いつもの相手から届いたメール
そのメールは、知らない誰かから届いたものではなかった。 サイバー犯罪: 日常に侵入する悪意 第 1 回 狙われるのは、特別な誰かではない。 いつもの日常に、見えない侵入口がある。公開されている情報を手がかりに、その静かな進行と、日常に現れる結果をたどります。 いつもの相手から その日の朝、イチカはいつものように会社のメールを確認していた。 小さな会社の事務担当。請求書の処理、取引先との連絡、社内のちょっとした調整。特別な仕事ではないけれど、彼女がいなければ回らない仕事がいくつもある。 届いていたメールの中に、取引先の担当者からのものがあった。 件名は「共有ファイルを更新しました」。 本文には、更新したファイルを確認してほしいという短い案内と、リンクがひとつ。 その担当者とは、もう何年も仕事をしている。請求書の確認や納期の相談で、何度もメールを交わしてきた相手だ。 イチカはリンクを開いた。…
The email arrived from someone familiar to Ichika. It wasn't from an unknown party. Cybercrime: malicious intent invades the daily. There's always an unseen entry point in the usual routine. With the evidence of publicly available information, the quiet progression and daily consequences are traced. On the first morning of that day, Ichika was checking her company's emails as usual.
As the small company's administrative assistant, she handled invoicing, communication with clients, and minor adjustments within the office. There was nothing exceptional about her work, but there were many tasks that couldn't be done without her. Among the emails received was one from a supplier. The subject line read "Updated shared file."
Attached was a brief instruction to check the updated file and a link. She clicked the link, which displayed the login screen of the cloud service she regularly used. It seemed to be a login screen, at least for now. She assumed it was out of date, entered her company email and password, but the screen did not display properly. "Is the system acting up again?"
Ichika thought, and moved on to another task. At that moment, she didn't feel anything was amiss. A few days later, a phone call came from the supplier. They said they had received an email from Ichika, requesting confirmation of a shared file. Ichika had no memory of sending such an email. However, the email management screen showed a list of emails she had sent, with an unfamiliar signature.
The system administrator was consulted, and it was revealed that someone had unauthorized access to Ichika's email account. Past emails were also accessed, containing email addresses of clients and business dealings. From Ichika's account, over 1,000 phishing emails had been sent out, both internally and externally. The sender was Ichika herself, with a valid email address.
It appeared the recipients were treated as if they were getting emails from someone she knew, as it looked like an ordinary email from someone familiar. Ichika's email account had been compromised. The company changed the password for her account, notified those who might have been affected of the possible data leakage, and considered implementing multi-factor authentication.
However, the issue went beyond that. Ichika's email box contained past communications with clients. From those, the attackers obtained email addresses, which they used to send phishing emails. The method of using a legitimate account to launch an attack is referred to as "lateral phishing" by the Information Processing Promotion Agency (IPA).
This incident is an actual case reported to IPA in the first half of 2020. The attackers used the compromised email account to send phishing emails to more than 1,000 recipients, including both inside and outside the organization. The attackers obtained customers' and suppliers' email addresses from past emails. Unlike a simple impersonation, it was difficult for recipients to suspect the source.
The article reconstructs this incident, based on actual incident reports submitted to IPA, using fictional company and character settings.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
