Gregory Rehbein’s Post

There is currently an attack underway targeting M365 customers that are using Slack. The attack starts with the actors creating accounts using your M365 email address in Google Workspace. The goal is to not use this account for email, however it will be used for creating a Slack Workspace (and potentially other services). Your users who have had a fake Google Account created will receive an email from workspace-noreply@google.com stating "Welcome to Google Workspace". This is the first indicator that your identity has been recreated in Google Workspace. Real users will eventually receive emails from no-reply@slack.com regarding Slack invites or workspaces. This is because while the accounts in Google have the same account name (username@domain.com), they do not have the ability to use be used for gmail. These emails provide some context around what workspaces have been created to lure your employees, customer, or counterparties. Update: There are reports of users getting DMs from fake Slack accounts using these new Google Accounts. The DMs are utilizing traditional phishing and social engineering methods such as urgently requesting payments or requesting that users review invoices via links and attachments. Because the accounts are using Google Workspace (not SSO via Entra ID) for identity, they are appear to be from your domain, making the request seem legitimate. What to do? 1. Create an account at workspace.google.com and take ownership of your domain. You will need to create a TXT record in DNS to finalize this validation. Once validated, seize all accounts created using the domain. Suspend or delete the accounts that you are now in control of in this tenant. Make sure you enable MFA for any accounts that will remain. 2. At the Slack Org level, click Security > Email Domains. Add each domain that you want to protect and click "Block members using this domain to join external workspaces" and "Members using this domain can only accept Slack Connect invite from domain" 3. Review your settings for Slack Connect at the Org level by navigating to Slack Connect > Settings. Configure "Require approvals for invitations" and "Automatically accept invitations" according to your firms risk tolerance. 4. Request a complete audit of all your domains in Slack. This will give you a complete report of any user that is using your domain as their identity and the Slack workspace, team, or DM that the communications are originating from. You can also see the dates these accounts were created. You will need to request this from your Slack Enterprise Account Executive. You will want to search for what rogue workspaces were created. We are seeing various typo-squatting workspace names that contain the name of the company they are masquerading as. Good Luck and i'll update this if I have any more details. Note that I can confirm multiple companies that have been attacked this way.

A court-authorized international law enforcement operation led by the U.S. Justice Department disrupted a botnet used to commit cyber attacks, large-scale fraud, child exploitation, harassment, bomb threats, and export violations. As part of this operation, YunHe Wang, 35, a People’s Republic of China national and St. Kitts and Nevis citizen-by-investment, was arrested on May 24 on criminal charges arising from his deployment of malware and the creation and operation of a residential proxy service known as “911 S5.” According to an indictment unsealed on May 24, from 2014 through July 2022, Wang and others are alleged to have created and disseminated malware to compromise and amass a network of millions of residential Windows computers worldwide. These devices were associated with more than 19 million unique IP addresses, including 613,841 IP addresses located in the United States. Wang then generated millions of dollars by offering cybercriminals access to these infected IP addresses for a fee. Read more: https://lnkd.in/g_3UD9X3