Evolving Phishing Attacks
While email has long been the vector of choice for carrying out phishing attacks, threat actors, and their tactics, techniques, and procedures (TTPs), are continually adapting and evolving to keep pace with the emergence of new technologies that represent new avenues to exploit. As previously discussed by the Darktrace analyst team, several novel threats relating to the abuse of commonly used services and platforms were observed throughout 2023, including the rise of QR Code Phishing and the use of Microsoft SharePoint and Teams in phishing campaigns.
Dropbox Phishing Attacks
It should, therefore, come as no surprise that the malicious use of other popular services has gained traction in recent years, including the cloud storage platform Dropbox.
With over 700 million registered users [1], Dropbox has established itself as a leading cloud storage service celebrated for its simplicity in file storage and sharing, but in doing so it has also inadvertently opened a new avenue for threat actors to exploit. By leveraging the legitimate infrastructure of Dropbox, threat actors are able to carry out a range of malicious activities, from convincing their targets to unknowingly download malware to revealing sensitive information like login credentials.
Darktrace Detection of Dropbox Phishing Attack
Darktrace detected a malicious attempt to use Dropbox in a phishing attack in January 2024, when employees of a Darktrace customer received a seemingly innocuous email from a legitimate Dropbox address. Unbeknownst to the employees, however, a malicious link had been embedded in the contents of the email that could have led to a widespread compromise of the customer’s Software-as-a-Service (SaaS) environment. Fortunately for this customer, Darktrace / EMAIL quickly identified the suspicious emails and took immediate actions to stop them from being opened. If an email was accessed by an employee, Darktrace / IDENTITY was able to recognize any suspicious activity on the customer’s SaaS platform and bring it to the immediate detection of their security team.
Attack overview
Initial infection
On January 25, 2024, Darktrace / EMAIL observed an internal user on a customer’s SaaS environment receiving an inbound email from ‘no-reply@dropbox[.]com’, a legitimate email address used by the Dropbox file storage service. Around the same time 15 other employees also received the same email.
The email itself contained a link that would lead a user to a PDF file hosted on Dropbox, that was seemingly named after a partner of the organization. Although the email and the Dropbox endpoint were both legitimate, Darktrace identified that the PDF file contained a suspicious link to a domain that had never previously been seen on the customer’s environment, ‘mmv-security[.]top’.
Darktrace understood that despite being sent from a legitimate service, the email’s initiator had never previously corresponded with anyone at the organization and therefore treated it with suspicion. This tactic, whereby a legitimate service sends an automated email using a fixed address, such as ‘no-reply@dropbox[.]com’, is often employed by threat actors attempting to convince SaaS users to follow a malicious link.
As there is very little to distinguish between malicious or benign emails from these types of services, they can often evade the detection of traditional email security tools and lead to disruptive account takeovers.
As a result of this detection, Darktrace / EMAIL immediately held the email, stopping it from landing in the employee’s inbox and ensuring the suspicious domain could not be visited. Open-source intelligence (OSINT) sources revealed that this suspicious domain was, in fact, a newly created endpoint that had been reported for links to phishing by multiple security vendors [2].
A few days later on January 29, the user received another legitimate email from ‘no-reply@dropbox[.]com’ that served as a reminder to open the previously shared PDF file. This time, however, Darktrace / EMAIL moved the email to the user’s junk file and applied a lock link action to prevent the user from directly following a potentially malicious link.
Unfortunately for the customer in this case, their employee went on to open the suspicious email and follow the link to the PDF file, despite Darktrace having previously locked it.
Darktrace / NETWORK subsequently identified that the internal device associated with this user connected to the malicious endpoint, ‘mmv-security[.]top’, a couple of days later.
Further investigation into this suspicious domain revealed that it led to a fake Microsoft 365 login page, designed to harvest the credentials of legitimate SaaS account holders. By masquerading as a trusted organization, like Microsoft, these credential harvesters are more likely to appear trustworthy to their targets, and therefore increase the likelihood of stealing privileged SaaS account credentials.
Suspicious SaaS activity
In the days following the initial infection, Darktrace / IDENTITY began to observe a string of suspicious SaaS activity being performed by the now compromised Microsoft 365 account.
Beginning on January 31, Darktrace observed a number of suspicious SaaS logins from multiple unusual locations that had never previously accessed the account, including 73.95.165[.]113. Then on February 1, Darktrace detected unusual logins from the endpoints 194.32.120[.]40 and 185.192.70[.]239, both of which were associated with ExpressVPN indicating that threat actors may have been using a virtual private network (VPN) to mask their true location.
Interestingly, the threat actors observed during these logins appeared to use a valid multi-factor authentication (MFA) token, indicating that they had successfully bypassed the customer’s MFA policy. In this case, it appears likely that the employee had unknowingly provided the attackers with an MFA token or unintentionally approved a login verification request. By using valid tokens and meeting the necessary MFA requirements, threat actors are often able to remain undetected by traditional security tools that view MFA as the silver bullet. However, Darktrace’s anomaly-based approach to threat detection allows it to quickly identify unexpected activity on a device or SaaS account, even if it occurs with legitimate credentials and successfully passed authentication requirements, and bring it to the attention of the customer’s security team.
Shortly after, Darktrace observed an additional login to the SaaS account from another unusual location, 87.117.225[.]155, this time seemingly using the HideMyAss (HMA) VPN service. Following this unusual login, the actor was seen creating a new email rule on the compromised Outlook account. The new rule, named ‘….’, was intended to immediately move any emails from the organization’s accounts team directly to the ‘Conversation History’ mailbox folder. This is a tactic often employed by threat actors during phishing campaigns to ensure that their malicious emails (and potential responses to them) are automatically moved to less commonly visited mailbox folders in order to remain undetected on target networks. Furthermore, by giving this new email rule a generic name, like ‘….’ it is less likely to draw the attention of the legitimate account holder or the organizations security team.
Following this, Darktrace / EMAIL observed the actor sending updated versions of emails that had previously been sent by the legitimate account holder, with subject lines containing language like “Incorrect contract” and “Requires Urgent Review”, likely in an attempt to illicit some kind of follow-up action from the intended recipient. This likely represented threat actors using the compromised account to send further malicious emails to the organization’s accounts team in order to infect additional accounts across the customer’s SaaS environment.
Unfortunately, Darktrace's Autonomous Response was not deployed in the customer’s SaaS environment in this instance, meaning that the aforementioned malicious activity did not lead to any mitigative actions to contain the compromise. Had RESPOND been enabled in autonomous response mode at the time of the attack, it would have quickly moved to log out and disable the suspicious actor as soon as they had logged into the SaaS environment from an unusual location, effectively shutting down this account takeover attempt at the earliest opportunity.
Nevertheless, Darktrace / EMAIL's swift identification and response to the suspicious phishing emails, coupled with Darktrace / IDENTITY's detection of the unusual SaaS activity, allowed the customer’s security team to quickly identify the offending SaaS actor and take the account offline before the attack could escalate further
Conclusion
As organizations across the world continue to adopt third-party solutions like Dropbox into their day-to-day business operations, threat actors will, in turn, continue to seek ways to exploit these and add them to their arsenal. As illustrated in this example, it is relatively simple for attackers to abuse these legitimate services for malicious purposes, all while evading detection by endpoint users and security teams alike.
By leveraging these commonly used platforms, malicious actors are able to carry out disruptive cyber-attacks, like phishing campaigns, by taking advantage of legitimate, and seemingly trustworthy, infrastructure to host malicious files or links, rather than relying on their own infrastructure. While this tactic may bypass traditional security measures, Darktrace’s Self-Learning AI enables it to recognize unusual senders within an organization’s email environment, even if the email itself seems to have come from a legitimate source, and prevent them from landing in the target inbox. In the event that a SaaS account does become compromised, Darktrace is able to identify unusual login locations and suspicious SaaS activities and bring them to the attention of the customer for remediation.
In addition to the prompt identification of emerging threats, Darktrace's Autonomous Response is uniquely placed to take swift autonomous action against any suspicious activity detected within a customer’s SaaS environment, effectively containing any account takeover attempts in the first instance.
Credit to Ryan Traill, Threat Content Lead, Emily Megan Lim, Cyber Security Analyst
Appendices
Darktrace Model Detections
- Model Breach: SaaS / Access::Unusual External Source for SaaS Credential Use
- Model Breach: SaaS / Unusual Activity::Multiple Unusual External Sources For SaaS Credential
- Model Breach: SaaS / Access::Unusual External Source for SaaS Credential Use
- Model Breach: SaaS / Access::Unusual External Source for SaaS Credential Use
- Model Breach: SaaS / Unusual Activity::Multiple Unusual SaaS Activities
- Model Breach: SaaS / Unusual Activity::Unusual MFA Auth and SaaS Activity
- Model Breach: SaaS / Compromise::Unusual Login and New Email Rule
- Model Breach: SaaS / Compliance::Anomalous New Email Rule
- Model Breach: SaaS / Compliance::New Email Rule
- Model Breach: SaaS / Compromise::SaaS Anomaly Following Anomalous Login
- Model Breach: Device / Suspicious Domain
List of Indicators of Compromise (IoCs)
Domain IoC
mmv-security[.]top’ - Credential Harvesting Endpoint
IP Address
73.95.165[.]113 - Unusual Login Endpoint
194.32.120[.]40 - Unusual Login Endpoint
87.117.225[.]155 - Unusual Login Endpoint
MITRE ATT&CK Mapping
DEFENSE EVASION, PERSISTENCE, PRIVILEGE ESCALATION, INITIAL ACCESS
T1078.004 - Cloud Accounts
DISCOVERY
T1538 - Cloud Service Dashboard
RESOURCE DEVELOPMENT
T1586 - Compromise Accounts
CREDENTIAL ACCESS
T1539 - Steal Web Session Cookie
PERSISTENCE
T1137 - Outlook Rules
INITIAL ACCESS
T156.002 Spearphishing Link
![PCAP showing the client request and server response associated with the download of the y.sh script from 45.76.141[.]166. The body content of the HTTP response highlights a shebang command to run subsequent code as bash script. The content is base64 encoded and details PHP script for what appears to be a webshell that will likely be written to the firewall device.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/675700c4a98f6ccec0f1a975_6756f988e443cb72200722b4_Screenshot%25202024-12-09%2520at%252014.06.53.png)
![Sample of URIs observed in Advanced Searchhighlighting HTTP requests to 77.221.158[.]154 for Gzip content suggest of Sliver communication.](https://cdn.prod.website-files.com/626ff4d25aca2edf4325ff97/6757623084734b0dbf6418e4_675761ed5dcf48e9b0b0befb_Screenshot%25202024-12-09%2520at%25201.31.31%25E2%2580%25AFPM.png)
