> JapanHacked_
[Resolved][Severity: Major][Malware][Phishing]

Life: malware on an office PC leaks mail history and sends spoofed mails

At Life, an advertising agency in eastern Shizuoka, an office PC was infected and its mail history leaked, feeding spoofed mails to contacts.

Disclosed

2020-01-20

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. In the evening the company received a spoofed mail quoting its own past mail; checking it, staff found an office PC infected with malware (VBA/Trojan Downloader.Agent). [1] [2]

  2. Public disclosure. [1]

Impact

Part of the PC's mail history leaked, and spoofed mails in the name of the company and its departments went to the addresses in it. [1] [2]

Response

The infected PC was wiped, the mail accounts on the abused domain were retired and a new domain was taken. [2]

Timeline

  1. Disclosed 2020-01-20
  2. 1 days

Attack or cause

Method
[Malware][Phishing]
Impact
[Data leak]
Entry point
E-mail

Data exposed or at risk

[Name][E-mail address]

Organizations involved

Open in organization search

Sources

  1. [1][News]社内パソコンがウイルス感染、メール送受信履歴に含まれるアドレスへなりすましメールを送付（ライフ）ScanNetSecurity · 2020-01-29 08:00
  2. [2][News]マルウェア感染でなりすましメールが送信 - 広告代理店Security NEXT · 2020-02-04