A massive brute-force attack campaign used both legacy protocols and credential dumps to compromise cloud user accounts.
In a six-month study, Proofpoint observed a wave of brute-force attacks that originated mainly from Nigeria but also China, the U.S., Brazil and South Africa. These malicious operations abused various legacy protocols in the process; the vast majority leveraged IMAP, a legacy authentication protocol that bypasses multifactor authentication (MFA). Concurrently, the campaigns referred to several credential dumps to obtain username-password variations.
The attacks relied on compromised network devices such as routers and servers to conduct IMAP-based password-spraying attacks. These brute-force attempts were successful 44 percent of the time, according to Proofpoint. In those cases, the malefactors used the compromised credentials to steal access to users’ cloud application accounts. They then abused that access to send out phishing attacks to move laterally throughout the network and/or prey upon users employed at other organizations.
Not the First Brute-Force Attack Campaign to Involve IMAP
IMAP has been involved in similar operations in the past. Back in 2017, for instance, security researcher Stephen Atty discovered what appeared to be a slow-moving botnet sending out POP3/IMAP attempts at a slow rate so as to not raise any red flags with monitoring software. More than a year later, Roger Comply reported in Paranoid Penguin that he had observed another botnet using what he called the “drip” approach in its login attempts against targeted IMAP servers.
How to Strengthen Your Organization’s Email Defenses
Security professionals can help strengthen their organization’s email security posture by taking a layered approach to email defenses. This strategy should begin with the deployment of an external solution capable of scanning email for threats. They should also seek budget to create an email security awareness program to train the entire workforce to recognize, avoid and report phishing attacks.