2018 You’ve Got Mail! by Dan Caban and Muks Hirani

### Overview In this talk, Dan Caban, an incident responder at Mandiant (part of FireEye) based in Dubai, discusses how targeted threat actors—particularly suspected nation-state groups in the Middle East such as APT34—exploit enterprise email infrastructure across every stage of the attack lifecycle. Moving beyond initial spear-phishing, Caban presents real-world incident response case studies demonstrating how adversaries abuse email trust relationships, bypass two-factor authentication (2FA), compromise desktop clients, deploy persistent server-side backdoors, and leverage built-in Exchange and PowerShell features for surveillance and exfiltration.

### Key Topics - **Initial Access & Trust Abuses:** Attackers use confusingly similar domains, lookalike domains for harvesting misdirected emails, and compromised partner accounts or OWA access to insert malicious payloads into active, trusted email threads. Caban also highlights Google OAuth abuse via strategic web compromises. - **Two-Factor Authentication Flaws & Bypasses:** Organizations frequently implement 2FA poorly. Threat actors bypass SMS-based one-time passwords (OTP) by modifying user mobile numbers via compromised domain admin rights, intercept RSA soft tokens sent via unencrypted email, spoof MAC addresses, or circumvent OWA 2FA entirely by targeting alternate protocols like Exchange ActiveSync or Exchange Web Services (EWS). - **Client-Side Attacks & Outlook Persistence:** Adversaries manipulate Outlook settings synchronized with Exchange. Tools like Ruler allow attackers to configure Outlook homepages (e.g., executing commands via living-off-the-land binaries like certutil or PowerShell) and inbox rules. Caban also examines stealthy client backdoors, including a malicious .NET Outlook add-in and a DLL targeting multiple clients (Outlook, Outlook Express, Thunderbird, The Bat!), both utilizing steganography inside images to conceal command-and-control (C2) traffic. - **Exchange Server Persistence (Web Shells, Modules & Agents):** Attackers exploit Exchange servers due to high uptime requirements. Techniques range from aspx web shells (with evasion such as offset indexing, credential-harvesting via modified logoff scripts, and dynamic in-memory compilation) to low-level IIS managed/native modules (e.g., `Microsoft.Exchange.Clients.Auth.dll`, `http_parser.dll`) and Exchange transport agents capable of intercepting, modifying, or blocking emails. - **PowerShell Post-Exploitation & Forensic Discovery:** Attackers utilize built-in cmdlets (`New-InboxRule`, `New-MailboxExportRequest`, `New-MailboxSearch`) to forward sensitive emails, dump executive PSTs, and run e-discovery queries across organizations targeting terms like 'password' or 'VPN access'.

### Technical Details - **Case Study (APT34):** In one 2015 breach, a macro-enabled document from a trusted hardware supplier led to credential dumping with Mimikatz, lateral movement, and web shell deployment on Exchange within three hours. Stolen data was staged as massive RAR files disguised as GIFs (triggering 206 partial download status codes). - **IIS Modules:** Adversaries use `appcmd.exe` or GUI to install native or managed modules. Native modules exported `RegisterModule` and parsed specific parameters (such as inspecting the 25th HTTP header for `default-windows` before triggering RC, UF, or DF routines). - **Forensics:** Caban notes that Exchange mailbox auditing is disabled by default, but defenders responding to Office 365 / Outlook 365 incidents can utilize Microsoft's activity/management REST API to review unlogged activity.

### Takeaways Defenders must secure email gateways, harden attachment policies, and sandbox files. Organizations must require VPNs for remote and guest networks, transition away from insecure SMS-based OTP or MAC filtering, enforce 2FA across all protocols (including EWS and ActiveSync), monitor for lookalike domains, employ file integrity monitoring (FIM) and application whitelisting on Exchange servers, inspect parent-child process anomalies (IIS/Word spawning PowerShell), and proactively hunt for suspicious inbox rules, mailbox exports, and e-discovery queries.