One incident happened where a user in my company complained that phishing emails were being sent from her O365 account. When I analyzed the PCAP, I noticed a connection established using STUN. It seems the intruder may have sent a link, and the user clicked on it, allowing the attacker to obtain her public IP address and port information. Upon further investigation, we discovered a VBS script placed in the user’s public folder, which was automatically sending phishing emails to all users in the company. We deleted the script and stopped the scheduled task. My main question is: how did the attacker gain access to her system behind the NAT? If I obtain someone's public IP address and port, can I exploit their system? What methods might the intruder have used to compromise the machine? Sorry, but I am really curious to know this. ending with 63.147 is our o365 ip address and ending with 226.333 (intruder) may be and 10.100.54.228 is user's machine ip
... View more