71 lines
3.0 KiB
Markdown
71 lines
3.0 KiB
Markdown
# Phishing Investigation — "Past Due - AMU54618 - AMYSH Solutions"
|
|
|
|
- **Date (UTC):** 2026-07-15
|
|
- **Tenant:** cascadestucson.com (`207fa277-e9d8-4eb7-ada1-1064d2221498`)
|
|
- **Reported by:** Chris Knight (via Mike/Howard)
|
|
- **Investigated with:** ComputerGuru Security Investigator (Graph read + EXO read), read-only
|
|
|
|
## The message
|
|
|
|
| Field | Value |
|
|
|---|---|
|
|
| From | Dax Howard `<info@syufway.com>` |
|
|
| Reply-To | `dax.howard@steqm.com` (mismatch — classic BEC indicator) |
|
|
| To | `accounting@cascadestucson.com` (only recipient in tenant) |
|
|
| Subject | Past Due - AMU54618 - AMYSH Solutions |
|
|
| Delivered | 2026-07-14 17:32 UTC (10:32 AM AZ) |
|
|
| Internet-Message-Id | `<NSCCVAyTgUFD3cMIwaf4nl5G1cSc5xC4W4Cr1Rrk0c@localhost>` |
|
|
| Attachment | `W9_AMYSH_Solutions54618.pdf` (84 KB) |
|
|
|
|
Two delivery attempts ~10s apart:
|
|
1. **17:30:23 UTC — Quarantined** as **High Confidence Phish** (never released).
|
|
2. **17:30:34 UTC — Delivered** to the Inbox (second copy evaded the filter).
|
|
|
|
## Attachment analysis
|
|
|
|
The PDF is a filled **IRS W-9** for "AMYSH Solutions", EIN 92-4058031, 75 E Santa
|
|
Clara St, San Jose CA 95113, signed 04/11/2026. **No URLs, no QR code, no active
|
|
content.** This is a vendor-impersonation / BEC setup: get the target to onboard
|
|
a fake vendor and pay a fraudulent invoice. The email body claims to forward an
|
|
invoice from "Skylar Green, Billing Coordinator, AMYSH Solutions".
|
|
|
|
## Who opened it (MailItemsAccessed audit, delivered copy)
|
|
|
|
Mailbox delegates with FullAccess: ashley.jensen, lauren.hasselman,
|
|
zachary.nelson, Chris.Knight.
|
|
|
|
| Time (UTC) | User | Client |
|
|
|---|---|---|
|
|
| 2026-07-14 17:32:06 | ashley.jensen@cascadestucson.com | Outlook Android |
|
|
| 2026-07-14 17:33:30 | Chris.Knight@cascadestucson.com | Outlook desktop |
|
|
| 2026-07-14 18:16:43 | ashley.jensen@cascadestucson.com | Outlook Android |
|
|
| 2026-07-14 18:54:59 | Chris.Knight@cascadestucson.com | Outlook desktop |
|
|
|
|
## Did anyone respond / act on it?
|
|
|
|
- **No outbound mail** from the tenant to `info@syufway.com` or the reply-to
|
|
`dax.howard@steqm.com` (message trace 07-13 → 07-15). Nobody replied.
|
|
- No link/click risk — the PDF contains no links.
|
|
- Risk is limited to *future action*: paying the fake invoice or emailing the
|
|
reply-to address.
|
|
|
|
## Verdict
|
|
|
|
Confirmed phishing (vendor-fraud/BEC lure). Defender already classified the
|
|
first copy as High Confidence Phish. Opened by Ashley Jensen and Chris Knight;
|
|
no reply, no click, no payment action observed. **No compromise indicated.**
|
|
|
|
## Remediation performed (2026-07-15, approved by Howard)
|
|
|
|
1. [OK] Delivered copy moved to Deleted Items in the accounting mailbox
|
|
(recoverable if ever needed for evidence).
|
|
2. [OK] `syufway.com` and `steqm.com` added to the Tenant Allow/Block List
|
|
(Sender block, no expiration) — future mail from either domain is blocked.
|
|
3. Quarantined copy left in quarantine (High Confidence Phish, not released).
|
|
|
|
## Remaining advice for client
|
|
|
|
- Do not pay invoice AMU54618 or contact the sender.
|
|
- Any real vendor banking/W-9 changes get phone verification on a known-good
|
|
number.
|