Host actively used as part of O365 Tenant Compromise between 1st June 2022 and 20th July 2022. Host ... show moreHost actively used as part of O365 Tenant Compromise between 1st June 2022 and 20th July 2022. Host is a RDP server in MS Azure, used by an attacker as an origin host for attack. Attacker compromised user mail accounts, stole sensitive information, attempted to trick user into sending payment for supplier invoices to unknown bank account, after intercepting the users mail and changing the original suppliers email and invoice. Used during same compromise as host 193.56.29.137. show less
Host actively used as part of O365 Tenant Compromise between 1st June 2022 and 20th July 2022. Host ... show moreHost actively used as part of O365 Tenant Compromise between 1st June 2022 and 20th July 2022. Host is a RDP serverused by an attacker as origin host for attack. Attacker compromised user mail accounts, stole sensitive information, attempted to trick user into sending payment for supplier invoices to unknown bank account, after intercepting the users mail and changing the original suppliers email and invoice. The following is audit log sample with sensitive information redacted, attacker accessing and altering users' mail.
{"CreationTime":"2022-07-05T13:56:31","Id":"0abf17e0-a307-453c-8f31-08da5e8e2a21","Operation":"Update","RecordType":2,"ResultStatus":"Succeeded","Workload":"Exchange","ClientIP":"193.56.29.137","UserId":"***[email protected]************e.com","ClientIPAddress":"193.56.29.137","ClientInfoString":"Client=OWA;Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.62 Safari/537.36;","ExternalAccess":false,"LogonType":0,"LogonUserSid":"S-1-5-21-1**-REDACTED-**5"} show less
52.249.187.66