Unveiling the Threat: Business Email Compromise Exploiting Perfect Data Software 

Understanding the Threat Landscape of Business Email Compromise

In recent incidents handled by NormCyber‘s Incident Response Team, the techniques employed by threat actors have been alarmingly consistent. Phishing emails serve as the initial vector, luring unsuspecting targets to divulge their Office 365 credentials. Armed with these credentials, and leveraging Perfect Data Software, threat actors infiltrate compromised accounts, using an email backup to siphon off sensitive mailbox contents. The repercussions are extreme, ranging from financial fraud to extortion, highlighting the urgency of addressing this threat. 

NormCyber has seen several such incidents where the threat actor has utilised ‘PERFECTDATA SOFTWARE’ and ‘Email Backup Wizard’ to exfiltrate mailbox data. 

Despite its seemingly benign façade, Perfect Data Software’s integration capabilities and broad access permissions make it a potent weapon in the hands of malicious actors.

Unveiling the Attack Vector

The attack vector employed by threat actors follows a well-defined sequence of events:

1. Phishing Email Delivery: Targets receive phishing emails, enticing them to divulge their Office 365 credentials.
2. Credential Harvesting: Target interacts with phishing email and is directed towards a phishing site which harvest O365 credentials, granting threat actors access to compromised accounts.
3. Perfect Data Software Integration: Threat actors utilise Perfect Data Software to obtain full mailbox access to the compromised O365 identity and exfiltrate mailbox data as a PST file.

Threat actors can access all mailboxes in the environment if the compromised O365 account has administrator rights, leveraging application impersonation rights.

Mitigating Business Email Compromise Threats

In light of this escalating threat, proactive measures are imperative to mitigate the risk of BEC incidents. NormCyber recommends:

• Continuous Monitoring: Leveraging Managed Detection and Response (MDR) services for vigilant monitoring and rapid incident response.
• Enhanced Authentication Controls: Reviewing and monitoring high-risk sign-ins to detect suspicious activity promptly.
• Granular Consent Management: Monitoring and restricting consent grants for applications, particularly those with elevated permissions.
• Enterprise App Registration Restrictions: Implementing controls to restrict users from registering enterprise apps within Office 365, mitigating the risk of unauthorised access.

Responding to the Threat

While there are some legitimate use cases for Perfect Data Software, our intelligence suggests that all instances of this application should be treated with caution. In the event of detecting this application within your environment, swift action is paramount:

• Engage Incident Response: Contact NormCyber‘s CSIRT for immediate support and initiation of investigation procedures.
• Application Disabling: Disable the application promptly to prevent further unauthorised access (don’t delete!)
• User Review and Disabling: Review and disable all users assigned to the application, considering them compromised entities.

Written by Ryan O’Leary

Ryan O’Leary is an Incident Response & Threat Hunting analyst who brings his expertise to NormCyber‘s Incident Response function, providing detailed analysis and forensic investigations helping our clients get back on their feet following a breach. Ryan brings his experience to the role from previously working within NormCyber‘s SOC.