Story time at work

Yesterday the most interesting thing happened at work, since the year i've worked there this has deffinitly tipped off the iceberg. The names in this post will be changed to random names for obvious reasons



To get this story started I have to explain that I work as an IT consultant, currently outsourced to support a team of 6 IT people in the biggest DIY company from belgium, the netherlands and luxembourg. Our team takes care of all the belgium stuff.
That's one of the reasons why I'm online so much, I'm just behind a pc and chill, the only time I have to work if there are major issues.


Ever since I started working with this team we have cleaned up all the problems meaning it's super relaxed here. This particulary day I started from 7AM meaning I only need to work till 3PM (8hours). Super chill morning, out of the team of 6, 2 are on vacation and 2 are sick so it's just me and another guy and then there is the boss who doesn't really help us anyway.


Day was going great, looked at the clock and was just about to hit 2PM meaning my day is almost over.
Then I get this call, some lady from accounting:
"Hi yea, our collegue Sarah Joe got a mail from a store but when she tries to open the file from the mail it doesn't seem to open."

Like I do with all small issues I just connect to her PC and am gonne try to find the problem. Quickly I notice that the mail is a dropbox invite, I ask them if they have ever used dropbox before as it's not really normal for anybody in this company to do so (we have big servers with shared drives).

"I've never gotten this before, but it could be usefull. Stores don't just send stuff over that isn't important you know."

While I hover my mouse over the logo of dropbox I notice that in the URL I don't see the word 'dropbox' anywhere, now I haven't used dropbox in forever but I was pritty certain that it should be in there.
Luckely for me, everyday before I go to work: I startup my home PC, start teamviewer up so that when I get to work I can chill here and do trades, work on my discord servers etc etc... I also have several personal virtual machines, so I start one up with a vpn, go on internet explorer to paste the URL from the mail from Sarah Joe..... As soon as the page loads I get sent to a login page for that requires me to login with either: outlook, gmail or just mail. The page also isn't for dropbox but for onedrive....

I instantly put my focus on Sarah:"Wait, did you login on this page?"
Sarah reacts super normal: "Yea ofcourse, I need to know what the store has sent me."

Panicking me I instantly go and lock her account but as I do so I hear my collegue next to me pick up the phone and say: "So you received a file from Sarah Joe but can't open it, mhmmm let me connect to your PC....."

Now in complete mahem mode I tell my collegue to yell at that person to not open the mail and to deffinitly not login via that URL. I glance at my own mailbox and see I have also received a mail from Sarah....

At this point anything could've happened, as this is the headquarters to a company with a yearly revenue up to 1.3 billion (2016-17).

Me still in complete panic mode runs thru the office looking for my boss, ofcourse his office has to be at the back so I have to run past all these people looking at me like I'm some weirdo. At his office... ofcourse it's empty, me running all the way back because most likely he is at the meeting room on the otherside of the building... After having run past nearly everybody on the bottom floor I see him.

Instantly I start to explain what's happening and that I need him to shut down our complete mailing network as this is not just going everybody who works for this company, but also everybody who has every mailed to us and who has ever been mailed this includes technicians & suppliers.

The next hour consists out of calling the top hierarchie of the company, CEO's to store managers from up to the regular people who work inside the store while constantly still getting people to call in:"I got this mail with a dropbox link but it won't download..."


Everything went super fast, within the first minute that Sarah Joe had opened the first mail about 10 others had done the same and logged into the phishing link.
Thank god no info was stolen and all that happened was every single person that has ever been in contact with the company over mail has probably gotten this mail.

At the end of the day in the evening we also backtracked from where the mail came, possibly a throwaway mailbox but we still thought it would be funny to send over 10.000 mails back to that specific mail adres as a thank you for the wonderfull afternoon we had at the office.


This shows how fast you could lose anything if you click on the wrong link and just give away your info.
I can vouch now that if you ever work in a company where this happens to NOT call your IT team and ask if he/she could quickly come upstairs because a printer isn't working

 

So how much did you make from spreading that phishing link

 

i've started to blackmail this bitch Sarah that I'll tell her about her porn stash if she doesn't get me coffee every morning

 

Next time I come back on this thread I expect nothing less than a tldr

 

It's worth the read mate

 

+1