To aid in response to a suspected or known Google account compromise, consider the following questions and investigation tips. (This article is the second of a 2-part series related to a current scam targeting Google accounts. The first article in the serries “Part-Time Job Application Google Account Compromise Scam: Prevention and Training” discusses steps to take to help prevent the scam from occurring.)
Questions to Answer
- How did this incident start?
- When did this start?
- What happened?
- Which accounts were compromised (all accounts)?
- What other files/data were accessed?
- What other single sign-on systems were accessed?
- What other email messages were viewed/deleted/etc.?
- What passwords could be compromised via Google password manager?
- What can be changed to prevent this from happening in the future?
Mitigation
- Revoke sign-in cookies- to prevent already logged in users from continuing to access the account.
- Disable account- to prevent any actions while investigation begins.
- Delete phishing email messages sent to other users within organization, if this function is available. (To find all emails with a specific subject, use Gmail message filter and add a filter of Attribute subject is.)
Investigation
- Who clicked the link: Use Google investigation tool Gmail log events filter and add filter for Subject contains [email subject] and Event is – Link clicked. Consider revoking sign in cookies and forcing a password change for any user who clicked the link in the phishing attempt.
- Where/When/Who accessed the compromised Google account: For user log events, Event is – successful login and User contains – [compromised account]. Look around the time of the known malicious use of the account and compare IP addresses for any logins. (Some IP addresses may be the user’s home location or the organization’s network. Look for any IP addresses that appear from different/unexpected locations.) Once suspicious IP addresses are found, check successful logins to any user accounts for that IP, to get a scope and history of the compromise.
- Was Google Takeout used to export data from the compromised account: Check for Takeout log events where IP address contains [malicious IP].
- Were Google Drive files accessed: Check Google Drive log events for the malicious IP address. Note: this data is only available for a period of time, so this should be prioritized early in an investigation.
- Were the compromised user’s contacts exported: Check Contacts log events.
- Check Single Sign-On events to see where the user’s account logged in, to see if the threat actor logged into other systems.
- What other email messages were accessed/forwarded/deleted: Check Gmail log events for the malicious IP.
- Any other user log events: Check User log events for the compromised account.
Notifying Other Organizations
If the phishing attempt originated from a compromised valid external account, call or email the originating organization’s IT department or main phone number.
If your organization’s compromised user emailed external contacts, notify those contacts or their technical support. In the notification, include sender/subject/other relevant information. For notifications to technical support, obfuscate any reference to malicious links, so the links don’t resolve. (Example: put “[.]” around dots in the link.) In the notification, include the advice that any user who clicked link/interacted with the email message should notify their technical support.
Recovery
When the investigation is complete, the compromised account access may be restored. Consider implementing multi-factor authentication requirements for the compromised account, and others accounts for the same group of users, if this is not already in place. If the compromised account had MFA already in place, consider moving to passkey instead of password authentication, or restricting MFA options to remove the vector of compromise. Initiate a password change with the valid user, where password change is required upon sign in. The password reset conversation with the user may include coaching on strong password habits and use of a secure password manager, also.
Incident After-Action
Throughout any cyber incident, including an account compromise, document and all findings and actions. The documentation can be used to create an after-action report. After an incident, assemble leadership and responders to discuss the incident process, findings, and next steps to prevent future incidents of this type.
MOREnet members may also contact MOREnet Cybersecurity for assistance during account compromise situations.