Re: [mailop] Threat Update.. Tales from the Trenches..

2022-10-06 Thread Michael Peddemors via mailop
Oh, we didn't say they solved the issue.. here it is mainly 'Do you want 
to buy a list of  users' spam..


But percentage wise, we are seeing a lot less than say a couple weeks ago..

Again, what you are seeing, or what we are seeing.. pretty easy to 
stop.. at the source.


On 2022-10-05 14:20, Hans-Martin Mosner via mailop wrote:

Am 05.10.22 um 19:13 schrieb Michael Peddemors via mailop:


PS, don't know what o365 is doing, but a marked reduction in uncaught 
spam leaking from their networks..



Really? I'm seeing a constant stream of fake dating spam from apparently 
compromised O365 accounts, with no end in sight.


Many of them use link shorteners (mostly tinyurl.com), content text has 
so little variation that good old regex rules get all of them, so it 
seems to be just a single spamming operation. Targets are german, so 
that may be a reason you're not seeing those.


Looks like either password databases have been leaked somehow (although 
I consider that very unlikely) or the tenants get to implement their own 
password policies (which seem to be mostly "anything goes") so that 
newly created accounts get fixed or easily guessable passwords. I've yet 
to read another plausible explanation for this wide-spread compromising.


Cheers,
Hans-Martin

___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop




--
"Catch the Magic of Linux..."

Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.

604-682-0300 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop


Re: [mailop] Threat Update.. Tales from the Trenches..

2022-10-06 Thread Atro Tossavainen via mailop
> >PS, don't know what o365 is doing, but a marked reduction in uncaught spam 
> >leaking from their networks..
> >
> Really? I'm seeing a constant stream of fake dating spam from apparently 
> compromised O365 accounts, with no end in sight.

I'm with Hans-Martin on this one.

> Many of them use link shorteners (mostly tinyurl.com), content text
> has so little variation that good old regex rules get all of them,
> so it seems to be just a single spamming operation. Targets are
> german, so that may be a reason you're not seeing those.

Targets are also Swedish and Finnish.

-- 
Atro Tossavainen, Founder, Partner
Koli-Lõks OÜ (reg. no. 12815457, VAT ID EE101811635)
Tallinn, Estonia
tel. +372-5883-4269, http://www.koliloks.eu/
___
mailop mailing list
mailop@mailop.org
https://list.mailop.org/listinfo/mailop