USE CASE #1
FROM AN OUTDATED SMARTPHONE
TO MASS SPAM FROM THE COMPANY DOMAIN

SOURCES OF VULNERABILITY TO ATTACKS

• One of the employees received a work call directly from the CEO, bypassing the IT department.
• The device was not covered by cybersecurity policies or technical oversight.
• An Android phone running an old, vulnerable version of the operating system served as the primary tool for receiving 2FA tokens for Microsoft 365.
  
• No security software (e.g., ESET Mobile Security) or MDM/MAM management agent is installed on the smartphone.
  

INCIDENT

The criminals exploited known vulnerabilities in an outdated Android system. They took control of the device, which allowed them to obtain the user's login and password and steal the 2FA token directly from the infected phone.

The attackers then compromised the Microsoft 365 mailbox, using it to send mass spam abroad.

WHY WAS THE ATTACK SUCCESSFUL?

• No updates: working on a buggy operating system.
  
• Lack of visibility: the phone was off the IT department's radar, unprotected (no central management).
  
• False sense of security: trusting 2FA without securing the end device.
  

EFFECTS OF THE INCIDENT

• Communication blockage: anti-spam systems blocked the company account, paralyzing work.
  
• Image crisis: risk of the domain being blacklisted (RBL), which means that emails may stop reaching customers for weeks.
  
• Operational costs: the need for urgent analysis of Microsoft 365 logs and tedious restoration of account security

THE ROLE OF SOC ADQ: WHAT WOULD CHANGE?

• Rapid anomaly detection: our analysts would immediately notice logins
  from unusual geographic locations.
  
• Response to mass mailings: SOC would detect unusual outgoing traffic (spam)
  in real time, rather than only after external filters have blocked the servers.
  
• Damage control: early alerts would allow for automatic or manual account blocking within minutes, rather than hours or days, protecting your domain's reputation.

KEY CONCLUSIONS:

• If the phone on which you generate codes is infected, security ceases to exist.
• Company phones must be subject to the same security requirements as laptops.
  
• The SOC service increases visibility into what is happening in your cloud (M365) and dramatically reduces response time to intrusions.