# Session Log — 2026-06-09 — Kittle BEC/ACH Fraud Investigation + IC3 Filing (and fleet Exchange-role fix)

## User
- **User:** Mike Swanson (mike)
- **Machine:** GURU-5070
- **Role:** admin

## Session Summary

This session spanned several threads but culminated in a major incident: the discovery and full
documentation of an **active ACH payment-redirection fraud** inside the 2026-06-08 Kittle Design &
Construction BEC. The session opened on ClaudeTools harness work (P1 completion: skill-description
trims, `/save` `/sync` thinning, `session-logs/YYYY-MM/` convention, `now-phoenix.sh`, harness 1.4.x,
plus a guard false-positive test matrix and a `/self-check` `harness`+`consistency` category), then a
Safe Site M365 + multi-RMM inventory investigation (parked), then pivoted to Kittle.

The pivotal enabler was a **fleet-wide fix for a recurring Exchange-role gap**: app-only EXO management
(Search-UnifiedAuditLog, Get-MessageTrace, inbox rules) requires the **Exchange Operator SP**
(`b43e7342-...`) to hold the Entra **Exchange Administrator** directory role, which admin-consent never
grants. Built `assign-exchange-role.sh` (idempotent, via the authoritative
`roleManagement/directory/roleAssignments` API — the legacy `directoryRoles/members` reads back
unreliably) and **backfilled the whole fleet: 13 tenants were silently broken and got fixed**, 12
already OK, 20 skipped (tenant-admin not consented), 0 errors. This unblocked EXO forensics on
kittlearizona.com (which already had the role).

With EXO working, the Kittle investigation escalated sharply. The original 2026-06-08 remediation had
treated the incident as a credential-phishing blast (1,000 phishing emails) and missed the real
objective. Audit-log + message-trace analysis revealed the attacker used Ken Schagel's standing
delegate (FullAccess) permission to the Accounting mailbox to **operate the finance mailbox**: from IP
64.44.131.168 they read customer/employee/finance folders (21 MailItemsAccessed events), then **sent
fraudulent "EFT UPDATE"/ACH bank-change emails (SendOnBehalf of Accounting@) to the City of Tucson** to
redirect Kittle's payments, then **hard-deleted the entire thread** to conceal it. Recovered the deleted
emails + the fraudulent `BSD ACH APPLICATION.pdf` from the M365 Recoverable Items dumpster via Graph,
extracting the attacker's mule bank accounts. Confirmed a multi-stage scheme using lookalike
infrastructure (`Accounting.kittlearizona@gmx.com`, `tucsonoz.com`).

Assembled a complete **FBI IC3 complaint package** (report PDF, 3 bank freeze letters, 2 ACH form PDFs,
171-event audit CSV, recovered emails, resolution confirmation), generated PDFs by installing
`markdown`+`xhtml2pdf`, and walked Mike through filing the IC3 complaint (**Submission ID
`aa2ef50482ca4c05a54ae0f6cb56ffa0`**, filed 2026-06-09 12:46 PM EST). Outcome: **the City of Tucson
stopped the payment before any transfer — $0 actual loss** (attempted $130k+); Kittle confirmed no Foam
Factory relationship. Also: posted public+emailed Syncro ticket updates, reset Ken's password, removed
his outbound-spam send restriction, created Ken as a Syncro contact, and researched bank fraud/BSA
contacts.

## Key Decisions

- **Exchange-role gap fixed via backfill + standing audit, not another empty promise.** Root cause: the
  Exchange Operator SP missing the Exchange Admin directory role; onboarding assigns it but
  pre-existing/manually-consented tenants never got it and nothing audited for it. Built the idempotent
  tool + ran `--all`. Saved `feedback_exchange_role_recurring_gap.md` so future sessions stop saying
  "next onboarding will fix it" (structurally false for already-onboarded tenants).
- **Used the authoritative `roleManagement/directory/roleAssignments` API** for role checks/writes — the
  legacy `directoryRoles/{id}/members` list reads back unreliably (replication lag falsely showed Safe
  Site/kittle unassigned right after a successful write).
- **Refined `harness-guard.sh` conflict rule to require a real hunk** (both `^<<<<<<< ` AND `^>>>>>>> `)
  instead of also firing on a lone `=======` — a markdown-underline false-positive vector. Built a
  12-case test matrix; FP surface now 0.
- **GrepAI demoted below the wiki** across CORE/EXTENDED/standard/guidelines — resolved the "GrepAI first"
  vs "wiki first" contradiction; GrepAI scoped to code/discovery.
- **Forensic scan pattern fix:** initial `*SSUS*` matched the company abbreviation (2,271 false hits);
  changed to the specific `06122026` date token.
- **IC3 first in the reporting order** — it generates the reference # the bank letters cite and routes to
  the FBI Recovery Asset Team (the actual lever on receiving banks).
- **Ken's password reset JIT cleanup must be done manually** — `reset-password.sh` grants the Tenant
  Admin SP Privileged Authentication Administrator to reset an admin target, but Microsoft blocks an SP
  from removing its OWN privileged role, so the cleanup always fails (script bug). Mike must remove it in
  the Entra portal.
- **Syncro ticket emails route to the customer DEFAULT address** (ken@), not contacts; the `contact_id`
  PUT is silently ignored by the API. Accepted emailing ken@ once his account was secured.

## Problems Encountered

- **Legacy directory-role member endpoints unreliable** (read-back lag + self-removal block) — switched
  to `roleManagement/directory/roleAssignments`; JIT PAA removal left to manual portal action.
- **Windows-native python can't read MSYS `/c/`,`/tmp` paths** and `/tmp` clears between Bash calls —
  used `cygpath -m` and kept intermediates in cwd / single invocations.
- **Recoverable-items message IDs are folder-scoped** — fetching attachment bodies via top-level
  `/messages/{id}` 404'd; used `/mailFolders/recoverableitemsdeletions/messages/{id}/...`.
- **No MD→PDF tool installed** — Mike granted module-install; used pure-python `markdown`+`xhtml2pdf`.
- **`Get-BlockedSenderAddress` removal lag** — Ken showed still-restricted immediately after
  `Remove-BlockedSenderAddress`; cleared on re-check (EOP propagation), did not re-issue.
- **Notepad didn't launch** from `cmd /c start` — used `Start-Process` with the Notepad++ path instead.
- **Syncro emailed ken@ not admin@** — API won't set ticket contact; documented, proceeded.

## Configuration Changes

Created/modified (committed):
- `.claude/skills/remediation-tool/scripts/assign-exchange-role.sh` (NEW) — fleet Exchange-Admin role backfill/audit.
- `.claude/skills/remediation-tool/references/tenants.md` — Safe Site + kittlearizona marked onboarded/verified; Exchange-role backfill note.
- `.claude/memory/feedback_exchange_role_recurring_gap.md` (NEW) + MEMORY.md index line.
- `.claude/scripts/now-phoenix.sh`, `.claude/scripts/test-harness-guard.sh` (NEW); `.claude/scripts/harness-guard.sh` (pair-required conflict rule).
- `.claude/skills/self-check/scripts/self-check.sh` + `baseline/manifest.json` + `SKILL.md` (harness + consistency + guard-selftest checks).
- `.claude/CLAUDE_EXTENDED.md`, `.claude/CODING_GUIDELINES.md`, `.claude/standards/context-lookup/grepai-first.md` (GrepAI wiki-first).
- `.claude/commands/save.md` `sync.md`; 8 skill SKILL.md description trims; `.claude/harness/VERSION` (→1.4.3) + CHANGELOG.
- `wiki/clients/safesite.md` (NEW).
- `clients/kittle/reports/2026-06-09-ic3-bec-fraud-report.md` (NEW; updated with amounts, resolution, IC3 #).
- `specs/claudetools-harness-optimization/plan.md` (status).

Not in repo (local evidence package): `C:\Users\guru\Downloads\Kittle-IC3-Package\` — report PDF+MD, BANK-FRAUD-NOTIFICATIONS PDF+MD, FRAUD_BSD_ACH_APPLICATION.pdf, EVIDENCE_2nd_ACH_FoamFactory.pdf, attacker-audit-events.csv, recovered-fraud-emails.txt, resolution-confirmation.txt, IC3-fill-sheet.txt.

Tenant changes (M365): kittlearizona Exchange Operator SP granted Exchange Admin role (and 13 other tenants); Ken@kittlearizona password reset; Ken removed from restricted-senders. **Tenant Admin SP still holds Privileged Authentication Administrator on kittlearizona — MUST remove in Entra portal.**

## Credentials & Secrets

- Ken Schagel M365 password reset to `LucyRed1903!` (no forced change) — NOW SUPERSEDED: Mike changed it in person on-site 2026-06-09. The `LucyRed1903!` value is stale/invalid.
- No new vault entries this session. EXO/Graph access via existing remediation-tool app suite (per-tenant tokens via get-token.sh; pass `VAULT_ROOT_ENV=D:/vault` since ~/.claude/identity.json lacks vault_path on GURU-5070).

## Infrastructure & Servers

- **Kittle tenant:** kittlearizona.com — tenant `3d073ebe-806a-4a5e-9035-3c7c4a264fc0`. Compromised: Ken@, Accounting@ (Darline Cabrera bookkeeper, impersonated). O365 E3 (no Entra P1).
- **Attacker IPs:** 64.44.131.168 (Chicago, AS20278 Nexeon Technologies — OWA + fraud sends + deletions), 45.134.224.220 (Kansas City, AS147049 PacketHub — phishing send), 40.126.41.96 (Azure — contact harvest via python-httpx/0.28.1, OAuth app d3590ed6-52b3-4102-aeff-aad2292ab01c).
- **Attacker infra:** Accounting.kittlearizona@gmx.com; tucsonoz.com (lookalike of tucsonaz.gov); phone (659) 221-9243.
- **Fraudulent mule accounts:** Truist rt 053201607 acct 1410020505238 (submitted to City under Kittle's name); FOAM FACTORY INC at First State Bank of East Detroit rt 072410165 acct 62100616, and JPMorgan Chase rt 021000021 (ACH 072000326) acct 2906183268 SWIFT CHASUS33.
- **Targeted payer:** City of Tucson BSD/AP — Randi Arnett (Finance Mgr, Randi.Arnett@tucsonaz.gov), HCDAccountsPayable-Finance@tucsonaz.gov. Invoices #31468 ($123,776.75), #31400 (~$8,818), #31453 ($41,231).
- App SP IDs: Exchange Operator b43e7342-5b4b-492f-890f-bb5a4f7f40e9; Tenant Admin 709e6eed-0711-4875-9c44-2d3518c47063 (objectId in kittle 0caa0dde-3f8d-4d46-ab26-aa0d38add0b5).

## Commands & Outputs

- `assign-exchange-role.sh --all` → 13 ASSIGNED / 12 OK / 20 SKIP / 0 ERROR.
- Role assignment via `POST roleManagement/directory/roleAssignments {principalId, roleDefinitionId:29232cdf-9323-42fd-ade2-1d097af3e4de, directoryScopeId:/}`.
- EXO unblock for kittle took ~15-20 min to propagate (Get-OrganizationConfig 403→200).
- Recovered fraud form bank details via `pdftotext -layout` on FRAUD_BSD_ACH_APPLICATION.pdf.
- PDF gen: `pip install markdown xhtml2pdf`; `xhtml2pdf.pisa.CreatePDF(html, dest)`.
- `Remove-BlockedSenderAddress -SenderAddress ken@kittlearizona.com` then `Get-BlockedSenderAddress` → clean (after lag).

## Pending / Incomplete Tasks

- **Kittle:** Send bank freeze letters (Truist business-fraud — Mike on phone; First State Bank fraud 866-372-1275 / main 586-775-5000; Chase Global Bank Recoveries 866-954-3718 opt 4 / gb.fraud.recovery@jpmorgan.com). Draft City of Tucson written follow-up (offered, not done). Remove Privileged Authentication Administrator from Tenant Admin SP in kittle Entra portal. Confirm exact City invoice $ and EIN 86-0942406. Christina Micek rule on Ken + Ken FullAccess to Accounting (pre-existing, Ken to confirm). Lori GA downscope.
- **Safe Site (parked):** corrected SSUS-06122026 endpoint scans queued on 7 agented recipients (run on GuruRMM reconnect); recall-proof in Downloads/safesite-recall-proof.json; coord todo f1c11d0d (mechanism follow-up). Unknown site LIGHT-CLOUD-3585. GuruRMM Intune-push blocked (DeviceManagementScripts.ReadWrite.All scope missing) + redundant with SC.
- **Harness:** promote guard to FATAL after clean warn window (coord todo, ~2026-06-22). `reset-password.sh` JIT self-removal bug to fix.

## Reference Information

- **FBI IC3 Submission ID: `aa2ef50482ca4c05a54ae0f6cb56ffa0`** (filed 2026-06-09 12:46 PM EST).
- Syncro Kittle ticket #32393 (id 112381882) — public+emailed fraud-alert, status update, IC3-filed comments. Ken contact id 4509381 (cell 520-310-1525). Kimberly Ross admin@ contact 4373248.
- Kittle: Ken Schagel, Owner, 2539 N Balboa Ave #125, Tucson AZ 85705, ken@kittlearizona.com, (520) 299-0404. ACG: Mike Swanson, admin@azcomputerguru.com, (520) 304-8300.
- Bank fraud: Truist 844-487-8478 / Enterprise Fraud Mgmt 1-866-802-4955; First State Bank (MI, fsb.bank) 586-775-5000 / fraud 866-372-1275; Chase Global Bank Recoveries 866-954-3718 opt 4, gb.fraud.recovery@jpmorgan.com.
- Commits: e180a463/512ceb47 (guard matrix), 7fc29a7c (exchange-role fix), 5a5e0c4c (kittle EXO verify), c5a7c15c/42135ed5/4c580fe4/53584e14 (IC3 report iterations).
- Package: `C:\Users\guru\Downloads\Kittle-IC3-Package\`.
