Spam e-mails on Exchange Online

[EBrooke]

Hi all,

 

This has been confusing my team and I for a while now and I'm desperate to get to the bottom of it.

 

We've been receiving a lot of spam.

• All emails appear to be sent from staff and student e-mail addresses within our organisation. Message Trace confirms this.
  
• When logging into an account that spam has been sent from, it is in the deleted items folder (rather than the sent items folder).
  
• All of these messages, according to Message Trace, originate from IP addresses leased from RIPE by Three (as in the mobile provider) for its mobile broadband service.
  
• Every single message looks like this, and makes reference to Chef Ramsay! It has a "View Article" link and the destination changes with every single e-mail that is sent.
  

 

 

I have tried to see where this link sends you as a user to confirm whether it is a phish or just spam, but when clicking the link (in a secure Linux virtual environment with no network access to anything sensitive) the page load times out and nothing happens.

Even if I intercept an e-mail like this right away the link in it appears dead.

 

I am a little lost and don't understand what the spammers are achieving if it's nothing but dead links. But it seems somehow they are gaining access to our users' accounts.

Is anyone else currently dealing with anything similar?

 

I've written some Exchange rules that are blocking this for now, but I don't know how long it is until the spammers realise nothing is getting through and alter their attack vector.

 

Best wishes!

[chaplic]

Are you sure these are spoof emails and instead you've been compromised in some way, either by a malicious enterprise app (aad.portal.azure.com -> Enterprise apps) I'd also look at the mailbox audit logs and signin logs via azure AD

[EBrooke]

Are you sure these are spoof emails and instead you've been compromised in some way, either by a malicious enterprise app (aad.portal.azure.com -> Enterprise apps) I'd also look at the mailbox audit logs and signin logs via azure AD

 

Thanks for the reply.

 

I can confirm that there are suspicious logins in the Azure sign-in logs. See below. I've redacted a legitimate sign-in as well as the student's username.

All these IPs are leased by Three for mobile broadband. The spam e-mails also come from IPs leased by Three in a similar (massive) range.

 

 

I'd love it if we could enable MFA for all students but unfortunately we can't.

 

Thank you.

[chaplic]

I can spoof emails all day long as any account I like; however it's impossible for me to add them to sent items, deleted items or anything else unless the account in question has been compromised. Someone has access to these accounts (it wouldn't surprise me if they also have inbox rules, perhaps not immediately visible) dealing with traffic. You need to dig into The office activity log, the mailbox activity log and I'd raise a ticket with MS. You may also start planning for a full password reset and MFA wherever possible.

[round2it]

Check the message rules on the accounts

 

I had one that did something similar and it was 2 rules one to send mail and another to delete it from the sent items putting the email in the deleted items as you are finding.

[MatthewL]

First thing I would do is change the password, potential for account to be compromised. If user doesn't need web access disable that (if you can in O365) reduce the places it can be logged in with.

[CraigM]

First thing I would do is change the password, potential for account to be compromised. If user doesn't need web access disable that (if you can in O365) reduce the places it can be logged in with.

 

Definitely a good first step. What you will probably find is that the account(s) is/are compromised. Once the spammers have working credentials, they are probably pushing out the spam via their botnet zombies, which is why you are seeing those IP addresses from the Three network.

 

Last year I had 2 users get phished and with those valid credentials, the spammers were sending mail via our domain - DKIM, SPF and DMARC couldn't help a damn here because the mail originated from a compromised internal account. Once I got them to change their passwords, the spamming stopped dead.

 

Good luck cleaning this up. It's never fun being a spam bot, especially when you try and keep everything running smoothly.

[Norphy]

I don’t have anything much more to add about the topic directly but there is something else that’s worth looking at.

 

There was a post on here a while ago about password hashes. There is a list on https://www.haveibeenpwned.com of NTLM hashes of passwords that have been known to be compromised and broken. Someone wrote a script which takes a dump of your Active Directory database and compares the password hashes with ones which have been known to be compromised. I ran this script on our AD database and it found a plethora of weak passwords, some of them from the IT team. It’s worth running this script against your AD database and seeing what it turns up.