Microsoft Security Intelligence warns of phishing attacks being sent from legitimate email addresses and IP ranges, taking advantage of gateway configuration settings to ensure delivery.
The bad guys know you have a layered defense sitting between them and your users. So, they look for ways to bypass any security controls by attempting to look legitimate. Microsoft’s warning highlights a few specific methods being used to accomplish this:
- The bad guys have compromised and leverage over 400,000 Office 365 email accounts as the phishing sender. The use of legitimate email addresses and domains lowers the likelihood a gateway will stop a phishing email.
- They also use compromised accounts from SendGrid and MailGun email delivery services, which many email gateways have listed as trusted senders.
- They use Appspot to create multiple unique phishing URLs to evade domain reputation-based solutions.
- They impersonate video conferencing solution notification emails.
The combination of these tactics adds up to some very successful phishing campaigns that make it all the way to a user’s Inbox.
The last line of defense here is the user, who can scrutinize the received emails, looking to see if they do any kind of business with the sender, if the email branding looks spoofed, and if the email is, in essence, unsolicited.
These simple checks are taught to users the undergo continual Security Awareness Training, helping to improve the security stance of their organization. The bad guys are obviously furiously working to get around your security solutions, so it’s time to put a human firewall layer in place through Security Awareness Training.
