Phishing for Cloud Providers A New Supply Chain Threat

iStock-688214742Attackers are going after cloud-based customer relationship management (CRM) providers in order to launch unusually convincing phishing campaigns, KrebsOnSecurity reports.
Krebs learned of a recent campaign that targeted customers of United Rentals, the largest construction equipment rental company in the world. The company’s customers received malicious emails from a third-party email marketing service that was authorized to send emails using United Rentals’ domain.
Krebs explained that compromising a CRM gave the attackers the ability to imitate United Rentals through a legitimate portal, as well as granting them access to the company’s customer email list. 
“Companies that use cloud-based CRMs sometimes will dedicate a domain or subdomain they own specifically for use by their CRM provider, allowing the CRM to send emails that appear to come directly from the client’s own domains,” he wrote. “However, in such setups the content that gets promoted through the client’s domain is actually hosted on the cloud CRM provider’s systems.” 
Dan Higgins, United Rentals’ chief information officer, told Krebs that it appears an attacker used a CRM provider account to send malicious emails United Rentals’ customers. “At this point, we believe this to be an email phishing incident in which an unauthorized third party used a third-party system to generate an email campaign to deliver what we believe to be a banking Trojan,” Higgins said.
In this case, the CRM appeared to be Pardot, an email marketing platform owned by Salesforce, but a Salesforce spokesman told Krebs that the compromised account belonged to a third-party marketing agency that was using the Pardot platform. This account was not using multi-factor authentication.
In order to defend themselves against these types of attacks, organizations need to monitor the third-party services they use, as well as ensure that their own employees are resistant to phishing attacks. Employees of all levels and at all kinds of organizations can benefit from new-school security awareness training.

KrebsOnSecurity has the story:

Request Your Security Awareness Training Quote

products-KB4SAT6-2Old-school awareness training does not hack it anymore. Your email filters have a ~10% failure rate; you need a strong human firewall as your last line of defense. KnowBe4 is your platform for new-school security awareness training. We help you keep your users on their toes with security top of mind. You simply have got to start training and phishing your users ASAP. If you don't, the bad guys will. Find out how affordable this is for your organization and be pleasantly surprised.

Get A Quote Now

Don't like to click on redirected buttons? Cut & Paste this link in your browser:

Subscribe To Our Blog

Weak Password Test Contest

Get the latest about social engineering

Subscribe to CyberheistNews