QR-Code Phishing at Northline Freight
Northline Freight is a 1,400-employee logistics company running Microsoft 365 with Proofpoint email filtering and a managed EDR. On a Tuesday, an accounts-payable clerk received an email supposedly from a carrier containing a QR code and no links or attachments. She scanned it with her personal phone, landed on a lookalike Microsoft login page, and entered her credentials plus an MFA push she approved. Eleven days later the SOC saw an EDR alert for rclone.exe on her workstation writing to a Mega.nz endpoint, and Treasury stopped a $240,000 wire change. Investigation found a hidden inbox rule moving invoice replies to RSS Feeds, a new device registered from a Netherlands IP, and three other employees who received the same QR email. The SOC has two analysts, business hours only, and no mailbox-audit alerting. Leadership wants to know whether this is an isolated phish or a targeted campaign.
1. Characterize the threat actor and state which facts support a business email compromise operation versus a ransomware affiliate, and what evidence would change your assessment.
Read the worked answer
The pattern fits business email compromise rather than encryption-driven ransomware. Supporting BEC: the actor spent 11 days in the mailbox, created a concealment rule, and pursued a wire change; rclone pulled data from a single user context, consistent with mailbox and document theft for fraud support. Supporting a ransomware affiliate: hands-on-keyboard tooling, cloud exfiltration, and a newly registered device can all be precursor behavior before encryption. Evidence that would flip the assessment: discovery of Cobalt Strike or credential-dumping tooling on the workstation, lateral SMB or RDP connections to servers, or archived staging directories across multiple hosts. One rclone run from one user is thin for pre-ransomware staging, which usually touches many hosts over days. Attribution to a named group is not needed to act; the actor's objective drives containment. Here the objective is fraudulent payment and data theft, so the priority is revoking the identity, removing persistence, and preserving mailbox audit and sign-in logs. Do not close this as 'one phish': three other recipients got the same message, so campaign scope is still unknown.
2. List the first five containment and preservation actions, in order, and justify why each comes before the next.
Read the worked answer
Revoke refresh tokens and sessions, disable the account, then reset the password. Reason: a stolen token survives a password reset, so revocation must precede everything else or the attacker keeps access while you work.
Remove the inbox rule and check for forwarding, delegation, and added OAuth grants. Reason: the rule hides replies and may still be diverting invoices; it also tells you what the actor was reading.
Network-contain the workstation through EDR rather than powering it off. Reason: containment stops egress while preserving memory and process artifacts that explain how
rclonewas launched.Block the Mega.nz destination and the lookalike domain at proxy and DNS, and hunt all endpoints for the same
rclonecommand line and parent process. Reason: the other three recipients may already have executed the same chain.Freeze the wire change with Treasury and open a case record with sign-in, audit, and EDR telemetry. Reason: financial recovery has a short window, and evidence must be captured before log retention ages out.
The ordering principle is identity first, concealment second, then host containment, estate-wide hunting, and finally business and evidence actions.
3. The CISO asks what single detection gap this incident exposed and what control would have caught it earliest. Explain your choice and its limits.
Read the worked answer
The gap is that email defenses which rewrite and detonate URLs are blind to QR codes, and nothing alerted on the identity side when a finance user registered a new device and signed in from a new country. The earliest catching control is a conditional access policy that requires a compliant, managed device or token protection for finance roles, backed by an alert on new device registration plus impossible-travel sign-in and mailbox rule creation. This would have blocked the session at authentication, before the attacker ever read mail, because the personal phone cannot satisfy device compliance. Its limits matter: enforcement can lock out legitimate travelers and contractors, so pilot it on a finance group with a break-glass exception; device compliance depends on Intune enrollment being healthy; and the alert only fires if mailbox auditing is on and forwarded to the SIEM. User training alone is not a control here, since the lure had no link for the filter to inspect and arrived on a personal device outside corporate inspection.