SC-009: Cloud Account Takeover → Data Exfiltration¶

Threat Actor Profile¶

COBALT INVOICE is a financially motivated eCrime group operating since 2021, specializing in Business Email Compromise (BEC) fraud escalated through cloud tenant compromise. Unlike traditional BEC actors, COBALT INVOICE weaponizes stolen O365 session cookies to bypass MFA, then pivots to cloud infrastructure found in corporate SharePoint — dramatically amplifying the financial and data-loss impact of each intrusion.

The group targets mid-market enterprises ($100M–$2B revenue) in finance, professional services, and manufacturing, where wire transfer authority exists but security controls lag larger enterprises. Their average intrusion-to-fraud timeline is under 72 hours. Known use of residential proxy networks and commercial AiTM phishing kits (EvilProxy variants).

Motivation: Financial — wire fraud ($500K–$5M per incident), data theft for secondary extortion, cryptocurrency laundering.

Scenario Narrative¶

Phase 1 — Initial Access via AiTM Phishing (~20 min)¶

COBALT INVOICE sends a targeted spearphishing email to Sarah Chen, Finance Manager, impersonating a DocuSign notification for a pending vendor contract. The link routes through an Adversary-in-the-Middle (AiTM) reverse proxy (docusign-review[.]sharepoint-auth[.]com, registered 4 days prior). Sarah enters her O365 credentials; the proxy forwards them in real time to Microsoft, captures the resulting session cookie, and relays the authenticated response back to Sarah — who sees a normal SharePoint document. No MFA prompt fires because the cookie represents an already-authenticated session.

Within 6 minutes, the attacker logs in from a residential proxy exit node in Amsterdam using Sarah's stolen session cookie.

Evidence Artifacts:

Phase 2 — OAuth Persistence & Mail Collection (~30 min)¶

With active session access, the attacker registers a new OAuth 2.0 application named "Analytics Helper Pro" in Contoso's Entra ID tenant using Sarah's credentials. The app is granted Mail.Read, Files.Read.All, and offline_access permissions (no admin consent required for these scopes under the existing tenant policy). This grants persistent token-based access that survives a password reset.

The attacker creates an Outlook inbox rule: forward all email containing keywords invoice, wire, payment, transfer, bank to analytics-helper@protonmail.com. Over the next 6 hours, 847 emails are forwarded — including pending wire transfer approvals, vendor banking details, and an upcoming $2.3M accounts payable batch.

The attacker also accesses SharePoint, searching for finance documents, and downloads 14 files totalling 380MB — including the corporate org chart, CFO's email signature, and Q1 payment schedule.

Evidence Artifacts:

Phase 3 — AWS Pivot via Exposed Credentials (~40 min)¶

Among the SharePoint downloads, the attacker finds dev-setup-notes.docx uploaded by a developer, containing AWS IAM credentials for a service account: AKIA... (Access Key ID) and the secret — stored in plain text. These credentials belong to the app-deploy IAM user with PowerUserAccess policy.

The attacker calls the AWS EC2 Instance Metadata Service (IMDS v1) endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/) from a compromised EC2 instance, retrieves a temporary role credential with broader permissions, and uses it to list all S3 buckets. One bucket, contoso-customer-data-prod, contains 847GB of customer PII. The attacker uses aws s3 sync to exfiltrate 100GB to an attacker-controlled S3 bucket in a different region (us-east-1 → eu-west-3).

Total exfiltration time: 22 minutes. CloudTrail logged all API calls but no alert fired — the app-deploy user legitimately calls S3 regularly.

Evidence Artifacts:

Phase 4 — BEC Wire Fraud & Cleanup (~30 min)¶

Using the forwarded emails from Phase 2, the attacker now has full context on a pending $2.3M accounts payable wire transfer to Apex Engineering Ltd. The attacker composes an email from Sarah's compromised mailbox (via the OAuth app) to the CFO, Jake Morrison, impersonating the CFO's own approval workflow — "I'm out of office, please use the updated banking details for Apex." The email includes the real vendor name, correct invoice number, and a fraudulent bank account for an IBAN in Lithuania.

CFO Jake Morrison approves the transfer. Finance executes it at 09:14 UTC.

At 10:02 UTC, the real Apex Engineering calls to enquire about a missed payment. The fraud is discovered. The attacker has already deleted the inbox forwarding rule and revoked the OAuth app consent via Sarah's session — but forgot to clear the Entra ID audit log entry for the app registration.

Evidence Artifacts:

Detection Opportunities¶

Key Discussion Questions¶

1. Your Conditional Access policy allows unmanaged personal devices to access O365 with MFA. How does AiTM bypass this, and what policy change closes the gap?
2. The developer stored AWS credentials in SharePoint. What secrets management solution would prevent this, and how would you audit for existing exposed secrets in your M365 tenant?
3. 847 emails were forwarded before the rule was discovered. Under GDPR Article 33, when did your 72-hour notification clock start?
4. The wire transfer was approved by the CFO based on a single email. What dual-control or out-of-band verification process would have prevented this?
5. GuardDuty did not alert on the mass S3 download because app-deploy had a trusted baseline. What detective control would you add to catch anomalous-volume access from trusted identities?

Debrief Guide¶

What Went Well¶

• Entra ID captured the anomalous sign-in — the data was there; the gap was triage prioritization
• CloudTrail preserved complete API activity — forensic reconstruction was possible

Key Learning Points¶

• AiTM bypasses MFA — Entra ID's token-binding and Conditional Access device compliance requirements are the countermeasure, not MFA alone
• OAuth apps survive password resets — incident response checklists must explicitly include OAuth app audit and token revocation
• IMDSv1 is a known-dangerous default — every AWS account should audit for this proactively
• BEC is the most expensive cyber crime category — wire fraud is enabled by email access, not technical sophistication

Recommended Follow-Up¶

• [ ] Enable Microsoft Entra ID Identity Protection — block High-risk sign-ins automatically
• [ ] Deploy Conditional Access: require compliant/managed devices for all O365 access
• [ ] Implement tenant-wide OAuth app consent policy: require admin approval for all third-party apps
• [ ] Enforce IMDSv2 across all EC2 instances via SCP or AWS Config rule
• [ ] Implement wire transfer dual-control: all transfers >$50K require phone verification to registered number
• [ ] Deploy DLP policy to flag AWS credential patterns in SharePoint/OneDrive uploads
• [ ] Run purple team exercise simulating AiTM phishing against your tenant

References¶

• Chapter 20: Cloud Attack & Defense
• Chapter 6: Triage & Investigation
• Chapter 9: Incident Response Lifecycle
• Chapter 7: Threat Intelligence & Context