Rapid Breach Response & Security Remediation for a Financial Startup
Background & Challenge
A small but fast-growing financial services startup experienced a Business Email Compromise (BEC) when a cybercriminal gained access to a key shared mailbox used for customer service and invoicing. Fraudulent emails were being sent to clients containing altered payment details — putting both the company’s reputation and client trust at risk.
Initially, the client believed the issue had been resolved by their independent IT consultant, but new reports from clients flagged further suspicious emails. In a state of panic, they reached out to Astec.
Initial Response
- Rapid Engagement: Within minutes of contact, we signed an NDA, gained secure access to the environment, and began investigating.
- Immediate Containment: We signed the affected mailbox out of all active sessions and reset the password. We then verified MFA was in place, only to learn that it had been bypassed using push notifications.
- Confirmed Breach Activity: We found emails actively being sent from international IPs based in Asia — confirming the intruder still had access, even on the day of our engagement. Signing the mailbox out of all active sessions immediately blocked the attacker’s access and prevented any further outbound emails.
Root Cause Analysis
We took a structured approach to understand how the breach occurred:
- User Behaviour Review: We spoke with the user managing the mailbox, who recalled clicking a document link that appeared to come from Microsoft.
- Threat Payload Analysis: We traced the email and found it linked to a Canva-hosted page. While Canva is a legitimate service and would not typically be flagged by anti-spam filters, the link contained a redirect to a fake Microsoft login page designed to harvest credentials.
- MFA Weakness: Shortly after entering credentials, the user received an MFA prompt and approved it — unknowingly granting the attacker full access.
- Inbox Rule Manipulation: Hidden inbox rules had been set up to hide sent items and replies, ensuring the user remained unaware of the attacker’s activity.
Containment & Clean-Up
- Account Secured: All malicious inbox rules were identified and removed.
- Threat Access Revoked: We confirmed all suspicious IP sessions were terminated and no persistence remained.
- User Awareness: We explained what had occurred and coached the client on how the breach happened in plain, non-technical terms.
- Confidence Restored: Astec advised the client to proactively reach out to impacted customers to explain the situation and confirm secure communication channels moving forward.
Recommendations & Long-Term Protection
With the immediate threat handled, we presented clear, business-aligned security recommendations:
- Online Security Awareness Training (SAT): Regular web-based training sessions with phishing simulations to educate staff on real-world threats and risky behaviours.
- MFA Hardening: Changed default MFA method from push notifications to number matching to reduce accidental approvals.
- Advanced DNS Filtering: Implemented content filtering to block malicious domains and prevent access to suspicious sites.
- Anti-Spam Replacement: Recommended and implemented a more advanced anti-spam platform to better detect obfuscated links and uncommon threat delivery methods.
All recommendations were accepted and implemented without delay.
Outcome
- Threat Contained Within Hours: The breach was neutralised quickly and without disruption to core operations.
- Same-Day Root Cause Analysis: A full RCA was completed the same day we were engaged, giving leadership immediate clarity.
- Enhanced Security Posture: A more robust IT security framework was put in place, significantly reducing the risk of future incidents.
- Trust Rebuilt: The client was able to take swift, transparent action with their own customers, maintaining confidence and avoiding financial loss.
- Fully Outsourced IT Partner: Impressed by the speed, clarity, and quality of support, the client made the decision to fully outsource their IT services to Astec.
“We called Astec in a panic. Within minutes they were in, had everything under control, and gave us clear answers. We’ve never looked back.”
