Incidents

Attack path In the order it happened. Select a step to see its evidence.
Response actions Open the playbook
Timeline
    Activity log Everything people and the system did on this case
      Summary Written by the assistant
      Blast radius 4 people got the mail, 1 clicked Open in search
      PersonRoleLink
        Customer update Drafted by the assistant Not sent
        To
        Priya Natarajan, IT director, Brightwater Credit Union
        Subject
        INC-2291: please hold a $48,200 payment to Harborline Supply

        Priya,

        Dana Reyes's Microsoft 365 account was taken over at 13:42 today, after she signed in through a fake sign-in page. We ended the attacker's sessions at 14:44.

        Two things need you now:

        1. Hold the $48,200 payment. At 14:11 a reply went out from Dana's mailbox asking Harborline Supply to use new bank details. Please phone Harborline on a number you already have on file, not one from that email thread.
        2. Approve a password reset and MFA re-registration for Dana. Your policy asks for your approval for finance staff.

        We are removing a hidden inbox rule and a mail app the attacker added. You will hear from me again by 15:15.

        M. Castellan, Dual Path SOC

        By email and the portal