What Talos Incident Response learned from a recent Qakbot attack hijacking old email threads

Summary: Cisco Talos described external thread hijacking in which attackers used emails harvested from other organizations months to years earlier during the 2021 ProxyLogon campaign (CVE-2021-26855) to send phishing emails, observed in June 2022 as part of a campaign delivering the Qakbot banking trojan. Unlike victim thread hijacking, where the adversary compromises the target's Exchange server and sends malicious replies from it, this method does not require initial access to the victim environment, so the target organization only saw inbound phishing emails built from its own legitimate emails with multiple external organizations represented in the threads.
What you should know: Talos notes that correctly recognizing external thread hijacking can save dozens of hours of hunting for an internal breach that does not exist, and that bulk email aggregations exfiltrated in 2020 and 2021 will likely keep feeding focused phishing campaigns.

Read the original at Cisco Talos ↗

Topics: Detection & Response
Mentions: CVE-2021-26855
Related: Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities Cyber Risks ·
CVE-2021-26855: Microsoft Exchange Server Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
Threat Advisory: HAFNIUM and Microsoft Exchange zero-day Cyber Risks ·