March 20, 2019 By David Bisson 2 min read

A massive brute-force attack campaign used both legacy protocols and credential dumps to compromise cloud user accounts.

In a six-month study, Proofpoint observed a wave of brute-force attacks that originated mainly from Nigeria but also China, the U.S., Brazil and South Africa. These malicious operations abused various legacy protocols in the process; the vast majority leveraged IMAP, a legacy authentication protocol that bypasses multifactor authentication (MFA). Concurrently, the campaigns referred to several credential dumps to obtain username-password variations.

The attacks relied on compromised network devices such as routers and servers to conduct IMAP-based password-spraying attacks. These brute-force attempts were successful 44 percent of the time, according to Proofpoint. In those cases, the malefactors used the compromised credentials to steal access to users’ cloud application accounts. They then abused that access to send out phishing attacks to move laterally throughout the network and/or prey upon users employed at other organizations.

Not the First Brute-Force Attack Campaign to Involve IMAP

IMAP has been involved in similar operations in the past. Back in 2017, for instance, security researcher Stephen Atty discovered what appeared to be a slow-moving botnet sending out POP3/IMAP attempts at a slow rate so as to not raise any red flags with monitoring software. More than a year later, Roger Comply reported in Paranoid Penguin that he had observed another botnet using what he called the “drip” approach in its login attempts against targeted IMAP servers.

How to Strengthen Your Organization’s Email Defenses

Security professionals can help strengthen their organization’s email security posture by taking a layered approach to email defenses. This strategy should begin with the deployment of an external solution capable of scanning email for threats. They should also seek budget to create an email security awareness program to train the entire workforce to recognize, avoid and report phishing attacks.

More from

CISA hit by hackers, key systems taken offline

3 min read - The Cybersecurity and Infrastructure Security Agency (CISA) — responsible for cybersecurity and infrastructure protection across all levels of the United States government — has been hacked.“About a month ago, CISA identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses,” a CISA spokesperson announced.In late February, CISA had already issued a warning that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. Ivanti Connect Secure is a widely deployed…

Cloud security evolution: Years of progress and challenges

7 min read - Over a decade since its advent, cloud computing continues to enable organizational agility through scalability, efficiency and resilience. As clients shift from early experiments to strategic workloads, persistent security gaps demand urgent attention even as providers expand infrastructure safeguards.The prevalence of cloud-native services has grown exponentially over the past decade, with cloud providers consistently introducing a multitude of new services at an impressive pace. Now, the contemporary cloud environment is not only larger but also more diverse. Unfortunately, that size…

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today