• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – Siemens SCALANCE W700 and W1700 Information Exposure Vulnerability
December 11, 2019
Rewterz Threat Alert – Phishing Campaign Linked to Cobalt Group
December 12, 2019

Rewterz Threat Alert – Office 365 App Phishing Campaign

December 12, 2019

Severity

Medium

Analysis Summary

A phishing campaign gained access to victim accounts when the victims granted the app access to their Office 365 account. Phishing emails were sent to potential victims and contained a link to what was advertised as a legitimate SharePoint or OneDrive file share. When the victim clicks on the link, they are sent to a legitimate Microsoft login page. After the victim logged in (or if they were previously logged in), they were presented with a “Permissions requested” page that the app in the URL required. Clicking the Accept button essentially granted the app (and therefore the attackers) full access to the Office 365 account. In addition, any single sign on (SSO) service that leveraged the victim’s Office 365 credentials could then be accessed by the attackers. PhishLabs indicated that just changing the account password does not close this window into the account – the victim must disassociate the app from the account.

Impact

Credential theft

Indicators of Compromise

URL

  • https://login.microsoftonline.com/common/oauth2/v2.0/authorize?%20client_id=fc5d3843-d0e8-4c3f-b0ee-6d407f667751&response_type=id_token+code&redirect_uri=https%3A%2F%2Foffice

mtr.com%3A8081%2Foffice&scope=offline_access%20contacts.read%20user.read%20mail.read

%20notes.read.all%20mailboxsettings.readwrite%20Files.ReadWrite.All%20openid%20profile&state

=12345Ajtwmd&response_mode=%20form_post&nonce=YWxsYWh1IGFrYmFy

  • https://officemtr.com:8081/office

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the links/attachments sent by unknown senders.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.