Detect
Security monitoring identified suspicious activity instead of waiting for the user to discover the compromise the next morning.
BUSINESS EMAIL COMPROMISE CASE STUDY
A phishing click happened after hours. Fortify IT’s security monitoring caught the compromise.
How Fortify IT contained a compromised Catalyst Carpet Service mailbox while the user was asleep and strengthened the account afterward.
CLIENTCatalyst Carpet Service
Business email compromise • Microsoft 365 security • Incident response • 24/7 SOC monitoring
THE INCIDENT
One phishing email gave an attacker access to a business mailbox.
A Catalyst Carpet Service user clicked a phishing link and the attacker gained access to the user’s email account. The attacker began creating mailbox rules, a common persistence technique that can help hide messages or redirect communications while an account is being abused.
Because business mailboxes can contain customer information, invoices, vendor conversations and other sensitive data, an account compromise can quickly become more than an email problem.
CAUGHT AFTER HOURS
The user was asleep. Fortify IT’s 24/7 SOC was still watching.
Security alert detected. Fortify IT’s 24/7 security operations monitoring identified the compromised account activity.
Account contained. The account was shut down before the attacker could continue doing more damage.
Access revoked. Credentials were reset and active sessions were revoked to remove unauthorized access.
Persistence investigated. The mailbox and account were reviewed for attacker-created rules and other signs of continued access.
THE RESPONSE
Contain first. Investigate. Then strengthen the account.
Contain
Fortify IT shut down access, reset credentials and revoked sessions to stop the attacker.
Investigate
The account was reviewed for malicious mailbox rules and other persistence or unauthorized activity.
Harden
MFA and account security were strengthened after containment to reduce the chance of repeat compromise.
A LONG-TERM IT RELATIONSHIP
“Fortify has been with us since we started our business, building our network, servers and applications from the ground up. It is wonderful knowing we can call Fortify every time we grow and they are right there to help our technology grow with our demands.”Kathy S.HR Director, Catalyst Carpet Service
WHY IT MATTERED
The value of monitoring is clearest when nobody is sitting at the computer.
Had the compromise gone unnoticed until the next business day, the attacker would have had additional time inside the mailbox. In this incident, Fortify IT’s security monitoring detected the activity while the user was asleep and the account was contained before the attacker could do more damage.
The incident also demonstrates why email security is not only a spam-filtering problem. Identity protection, security monitoring, incident response and user awareness all play a role in reducing business email compromise risk.
WORRIED ABOUT EMAIL COMPROMISE?