Multi-wave impersonation campaign
Extracted IOCs across three sending domains, purged every copy from mailboxes and alerted staff the same day.
The situation
A phishing campaign arrived in waves, each from a different sending domain, all impersonating a trusted sender. Changing domains between waves is a common way for attackers to get past filters that only block what they have already seen.
What I did
- Pulled out the indicators. Extracted the indicators of compromise (IOCs) from each wave: the three sending domains and the other details that tied the messages together.
- Found every copy. Searched across all mailboxes for messages matching those indicators, including ones users had not reported.
- Purged them org-wide. Removed every copy from every mailbox using Defender for Office 365, so nobody could open one later.
- Blocked the senders. Added the domains to the block list to stop further waves.
- Told staff the same day. Sent an alert describing the emails, so anyone who had already interacted with one could report it straight away.
Outcome
Every copy was purged across the organisation, the sending domains were blocked, and staff were alerted on the same day.
What others can learn
- One report means many inboxes. When a single user reports a phish, assume everyone got it and search for all copies.
- Block by pattern, not just by domain. Campaigns rotate domains, so the shared indicators matter more than any single sender.
- Speed beats perfection. A quick, clear staff alert prevents more clicks than a detailed one sent tomorrow.