizations and security teams around the world continue to improve their cyber hygiene and strengthen the defenses of their digital environments, threat actors are being forced to adapt and employ more advanced, sophisticated attack methods to achieve their goals.

Vendor Email Compromise (VEC) is one such elaborate and sophisticated type of Business Email Compromise (BEC) attack which exploits pre-existing trusted business relationships to impersonate vendors, with the goal of launching a targeted attack on the vendor’s customers [1].  

In March 2023, Darktrace/Email™ detected an example of a VEC attack on the network of a customer in the energy sector. Darktrace’s Self-Learning AI worked to successfully neutralize the VEC attack before it was able to take hold, by blocking the malicious emails so that they did not reach the inboxes of the intended recipients.

Business Email Compromise (BEC)

BEC is the practice of using deceitful emails to trick an organization into transferring funds or divulging sensitive information to a malicious actor. BEC attacks can have devastating financial consequences for organizations, with the FBI reporting a total of USD 2.7 billion in losses from BEC attacks in 2022 [2].  Along with ransomware attacks, BEC attacks are one of the greatest cyber threats facing organizations.

Vendor Email Compromise (VEC)

VEC represents a “new milestone in the evolution of BEC attacks” having taken BEC attacks “to a whole new level of sophistication” [3]. Traditional BEC attacks involve the impersonation of an upper or middle-management employee by a cybercriminal, who attempts to trick a senior executive or employee with access to the company’s finances into transferring funds [4]. Thus, they are crafted to target a specific individual within an organization.

On the other hand, VEC attack campaigns take this attack style even further as they tend to require a greater understanding of existing vendor-customer business relationships. A cyber-criminal gains access to a legitimate vendor account, the process of which may take months to design and fully implement, and uses the account to spread malicious emails to the vendor’s customers. VEC attacks are complex and difficult to detect, however they share some common features [1,3]:

1. Reconnaissance on the vendor and their customer base – the threat actor conducts in-depth research in an attempt to be as convincing as possible in their impersonation efforts. This process may take weeks or months to complete.

2. Credential stealing through phishing campaigns – the threat actor tricks the vendor’s employees into revealing confidential data or corporate credentials in order to gain access to one of the email accounts belonging to the vendor.

3. Account takeover - once the attacker has gained access to one of the vendor’s email accounts, they will create mailbox rules which forward emails meeting certain conditions (such as having ‘Invoice’ in their subject line) to the threat actor’s inbox. This is typically a lengthy process and requires the malicious actors to harvest as much sensitive information as they need in order to successfully masquerade as vendor employees.

4. Deceitful emails are sent to the vendor’s customers – the attacker crafts and sends a highly sophisticated and difficult to detect email campaign to targeted individuals amongst the vendor’s customers. These emails, which may be embedded into existing email threads, will typically contain instructions on how to wire money to the bank account of an attacker.

There have been many high-profile cases of BEC attacks over the years, one of the most famous being the vendor-impersonating BEC attacks carried out between 2013 and 2015 [5]. This BEC campaign resulted in victim companies transferring a total of USD 120 million to bank accounts under the attacker’s control. As the threat of BEC, and in particular VEC, attacks continue to rise, so too does the importance of being able to detect and respond to them.

Observed VEC Attack  

In March 2023, Darktrace/Email observed a VEC attack on an energy company. Email communication between this customer and one of their third-party vendors was common and took place as part of expected business activity, earning previous emails tags such as “Known Domain Relationship”, “Known Correspondent”, and “Established Domain Relationship”. These tags identify the sender relationship as trusted, causing Darktrace’s AI to typically attribute an anomaly score of 0% to emails from this third-party sender.

Just fifty minutes after the above legitimate email was observed, a group of suspicious emails were sent from the same domain, indicating that the trusted third-party had been compromised. Darktrace’s AI picked up on the peculiarity of these emails straight away, detecting elements of the mails which were out of character compared to the sender’s usual pattern of life, and as a result attributing these emails a 100% anomaly score despite the trusted relationship between the customer and sender domain. These suspicious emails were part of a targeted phishing attack, sent to high value individuals such as the company’s CTO and various company directors.  

Figure 1: Darktrace/Email's interface highlighting tags indicating the trusted relationship between the third-party domain and the customer.

Using methods outside of Darktrace’s visibility, a malicious actor managed to hijack the corporate account of a senior employee of this vendor company. The actor abused this email account to send deceitful emails to multiple employees at the energy company, including senior executives.

Figure 2: This screenshot shows Darktrace/Email’s assessment of emails from the vendor account pre-compromise and post-compromise.

Each of the emails sent by the attacker contained a link to a malicious file hosted inside a SharePoint repository associated with a university that had no association with the energy company. The malicious actor therefore appears to have leveraged a previously hijacked SharePoint repository to host their payload.

Cyber-criminals frequently use legitimate file storage domains to host malicious payloads as traditional gateways often fail to defend against them using reputation checks. The SharePoint file which the attacker sought to distribute to employees of the energy company likely provided wire transfer or bank account update instructions. If the attacker had succeeded in delivering these emails to these employees’ mailboxes, then the employees may have been tricked into performing actions resulting in the transfer of funds to a malicious actor. However, the attacker’s attempts to deliver these emails were thwarted by Darktrace/Email.

Darktrace Coverage

Despite the malicious actor sending their deceitful emails from a trusted vendor account, a range of anomalies were detected by Darktrace’s AI, causing the malicious emails to be given a 100% anomaly score and thus held from their recipients’ mailboxes. Such abnormalities, which represented a deviation in normal behavior, included:

  • The presence of an unexpected, out of character file storage link (known to be used for hosting malicious content)
  • The geographical source of the email
  • The anomalous linguistic structure and content of the email body, which earned the emails a high inducement score
Figure 3: Darktrace/Email’s overview of one of the malicious VEC emails it observed.

Darktrace has a series of models designed to trigger when anomalous features, such as those described above, are detected. The emails which made up this particular VEC attack breached a number of notable Darktrace/Email models. The presence of the suspicious link in the emails caused multiple link-related models to breach, which in turn elicited Darktrace RESPOND™ to perform its ‘double lock link’ action – an action which ensures that a user who has clicked on it cannot follow it to its original source. Models which breached due to the suspicious SharePoint link include:

Link / Link To File Storage

  • Link / Low Link Association
  • Link / New Unknown Link
  • Link / Outlook Hijack
  • Link / Relative Sender Anomaly + New Unknown Link
  • Link / Unknown Storage Service
  • Link / Visually Prominent Link Unexpected for Sender
  • Unusual / Unusual Login Location + Unknown Link

The out-of-character and suspicious linguistic aspects of the emails caused the following Darktrace/Email models to breach:

  • High Anomaly Sender
  • Proximity / Phishing
  • Proximity / Phishing and New Activity
  • Unusual / Inducement Shift High
  • Unusual / Undisclosed Recipients
  • Unusual / Unusual Login Location
  • Unusual / Off Topic

Due to the combination of suspicious features that were detected, tags such as ‘Phishing Link’ and ‘Out of Character’ were also added to these emails by Darktrace/Email. Darktrace’s coverage of these emails’ anomalous features ultimately led Darktrace RESPOND to perform its most severe inhibitive action, ‘hold message’. Applying this action stopped the emails from entering their recipients’ mailboxes. By detecting deviations from the sender’s normal email behavior, Darktrace/Email was able to completely neutralize the emails, and prevent them from potentially leading to significant financial harm.

Conclusion

Despite bypassing the customer’s other security measures, Darktrace/Email successfully identified and held these malicious emails, blocking them from reaching the inboxes of the intended recipients and thus preventing a successful targeted VEC attack. The elaborate and sophisticated nature of VEC attacks makes them particularly perilous to customers, and they can be hard to detect due to their exploitation of trusted relationships, and in this case, their use of legitimate services to host malicious files.

Darktrace’s anomaly-based approach to threat detection means it is uniquely placed to identify deviations in common email behavior, while its autonomous response capabilities allow it to take preventative action against emerging threats without latency.

Credits to: Sam Lister, Senior Analyst, for his contributions to this blog.

Appendices

MITRE ATT&CK Mapping

Tactic - Techniques

Resource Development

  • T1586.002 – Compromise Accounts: Email Accounts
  • T1584.006 – Compromise Infrastructure: Web Services
  • T1608.005 – Stage Capabilities: Link Target

Initial Access

  • T1195 – Supply Chain Compromise
  • T1566.002 – Phishing : Spearphishing Link

References

[1] https://www.cloudflare.com/en-gb/learning/email-security/what-is-vendor-email-compromise/

[2] https://www.ic3.gov/Media/PDF/AnnualReport/2022_IC3Report.pdf

[3] https://heimdalsecurity.com/blog/vendor-email-compromise-vec/

[4] https://www.ncsc.gov.uk/files/Business-email-compromise-infographic.pdf  

[5] https://www.justice.gov/usao-sdny/pr/lithuanian-man-sentenced-5-years-prison-theft-over-120-million-fraudulent-business

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Author
Tiana Kelly
Deputy Team Lead, London & Cyber Analyst
Book a 1-1 meeting with one of our experts
Share this article

More in this series

No items found.

Blog

/

October 4, 2024

/

Inside the SOC

From Call to Compromise: Darktrace’s Response to a Vishing-Induced Network Attack

Default blog imageDefault blog image

What is vishing?

Vishing, or voice phishing, is a type of cyber-attack that utilizes telephone devices to deceive targets. Threat actors typically use social engineering tactics to convince targets that they can be trusted, for example, by masquerading as a family member, their bank, or trusted a government entity. One method frequently used by vishing actors is to intimidate their targets, convincing them that they may face monetary fines or jail time if they do not provide sensitive information.

What makes vishing attacks dangerous to organizations?

Vishing attacks utilize social engineering tactics that exploit human psychology and emotion. Threat actors often impersonate trusted entities and can make it appear as though a call is coming from a reputable or known source.  These actors often target organizations, specifically their employees, and pressure them to obtain sensitive corporate data, such as privileged credentials, by creating a sense of urgency, intimidation or fear. Corporate credentials can then be used to gain unauthorized access to an organization’s network, often bypassing traditional security measures and human security teams.

Darktrace’s coverage of vishing attack

On August 12, 2024, Darktrace / NETWORK identified malicious activity on the network of a customer in the hospitality sector. The customer later confirmed that a threat actor had gained unauthorized access through a vishing attack. The attacker successfully spoofed the IT support phone number and called a remote employee, eventually leading to the compromise.

Figure 1: Timeline of events in the kill chain of this attack.

Establishing a Foothold

During the call, the remote employee was requested to authenticate via multi-factor authentication (MFA). Believing the caller to be a member of their internal IT support, using the legitimate caller ID, the remote user followed the instructions and confirmed the MFA prompt, providing access to the customer’s network.

This authentication allowed the threat actor to login into the customer’s environment by proxying through their Virtual Private Network (VPN) and gain a foothold in the network. As remote users are assigned the same static IP address when connecting to the corporate environment, the malicious actor appeared on the network using the correct username and IP address. While this stealthy activity might have evaded traditional security tools and human security teams, Darktrace’s anomaly-based threat detection identified an unusual login from a different hostname by analyzing NTLM requests from the static IP address, which it determined to be anomalous.

Observed Activity

  • On 2024-08-12 the static IP was observed using a credential belonging to the remote user to initiate an SMB session with an internal domain controller, where the authentication method NTLM was used
  • A different hostname from the usual hostname associated with this remote user was identified in the NTLM authentication request sent from a device with the static IP address to the domain controller
  • This device does not appear to have been seen on the network prior to this event.

Darktrace, therefore, recognized that this login was likely made by a malicious actor.

Internal Reconnaissance

Darktrace subsequently observed the malicious actor performing a series of reconnaissance activities, including LDAP reconnaissance, device hostname reconnaissance, and port scanning:

  • The affected device made a 53-second-long LDAP connection to another internal domain controller. During this connection, the device obtained data about internal Active Directory (AD) accounts, including the AD account of the remote user
  • The device made HTTP GET requests (e.g., HTTP GET requests with the Target URI ‘/nice ports,/Trinity.txt.bak’), indicative of Nmap usage
  • The device started making reverse DNS lookups for internal IP addresses.
Figure 2: Model alert showing the IP address from which the malicious actor connected and performed network scanning activities via port 9401.
Figure 3: Model Alert Event Log showing the affected device connecting to multiple internal locations via port 9401.

Lateral Movement

The threat actor was also seen making numerous failed NTLM authentication requests using a generic default Windows credential, indicating an attempt to brute force and laterally move through the network. During this activity, Darktrace identified that the device was using a different hostname than the one typically used by the remote employee.

Cyber AI Analyst

In addition to the detection by Darktrace / NETWORK, Darktrace’s Cyber AI Analyst launched an autonomous investigation into the ongoing activity. The investigation was able to correlate the seemingly separate events together into a broader incident, continuously adding new suspicious linked activities as they occurred.

Figure 4: Cyber AI Analyst investigation showing the activity timeline, and the activities associated with the incident.

Upon completing the investigation, Cyber AI Analyst provided the customer with a comprehensive summary of the various attack phases detected by Darktrace and the associated incidents. This clear presentation enabled the customer to gain full visibility into the compromise and understand the activities that constituted the attack.

Figure 5: Cyber AI Analyst displaying the observed attack phases and associated model alerts.

Darktrace Autonomous Response

Despite the sophisticated techniques and social engineering tactics used by the attacker to bypass the customer’s human security team and existing security stack, Darktrace’s AI-driven approach prevented the malicious actor from continuing their activities and causing more harm.

Darktrace’s Autonomous Response technology is able to enforce a pattern of life based on what is ‘normal’ and learned for the environment. If activity is detected that represents a deviation from expected activity from, a model alert is triggered. When Darktrace’s Autonomous Response functionality is configured in autonomous response mode, as was the case with the customer, it swiftly applies response actions to devices and users without the need for a system administrator or security analyst to perform any actions.

In this instance, Darktrace applied a number of mitigative actions on the remote user, containing most of the activity as soon as it was detected:

  • Block all outgoing traffic
  • Enforce pattern of life
  • Block all connections to port 445 (SMB)
  • Block all connections to port 9401
Figure 6: Darktrace’s Autonomous Response actions showing the actions taken in response to the observed activity, including blocking all outgoing traffic or enforcing the pattern of life.

Conclusion

This vishing attack underscores the significant risks remote employees face and the critical need for companies to address vishing threats to prevent network compromises. The remote employee in this instance was deceived by a malicious actor who spoofed the phone number of internal IT Support and convinced the employee to perform approve an MFA request. This sophisticated social engineering tactic allowed the attacker to proxy through the customer’s VPN, making the malicious activity appear legitimate due to the use of static IP addresses.

Despite the stealthy attempts to perform malicious activities on the network, Darktrace’s focus on anomaly detection enabled it to swiftly identify and analyze the suspicious behavior. This led to the prompt determination of the activity as malicious and the subsequent blocking of the malicious actor to prevent further escalation.

While the exact motivation of the threat actor in this case remains unclear, the 2023 cyber-attack on MGM Resorts serves as a stark illustration of the potential consequences of such threats. MGM Resorts experienced significant disruptions and data breaches following a similar vishing attack, resulting in financial and reputational damage [1]. If the attack on the customer had not been detected, they too could have faced sensitive data loss and major business disruptions. This incident underscores the critical importance of robust security measures and vigilant monitoring to protect against sophisticated cyber threats.

Credit to Rajendra Rushanth (Cyber Security Analyst) and Ryan Traill (Threat Content Lead)

Appendices

Darktrace Model Detections

  • Device / Unusual LDAP Bind and Search Activity
  • Device / Attack and Recon Tools
  • Device / Network Range Scan
  • Device / Suspicious SMB Scanning Activity
  • Device / RDP Scan
  • Device / UDP Enumeration
  • Device / Large Number of Model Breaches
  • Device / Network Scan
  • Device / Multiple Lateral Movement Model Breaches (Enhanced Monitoring)
  • Device / Reverse DNS Sweep
  • Device / SMB Session Brute Force (Non-Admin)

List of Indicators of Compromise (IoCs)

IoC - Type – Description

/nice ports,/Trinity.txt.bak - URI – Unusual Nmap Usage

MITRE ATT&CK Mapping

Tactic – ID – Technique

INITIAL ACCESS – T1200 – Hardware Additions

DISCOVERY – T1046 – Network Service Scanning

DISCOVERY – T1482 – Domain Trust Discovery

RECONNAISSANCE – T1590 – IP Addresses

T1590.002 – DNS

T1590.005 – IP Addresses

RECONNAISSANCE – T1592 – Client Configurations

T1592.004 – Client Configurations

RECONNAISSANCE – T1595 – Scanning IP Blocks

T1595.001 – Scanning IP Blocks

T1595.002 – Vulnerability Scanning

References

[1] https://www.bleepingcomputer.com/news/security/securing-helpdesks-from-hackers-what-we-can-learn-from-the-mgm-breach/

Continue reading
About the author
Rajendra Rushanth
Cyber Analyst

Blog

/

October 3, 2024

/

Cloud

Introducing real-time multi-cloud detection & response powered by AI

Default blog imageDefault blog image

We are delighted to announce the general availability of Microsoft Azure support for Darktrace / CLOUD, enabling real-time cloud detection and response across dynamic multi-cloud environments. Built on Self-Learning AI, Darktrace / CLOUD leverages Microsoft’s new virtual network flow logs (VNet flow) to offer an agentless-first approach that dramatically simplifies detection and response within Azure, unifying cloud-native security with Darktrace’s innovative ActiveAI Security Platform.

As organizations increasingly adopt multi-cloud architectures, the need for advanced, real-time threat detection and response is critical to keep pace with evolving cloud threats. Security teams face significant challenges, including increased complexity, limited visibility, and siloed tools. The dynamic nature of multi-cloud environments introduces ever-changing blind spots, while traditional security tools struggle to provide real-time insights, often offering static snapshots of risk. Additionally, cloud security teams frequently operate in isolation from SOC teams, leading to fragmented visibility and delayed responses. This lack of coordination, especially in hybrid environments, hinders effective threat detection and response. Compounding these challenges, current security solutions are split between agent-based and agentless approaches, with agentless solutions often lacking real-time awareness and agent-based options adding complexity and scalability concerns. Darktrace / CLOUD helps to solve these challenges with real-time detection and response designed specifically for dynamic cloud environments like Azure and AWS.

Pioneering AI-led real-time cloud detection & response

Darktrace has been at the forefront of real-time detection and response for over a decade, continually pushing the boundaries of AI-driven cybersecurity. Our Self-Learning AI uniquely positions Darktrace with the ability to automatically understand and instantly adapt to changing cloud environments. This is critical in today’s landscape, where cloud infrastructures are highly dynamic and ever-changing.  

Built on years of market-leading network visibility, Darktrace / CLOUD understands ‘normal’ for your unique business across clouds and networks to instantly reveal known, unknown, and novel cloud threats with confidence. Darktrace Self-Learning AI continuously monitors activity across cloud assets, containers, and users, and correlates it with detailed identity and network context to rapidly detect malicious activity. Platform-native identity and network monitoring capabilities allow Darktrace / CLOUD to deeply understand normal patterns of life for every user and device, enabling instant, precise and proportionate response to abnormal behavior - without business disruption.

Leveraging platform-native Autonomous Response, AI-driven behavioral containment neutralizes malicious activity with surgical accuracy while preventing disruption to cloud infrastructure or services. As malicious behavior escalates, Darktrace correlates thousands of data points to identify and instantly respond to unusual activity by blocking specific connections and enforcing normal behavior.

Figure 1: AI-driven behavioral containment neutralizes malicious activity with surgical accuracy while preventing disruption to cloud infrastructure or services.

Unparalleled agentless visibility into Azure

As a long-term trusted partner of Microsoft, Darktrace leverages Azure VNet flow logs to provide agentless, high-fidelity visibility into cloud environments, ensuring comprehensive monitoring without disrupting workflows. By integrating seamlessly with Azure, Darktrace / CLOUD continues to push the envelope of innovation in cloud security. Our Self-learning AI not only improves the detection of traditional and novel threats, but also enhances real-time response capabilities and demonstrates our commitment to delivering cutting-edge, AI-powered multi-cloud security solutions.

  • Integration with Microsoft Virtual network flow logs for enhanced visibility
    Darktrace / CLOUD integrates seamlessly with Azure to provide agentless, high-fidelity visibility into cloud environments. VNet flow logs capture critical network traffic data, allowing Darktrace to monitor Azure workloads in real time without disrupting existing workflows. This integration significantly reduces deployment time by 95%1 and cloud security operational costs by up to 80%2 compared to traditional agent-based solutions. Organizations benefit from enhanced visibility across dynamic cloud infrastructures, scaling security measures effortlessly while minimizing blind spots, particularly in ephemeral resources or serverless functions.
  • High-fidelity agentless deployment
    Agentless deployment allows security teams to monitor and secure cloud environments without installing software agents on individual workloads. By using cloud-native APIs like AWS VPC flow logs or Azure VNet flow logs, security teams can quickly deploy and scale security measures across dynamic, multi-cloud environments without the complexity and performance overhead of agents. This approach delivers real-time insights, improving incident detection and response while reducing disruptions. For organizations, agentless visibility simplifies cloud security management, lowers operational costs, and minimizes blind spots, especially in ephemeral resources or serverless functions.
  • Real-time visibility into cloud assets and architectures
    With real-time Cloud Asset Enumeration and Dynamic Architecture Modeling, Darktrace / CLOUD generates up-to-date architecture diagrams, giving SecOps and DevOps teams a unified view of cloud infrastructures. This shared context enhances collaboration and accelerates threat detection and response, especially in complex environments like Kubernetes. Additionally, Cyber AI Analyst automates the investigation process, correlating data across networks, identities, and cloud assets to save security teams valuable time, ensuring continuous protection and efficient cloud migrations.
Figure 2: Real-time visibility into Azure assets and architectures built from network, configuration and identity and access roles.

Unified multi-cloud security at scale

As organizations increasingly adopt multi-cloud strategies, the complexity of managing security across different cloud providers introduces gaps in visibility. Darktrace / CLOUD simplifies this by offering agentless, real-time monitoring across multi-cloud environments. Building on our innovative approach to securing AWS environments, our customers can now take full advantage of robust real-time detection and response capabilities for Azure. Darktrace is one of the first vendors to leverage Microsoft’s virtual network flow logs to provide agentless deployment in Azure, enabling unparalleled visibility without the need for installing agents. In addition, Darktrace / CLOUD offers automated Cloud Security Posture Management (CSPM) that continuously assesses cloud configurations against industry standards.  Security teams can identify and prioritize misconfigurations, vulnerabilities, and policy violations in real-time. These capabilities give security teams a complete, live understanding of their cloud environments and help them focus their limited time and resources where they are needed most.

This approach offers seamless integration into existing workflows, reducing configuration efforts and enabling fast, flexible deployment across cloud environments. By extending its capabilities across multiple clouds, Darktrace / CLOUD ensures that no blind spots are left uncovered, providing holistic, multi-cloud security that scales effortlessly with your cloud infrastructure. diagrams, visualizes cloud assets, and prioritizes risks across cloud environments.

Figure 3: Unified view of AWS and Azure cloud posture and compliance over time.

The future of cloud security: Real-time defense in an unpredictable world

Darktrace / CLOUD’s support for Microsoft Azure, powered by Self-Learning AI and agentless deployment, sets a new standard in multi-cloud security. With real-time detection and autonomous response, organizations can confidently secure their Azure environments, leveraging innovation to stay ahead of the constantly evolving threat landscape. By combining Azure VNet flow logs with Darktrace’s AI-driven platform, we can provide customers with a unified, intelligent solution that transforms how security is managed across the cloud.

Learn More:

References

1. Based on internal research and customer data

2. Based on internal research

Continue reading
About the author
Adam Stevens
Director of Product, Cloud Security
Your data. Our AI.
Elevate your network security with Darktrace AI