claudetools/clients/cascades-tucson/reports/2026-04-20-tenant-phishing-sweep-and-purge.md

# Cascades Tucson — Tenant-Wide Phishing Sweep and Purge

**Date:** 2026-04-20
**Tenant:** Cascades Tucson (cascadestucson.com, 207fa277-e9d8-4eb7-ada1-1064d2221498)
**Subject:** Tenant-wide (46 internal mailboxes)
**Tool:** Claude-MSP-Access / ComputerGuru - AI Remediation (App ID `fabb3421-8b34-484b-bc17-e46de9703418`)
**Scope:** Read-only sweep + explicit deletion action (authorized by Mike in chat, "a" = delete Groups A+B)
**Operator:** Mike Swanson (mike@azcomputerguru.com)

## Summary

- Triggered by John Trozzi reporting a spoof email at 12:23 UTC. Initial check on John (see `2026-04-20-john-trozzi-spoof-email-check.md`) found him clean and confirmed he was reporting, not compromised. Tenant-wide sweep expanded the investigation.
- **14 phishing messages** found across 7 mailboxes spanning 2026-03-21 through 2026-04-20 — a sustained ~1-month campaign from at least 4 distinct attacker IPs plus a compromised-M365-tenant relay.
- **14 / 14 messages deleted** (13 succeeded on first attempt; 1 retry for Lois Lane after she moved the message to Archive between scan and delete).
- **3 false positives** correctly excluded: the "HRPYDBRUNFOC…xlsx" thread is Ashley Jensen's legitimate internal HR export from 2026-03-09, with replies from JD Martin and Alyssa Brooks. Not phishing.
- **4 Sent Items items preserved as evidence** (user forwards to MSP).
- **Recommended blocks:** Ukraine (UA) region, 139.28.37.117 / 104.168.101.10 / 207.189.10.75 / 91.244.70.212 specific IPs, and `zoom.nl` domain in URL filters. **Publish DMARC p=reject for cascadestucson.com** to kill the domain-spoofing vector.

## Attacker origins (for regional blocking decisions)

Two distinct delivery patterns:

### Pattern 1 — External bulletproof/cheap hosting (April 2026)

| IP | Country | PTR / Hoster | Language header | Messages | Target(s) |
|---|---|---|---|---|---|
| **139.28.37.117** | UA | `139.28.37.117.deltahost-ptr` (Deltahost, Ukraine — bulletproof hosting) | `vi` (Vietnamese) / `en` | 2 | john.trozzi (4/20) |
| **104.168.101.10** | US | `104-168-101-10-host.colocrossing.com` (ColoCrossing NY) | **`th` (Thai)** | 3 | lois.lane (4/17), megan.hiatt (4/17 + 4/18) |
| **207.189.10.75** | DE | no reverse DNS (`InfoDomainNonexistent`) | `en` | 1 | dax.howard (4/17) |
| **91.244.70.212** | AT | (Austria, cheap hosting) | `en` | 1 | megan.hiatt (4/17) |

All 7 had **SPF=fail, DMARC=fail, DKIM=none**, envelope sender spoofed to recipient's own address. Microsoft let them through (`SFV:NSPM, SCL:1, compauth=pass reason=703`) because `cascadestucson.com` has `DMARC p=none` (observational, not enforcing). The `reason=703` specifically means "composite auth passed in the absence of an explicit DMARC reject policy" — i.e. a DMARC policy change to `p=quarantine` or `p=reject` would have blocked every one of these.

### Pattern 2 — Compromised M365 tenant relay (March 2026)

| IP (IPv6) | Source | Messages | Target(s) |
|---|---|---|---|
| `2a01:111:f403:c104::` / `:c103::3` / `:c100::f` / `:c110::1` / `:c10c::1` | Microsoft 365 Exchange Online datacenter (compromised customer tenant being used as a relay) | 6 | meredith.kuhn, anna.pitzlin, ann.dery |

SPF/DMARC **pass** because the compromised source tenant had valid SPF/DKIM. Only reliable signal was the content:
- Envelope `DocExchange_Noreply-m939k6d7.r.us_west_2.awstrack.me` (AWS SES click-tracking host masking the real sender)
- URL unwraps to `us02web.zoom.nl/j/81163775943?pwd=…` — **`zoom.nl` is NOT Zoom**. `.nl` is the Netherlands TLD. The real Zoom is `zoom.us`. Classic lookalike-domain redirect.
- Subject has `REF#<40-char-hex>` hash which is a fingerprint of this operator.

### Regional / TABL block recommendations

| Recommendation | Rationale |
|---|---|
| **Block UA** at Microsoft Defender for Office 365 country filter (if available in E3+) | Deltahost is persistent infrastructure, 2 confirmed phishes in one day |
| **Add 139.28.37.117, 104.168.101.10, 207.189.10.75, 91.244.70.212 to Exchange TABL IP Block List** | Exact IPs; cheaper than broad regional block; will stop retransmission from the same hosts |
| **Add `zoom.nl` and `awstrack.me` to Exchange URL/domain block list** | The compromised-tenant phishes use these for redirect; blocking kills that vector |
| **Publish DMARC `p=quarantine` or `p=reject` for cascadestucson.com** (highest-leverage change) | Would have blocked ALL 8 external-hosting phishes because they all spoofed the domain and failed SPF/DMARC |
| **Enable Microsoft Defender impersonation protection** for cascadestucson.com domain | Catches "cascadestucson" lookalike-domain attempts before they land |

The Thai-language header (`LANG:th`) on ColoCrossing, Vietnamese on Deltahost, and English on the DE/AT hosts suggest a **Southeast-Asia-based operator using geographically-distributed sending infrastructure**. Blocking any single region is only a partial defense; DMARC enforcement is the real fix.

## Scan methodology

1. Pulled all 53 Cascades tenant users via Graph `/v1.0/users`; filtered to 46 internal mailboxes (excluding `#EXT#` guests).
2. Three search passes with Graph `$search` + client-side filter:
   - Subject contains 32+ hex chars (attacker hash signature)
   - Subject contains "ATTN expire / Mailbox Expire / Service Termination / Password expire / Login Expire"
   - Subject contains "Pending Documents expires / Executed NDA Agreement / Approval Pending Review"
3. Paginated follow-up scans for John and Lois (initial $top=500 truncated their result sets).
4. For each hit: resolved folder name, fetched full `internetMessageHeaders`, extracted origin IP / country / language / SPF / DMARC / envelope-from, and pulled bodyPreview for content-based classification.

## Deletion inventory — 14 targets

### Group A — external-hosting phishing (8 messages, all DELETED)

| # | Mailbox | Folder (at scan) | Subject | Origin IP | Country | Result |
|---|---|---|---|---|---|---|
| 1 | dax.howard | Inbox | NSA: Cascadestucson Executed NDA Agreement Ref: 3a52d24c… | 207.189.10.75 | DE | DELETED 16:34:00Z |
| 2 | lois.lane | Inbox → Archive | ATTN : Mailbox Login Expire today, 4/17/2026 - 7578c86fe50e… | 104.168.101.10 | US | DELETED 16:34:32Z (retry) |
| 3 | john.trozzi | Inbox | ATTN!! — Pending 5 (Pages) Documents expires in 2 days REF, ID:f1bb60a2… | 139.28.37.117 | UA | DELETED 16:33:57Z |
| 4 | john.trozzi | Inbox | Action Required: Service Termination Alert – 32d38cbb… | 139.28.37.117 | UA | DELETED 16:33:59Z |
| 5 | megan.hiatt | Deleted Items | Re: HR Documents – Approval Pending Review Ref/ID#: 0f70944d… | 91.244.70.212 | AT | DELETED 16:33:52Z (purged) |
| 6 | megan.hiatt | Deleted Items | ATTN : Mailbox Login Expire today, 4/17/2026 - 123a5bc9ed53e… | 104.168.101.10 | US | DELETED 16:33:53Z (purged) |
| 7 | megan.hiatt | Deleted Items | ATTN : Mailbox Login Expire today, 4/18/2026 - fecac7931c86… | 104.168.101.10 | US | DELETED 16:33:51Z (purged) |
| 8 | megan.hiatt | Deleted Items | Undeliverable: FW: HR Documents (bounce of her fwd to info@azcomputeguru.com — typo) | — | — | DELETED 16:33:49Z (purged) |

### Group B — compromised-M365-tenant phishing (6 messages, all DELETED)

| # | Mailbox | Folder (at scan) | Subject | Envelope-From | Result |
|---|---|---|---|---|---|
| 9 | meredith.kuhn | Deleted Items | Document Ready for Review REF#99dab116… | DocExchange_Noreply…awstrack.me (→zoom.nl) | DELETED 16:33:45Z |
| 10 | meredith.kuhn | Deleted Items | Request for Quotation: Urban Choice Charter Project REF:3234627582… | lmccarthy@urbanchoicecharter.org | DELETED 16:33:46Z |
| 11 | anna.pitzlin | Inbox | Document Ready for Review REF#e8003bb2… | DocExchange_Noreply…awstrack.me | DELETED 16:33:55Z |
| 12 | anna.pitzlin | Inbox | Request for Quotation: Urban Choice Charter Project REF:3239883791… | lmccarthy@urbanchoicecharter.org | DELETED 16:33:56Z |
| 13 | ann.dery | Inbox | Document Ready for Review REF#ec4be8f2… | DocExchange_Noreply…awstrack.me | DELETED 16:34:02Z |
| 14 | ann.dery | Junk Email | Request for Quotation: Urban Choice Charter Project REF:953054e0… | lmccarthy@urbanchoicecharter.org | DELETED 16:34:03Z |

### Group C — false positives (EXCLUDED from deletion — NOT phishing)

The "HRPYDBRUNFOCb5b92c8c81854eb7afd33163c34118b7kktvrgsygrzrxvisedqvpsvfh55878.xlsx" thread is Ashley Jensen's legitimate 2026-03-09 employee roster export from an HR system that generates long hashed filenames. JD Martin replied to Ashley on 2026-03-10 and Alyssa Brooks replied on 2026-03-21 with payroll corrections. Internal HR correspondence.

- ashley.jensen / Inbox — JD Martin's "RE:" reply to her original
- jd.martin / Inbox — JD's own copy of Ashley's original (via CC or reply-all)
- alyssa.brooks / Sent Items — her "RE:" reply to ashley.jensen

### Group D — user outbound forwards (EXCLUDED from deletion — kept as evidence)

| Mailbox | Folder | Subject | To | Note |
|---|---|---|---|---|
| john.trozzi | Sent Items | Fw: ATTN!! — Pending 5 (Pages) Documents… | howard@azcomputerguru.com | John's forward to MSP, body: "Getting spoof emails this morning" |
| megan.hiatt | Sent Items | FW: HR Documents – Approval Pending Review… (17:37) | info@azcomputeguru.com (TYPO) | Megan's 1st forward attempt, bounced |
| megan.hiatt | Sent Items | FW: HR Documents – Approval Pending Review… (17:38) | info@azcomputerguru.com | Megan's 2nd forward, delivered |

These are evidence of user reporting; preserved per MSP workflow. Mike can purge later if desired.

## Deletion log

Full structured log at `/tmp/cascades_phishsweep/delete_log/2026-04-20T163343_deletions.jsonl`.

Summary: 14 success (13 on first try, 1 retry for Lois after user-move to Archive), 0 remaining failures.

## Next actions (prioritized)

1. **[HIGH] Publish DMARC `p=quarantine` for cascadestucson.com.** This is the single change that would block every external-spoofing phish. Start at `p=quarantine pct=25` to ease in, move to `p=reject` once you've watched reports for a week. Single-biggest leverage item.
2. **[HIGH] Add to Exchange TABL IP Block List:** `139.28.37.117`, `104.168.101.10`, `207.189.10.75`, `91.244.70.212`. Blocks re-use of the same infrastructure.
3. **[HIGH] Add URL/domain block:** `zoom.nl`, `*.awstrack.me`. Kills the compromised-tenant redirect vector.
4. **[MEDIUM] Talk to the 5 targeted users** (John, Lois, Dax, Megan, Meredith, Anna, Ann) — confirm none clicked or entered credentials. Pay extra attention to Megan (repeatedly targeted: 4 messages over 2 days) and John (targeted today with two variants one hour apart).
5. **[MEDIUM] Enable Defender anti-phish impersonation protection** for `cascadestucson.com` as a protected domain (if tenant has M365 Business Premium / E5 — verify SKU).
6. **[MEDIUM] Baseline sweep of the remaining 39 mailboxes not hit this time.** Only 7 of 46 users were targeted in this 30-day window; the operator may cycle through the rest next month.
7. **[LOW] Consider country-level mail filter for UA/AT inbound.** These have near-zero legitimate traffic to a Tucson senior-living facility. Only if DMARC enforcement isn't fast enough.
8. **Run again in 7 days** to verify no recurrence and to catch any variants that used subjects we didn't match.

## Data artifacts

All raw scan + deletion artifacts under `/tmp/cascades_phishsweep/`:
- `users.tsv` — list of 46 internal mailboxes scanned
- `junk_sweep.jsonl` — all signature-matched hits from all mailboxes
- `campaign_enriched2.jsonl` — final enriched list with folder + IP + country + auth for 20 matches (16 true phish + 4 false-positive HR thread)
- `campaign_final.json` — deduplicated 20 unique messages
- `headers/` — per-message JSON including full `internetMessageHeaders` for each match
- `targets.jsonl` — the 14 deletion targets
- `delete_log/2026-04-20T163343_deletions.jsonl` — structured log of all 14 DELETE calls, with HTTP codes and timestamps