SANS Institute is under a phishing attack

SANS Institute, a cooperative research and education organization, that trains cyber security specialists, fell victim of a phishing attack. As a result, about 28 000 personal records leaked.

What happened?

SANS Institute conducted its regular email configuration and rules review on the 6th of August. During the review it identified a suspicious forwarding rule and immediately started the incident response process. The discovered rule sent 513 emails from an employee’s account to some external address. The stolen data contained email addresses, names, surnames, countries of living, positions, company names, working phone numbers, company verticals and addresses of people registered for SANS Digital Forensics & Incident Response (DFIR) Summit.

The security incident was a result of the phishing email, received by one of the organization’s employees. He did not manage to recognize the fake email, followed the fraudulent instructions, and compromised his corporate email account. Though there was no malware deployed to his endpoint, the attack used a malicious O365 add-in on the server side.

Fortunately, SANS managed to identify the phishing attack quickly. On the average it takes companies from 6 weeks to 6 months to recognize a security incident like this. They removed the malicious code and conducted a full risk assessment according to the European legislation. Most of the compromised data turned out to be public, and the potential damage to the clients was not significant.

How to protect your company?

• Train your employees to recognize manipulation of their emotions and other signs of the phishing emails. First of all, it refers to non-IT teams inside any organization, including security and cyber security companies
• Constantly monitor (or at least regularly check) security events and review the discovered anomalies to timely identify suspicious activity and early signs of cyber-attacks
• If you detected some personal data compromised, act according to GDPR
• If you do not know how to act fast and properly in case of a security incident, contact our Incident Response team any time during the day or even at night

Image by Zab Consulting