The recent conviction of a U.K. man for cyber crimes committed in 2018 brings to light a cyber attack where this attacker manually performed the “in-the-middle” part of an attack.
We’ve all heard of a “Man-in-the-Middle” (MitM) attack – also more recently called a “Manipulator-in-the-Middle” attack. These attacks involve attackers using some form of tech to intercept communications, manipulate them for their own devious purposes, and control a conversation between two systems, networks, entities or people.
The recent conviction of 28-year old U.K. would-be cybercriminal, Ashley Liles shows us that sometimes attacks can be accomplished “old school," where old fashioned manual intervention is all that’s needed for an attack.
According to the conviction details, in 2018, Liles employer became the victim of a ransomware attack. Liles’ role was IT Security Analyst, working alongside law enforcement to respond to and mitigate the attack. But Liles himself intercepted a board member’s email over 300 times, altering the payment details on blackmail emails in an attempt to have the ransom paid to himself.
Liles’ downfall was access logs showing that access to the board member’s email had been accomplished from his home.
Sure, this kind of twist in a ransomware attack is not probable, but it does make the case that organizations should always maintain and audit security logs, don’t fall victim to a ransomware attack in the first place, and implement new-school security awareness training to teach your users how to avoid these types of attacks.
