Darktrace email finds: Microsoft Teams impersonation

Dan Fein, Director of Email Security Products | Thursday July 16, 2020

With the move to remote working, the number of active daily users on Microsoft Teams has grown to 75 million, up from 20 million this time last year. Similar trends are being seen across Slack, Zoom, and Google Meet. With these SaaS applications becoming a staple in our working lives, we can expect cyber-criminals to begin leveraging their household names and trusted reputation to launch email attack campaigns.

Indeed, Darktrace’s AI picked up on one such attempt last month while deployed in passive mode at a multinational conglomerate. Antigena Email identified 48 incoming emails that impersonated a Microsoft Teams notification, but in fact came from an unknown sender and rare domain. The emails contained a hidden link to a Google storage site, hidden behind the text ‘Accept Collaboration’.

98%
Fri Jun 19 2020, 08:26:42
From:Microsoft Teams <[email protected]>
Recipient:Naomi Kelly <[email protected]>
Teams Message
Email Tags
Suspicious Link
New Contact
Wide Distribution
Actions on Email
Move to Junk
Double Lock Link
Hold Message

Figure 1: An interactive snapshot of Antigena Email's user interface

File storage links such as these are often used because they bypass spam filtering. Whilst the links themselves aren’t deemed as malicious, they may well include malware-containing files or other harmful content. Whilst this attack would have been waved through by a traditional email security tool, Antigena Email noticed that in this case the page appeared to be hosting a Microsoft sign-in page. At the time the email came through, a URL scan did not reveal this site as malicious, but Antigena Email recognized that it is highly unusual for a Google domain to be hosting an Office login page.

Recognizing this as an attempt to impersonate an internal service to distribute phishing links, Antigena Email locked the link in question and held the messages back from the inbox. The screenshot below reveals the full list of models that were breached, and the respective actions that this prompted the AI to take.

Figure 2: The complete list of model breaches associated with this email, and the relevant actions taken

None of the 48 emails were caught by Microsoft’s built-in security tools, and 12 of the emails were opened by the recipient. Additionally, emails were sent to recipients in alphabetical order, suggesting that the attacker may have gotten hold of a company address book and likely would have continued their attack – targeting even more employees – had Antigena Email not identified the malicious activity and immediately alerted the security team.

This was not the first, and is unlikely to be the last, time that attackers leverage trusted SaaS collaboration tools to try and engage users and coax them into clicking a malicious link. Antigena Email can see through these attempts, recognizing when a trusted brand name is being used to mask unusual and threatening behavior. Hundreds of organizations are now relying on this AI technology for a more comprehensive detection and response strategy against these increasingly sophisticated attacks.

For an analysis of 13 more email attacks, read the Email Security Threat Report 2020

Dan Fein

Based in New York, Dan is the Director of Email Security Products for the Americas. He joined Darktrace’s technical team in 2015, helping customers quickly achieve a complete and granular understanding of Darktrace’s world-leading Cyber AI Platform and products. Dan has a particular focus on Antigena Email, ensuring that it is effectively deployed in complex digital environments, and works closely with the development, marketing, sales, and technical teams. Dan holds a Bachelor’s degree in Computer Science from New York University.