Phishing email
How a single phishing email ended with the corporate database being stolen
How the attack unfolded
Eight steps from a single email to an employee to a stolen database. The attack could have been stopped at almost every one of them.
Email received Entry point
An employee gets a phishing email with a virtual disk image attached
Attachment opened
The employee opens the attachment and the disk image mounts
Shortcut launched
A malicious shortcut (LNK) contacts a remote server
Malware loaded
A loader delivers the main payload and runs it in memory
Credentials stolen
The attackers take passwords saved in the employee’s browser
Admin workstation taken
Lateral movement and new credentials from an administrator’s workstation
Infrastructure access
The admin credentials give control of VMware vCenter
Database exfiltrated Impact
vCenter leads to the database server; the dump goes to an external server
What we did
We reconstructed the attack chain, from an employee’s email to the stolen database, and identified where defences failed. We handed over recommendations on email, workstations, admin accounts and outbound traffic.
Task
The contents of a corporate database turned up on an external server. We had to reconstruct the attackers’ path from the first step to the leak and identify which defences should have worked at each stage.
Solution
- Identified the entry point: a phishing email with a virtual disk image containing a malicious shortcut (LNK).
- Analysed the loader: it downloaded the main malicious payload and ran it in memory.
- Found how the attackers took credentials saved in the employee’s browser and reached an administrator’s workstation.
- Traced the path through VMware vCenter to the database server and the transfer of the dump to an external server.
- Gave recommendations on email protection, workstations, admin accounts and outbound traffic control.
Where the attack could have been stopped
There was a chance to stop the attack at almost every step. We recommended:
- Filtering email attachments: disk images and shortcuts should never reach employees
- Training and practice phishing campaigns, so suspicious emails get noticed and reported
- No passwords stored in browsers, plus multi-factor authentication
- Separate workstations and accounts for administration
- Restricted access to vCenter and database servers, and control of outbound traffic
What shall we build together?
Tell us what you want to launch or improve. We’ll discuss the task and suggest the next step.