Network hack? Possibly spyware?

[berderder]

Hi everyone,

 

I have an attorney client whose email address was used to contact a customer asking for a wire transfer for a large sum of money. The attorney didn't send it, but rather a malicious person did.

 

My first thought was that some spyware picked up his email credentials and the malicious user combed through his contacts for a target. Also it's a possibility someone was shoulder surfing when he typed in his credentials and wrote down the info.

 

If credentials and sensitive info were stored locally or on the server, maybe his network has been hacked.

 

What would be your first thoughts, reactions, and steps taken in this scenario?

 

Thank you.

[You_are_a_cunt]

e-mail spoofing, man-in-the-middle, spyware, etc.

 

I'd pull the entire network offline pending investigation. Every single machine should be taken off of the network, audited and hopefully problem found and fixed.

[berderder]

4 minutes ago, revsilverspine said:

e-mail spoofing, man-in-the-middle, spyware, etc.

 

I'd pull the entire network offline pending investigation. Every single machine should be taken off of the network, audited and hopefully problem found and fixed.

I'm going to tell him to change his email password, run anti-virus/anti-malware, and I suppose the same with other client computers in the office.

 

Do you suggest anything with his firewall? I remember man-in-the-middle, but are there any steps you would take to tackle that in particular or any other possibility?

[You_are_a_cunt]

16 minutes ago, berderder said:

I'm going to tell him to change his email password, run anti-virus/anti-malware, and I suppose the same with other client computers in the office.

 

Do you suggest anything with his firewall? I remember man-in-the-middle, but are there any steps you would take to tackle that in particular or any other possibility?

man-in-the-middle attacks are generally physical attacks where the perp intercepts traffic from either the network internally or from somewhere between the network and the ISP.

I'm kinda rusty on network security and software firewalls, since I've been using a hardware-based firewall for the past 5 or so years