Resisting six weeks of sustained phishing attacks

Transparency International experienced a sustained and sophisticated phishing attack, which was detected through a sharp increase in failed attempts to log in to organisational email accounts. Over a six-week period, the IT team at the Secretariat responded to this persistent effort to breach the organisation’s systems.

Download case study

Through research, advocacy, and campaigning, they work to expose the systems and networks that enable corruption to thrive, demanding greater transparency, accountability, and integrity at all levels and across all sectors of society. The organisation’s structure includes national chapters in more than 100 countries. Each national chapter has its own IT department, and these departments coordinate with the Secretariat in Berlin, Germany, for different types of support.

In 2019, Transparency International experienced a sustained and sophisticated phishing attack, which was detected through a sharp increase in failed attempts to log in to organisational email accounts. Over a six-week period, the five-person IT team at the Secretariat monitored and responded to this persistent effort to breach the organisation’s systems.

1. What happened?

In the summer of 2019, the IT team received an email from Microsoft alerting them to a sudden and unusual increase in activity, resulting in failed attempts to sign in to the organisation’s Microsoft Office accounts. Transparency International uses Microsoft Office 365 services for email, browsers, and internal collaboration tools. While it was common for failed login attempts to occur (for example, due to someone in the organisation forgetting their password and accidentally using the wrong credentials or an external actor trying to enter the system through email or other services), the volume of failed attempts in this case was extraordinary and indicated a sustained effort to breach the organisation’s IT system.

After receiving the email from Microsoft, the IT team did not know what to make of the warning. They were reassured that staff accounts were protected by multi-factor authentication, which felt like adequate protection from the barrage of login attempts, but they decided to continue to closely monitor these attempts. Whenever they saw an account that used the correct login credentials (such as the correct email address and password) but failed to apply the correct multi-factor authentication, the IT team would warn the staff member whose account had been targeted and ask them to change their password. At this early stage, the IT team decided against sending out a warning email to all staff to avoid creating fear or paralysing people’s work.

One week after the initial warning email from Microsoft, senior management started to receive phishing emails impersonating the Chair of the Board and mimicking their writing style. The IT team realised that this was a spear phishing attack and, for the first time, understood that the organisation was being targeted. The phishing emails were sent from Gmail addresses but had a high level of sophistication, as they closely imitated the writing styles of previous emails that had been sent. For instance, on the sixteenth day of the cyberattack, the attackers sent an email mimicking a warning email that had been sent by the Head of Technology 24 hours earlier. In their email, the attackers offered additional support regarding the phishing emails by asking staff to click a link to get more information about the ongoing attacks! Given how closely the phishing emails mimicked management emails, the IT team suspected that the attackers could see emails within the organisation’s system – but they could not identify where or how the attackers were able to do so.

The IT team continued to “firefight” the login attempts and phishing emails. In the third week, Transparency International received another email from Microsoft, which said that attackers had successfully breached the accounts of two staff members. This meant that the attackers had not only used the correct login credentials for these staff members but were able to “confirm” their identity by completing or bypassing the multi-factor authentication process (Transparency International used SMS-based multi-factor authentication at the time). The two staff members whose accounts were breached were not senior staff and fortunately did not have access to sensitive data. However, the organisation’s IT security had been breached by cyberattackers. The IT team was able to end all active sessions and change passwords on the affected accounts to ensure the attackers were logged out.

After six weeks, the attacks subsided. To this day, Transparency International is not sure why the attacks stopped. It could be that the attackers found what they wanted, that it was too difficult to find and access what they wanted, or that there was a time limit set on the campaign against them.

Overall, the six weeks of attacks on their system were a demanding and strenuous time for the organisation. One of the two IT staff members directly responding to the incident had just joined the organisation three days prior to the start of the incident. IT staff did not know what was coming next and had to “firefight” this attack while still completing their regular work.

2. Response

During the first two weeks of the attack, the IT team was in constant communication with senior management but did not alert all staff. In meetings with senior management, they probed into why this attack was happening and what the attackers could possibly want. By the end of the second week, given the persistence of the phishing attacks, the head of IT sent out an awareness and warning email to all staff. The aim was to prevent staff from accidentally exposing their accounts. This was the email that the attackers mimicked in a phishing email sent to all staff on the 16th day of the incident.

Transparency International had a retainer relationship with a cybersecurity company that ran an intrusion detection service to constantly scan communications across the organisation’s network for a breach. By day 13 of the attack, the company notified Transparency International that three devices in the Secretariat’s network were communicating with external IP addresses. In their analysis, they noted that the IPs likely belonged to state-sponsored attackers who had substantial resources to put toward an attack. Based on similarities to previous attacks, the cybersecurity company suspected (though they could not completely verify) that the attackers were a group known as Cozy Bear or APT 29, a prolific group linked to Russian intelligence which “hunts for confidential information stored in the networks of governmental organisations, political groups, and think tanks.”

The cybersecurity company also discovered that although the intrusion attempts seemed to originate from Chinese IP addresses, they were actually Russian IPs masked as Chinese addresses. They found that the attackers were registering many domain names that were close to the domain names of several international civil society organisations (ICSOs) – a type of cyberattack known as domain spoofing. Following the analysis by the cybersecurity company in which the organisation learned that this attack was from a state-sponsored actor, Transparency International became more serious in their response.

The IT team tried to stay ahead of the attackers by putting blocks on the firewall so staff would not accidentally open phishing links. “We had a game of cat and mouse for a few weeks, as the attackers switched up [their approach] and we blocked,” said an IT staff member. Suspecting that their email communications were being monitored, the IT team moved their communications offline and relied on in-person conversations to coordinate to avoid further compromise. They also started blocking email addresses that were suspected of being related to the attackers and asked staff to be alert for phishing emails, providing a list of actions that staff should and should not take (such as to avoid clicking links or downloading files from unknown accounts and to report suspicious emails).

Eventually, the attackers moved to European servers, probably to avoid detection. However, the cybersecurity company had more leverage to get these servers taken down than if the servers were in Russia or China, because the cybersecurity company had contacts at the major cloud computing providers in Europe. They notified these providers when they saw that their infrastructure was being used by a customer for illegal or fraudulent activity.

After learning from the cybersecurity company that the attackers were developing spoof domains for other ICSOs working in the environment, development, and humanitarian sectors, the IT team reached out to other organisations where they had personal connections with staff. They sought to warn them about the domain spoofing and ask whether they had seen any evidence of a cyberattack on their organisation. Some organisations responded by thanking them for the information, and others confirmed that they had not been attacked. It seemed like Transparency International was the only one being attacked at the time; however, it is possible that other ICSOs preferred not to share that an attack had happened or were unable to identify an attack (as few organisations have intrusion detection set up on their systems). Transparency International has since set up an informal peer network of chief information officers to exchange information, which continues to be active.

In the third week of the attack, Transparency International received another email from Microsoft to notify them that the attackers had successfully breached the phones and accounts of two staff members. The multi-factor authentication on their accounts had been bypassed through their phones. The cybersecurity company conducted a forensic analysis of the laptops of staff who experienced the breach. As staff phones were private phones, it was not possible to conduct forensic follow-up on them. At that time, the IT staff could not fathom how it could have been possible to bypass the two-factor authentication. Since learning of Pegasus spyware in 2021, they now suspect that such malware may have been used on staff phones to intercept the MFA code and transmit it to the attackers, allowing them to complete the multi-factor authentication process.

Eventually, the attackers moved to European servers, probably to avoid detection. However, the cybersecurity company had more leverage to get these servers taken down than if the servers were in Russia or China, because the cybersecurity company had contacts at the major cloud computing providers in Europe. They notified these providers when they saw that their infrastructure was being used by a customer for illegal or fraudulent activity.

After learning from the cybersecurity company that the attackers were developing spoof domains for other ICSOs working in the environment, development, and humanitarian sectors, the IT team reached out to other organisations where they had personal connections with staff. They sought to warn them about the domain spoofing and ask whether they had seen any evidence of a cyberattack on their organisation. Some organisations responded by thanking them for the information, and others confirmed that they had not been attacked. It seemed like Transparency International was the only one being attacked at the time; however, it is possible that other ICSOs preferred not to share that an attack had happened or were unable to identify an attack (as few organisations have intrusion detection set up on their systems). Transparency International has since set up an informal peer network of chief information officers to exchange information, which continues to be active.

The response to the attack on Transparency International was largely carried out by the IT team with support from the cybersecurity company. One staff member had some training and background in information security and recognised that they needed expert support. Before the attack, the IT team had spent a few hours per week on security, but the attack response became the majority of their work for six weeks. Although they kept senior management informed, the IT team managed the cyberattack response, as in the moment, they saw it as mainly a technical issue. In their words: “There wasn’t time to think about the big picture. Maybe we could have included the communications team to help with outreach to staff, but we didn’t think about it at the time.”

3. Outcomes & impact

The incident was contained within the organisation’s systems, and there was no impact on the communities they work with or their donors. The breach did not reach any sensitive data, in part due to the organisation’s systems architecture – Transparency International uses different systems to store sensitive information.

However, the attack was stressful for the IT team who were the frontline responders to the incident. They faced intense uncertainty, coming into work each day and not knowing what to expect from the attackers or how the incident might progress. However, the incident also presented a rare opportunity for the team, as it was their first time responding to a cyber incident that was actual rather than theoretical. The IT staff said, “Now we have organisational learning from the experience, but at the time it felt like firefighting and trying to keep heads above water.”

When a cyberattack like this occurs, staff may be less inclined to trust the operating systems they rely upon to do their work. Ultimately, the IT team and senior management at Transparency International were able to manage the situation and help staff members stay calm and vigilant and continue their work.

In the wake of the incident, Transparency International recovered quite quickly but became more conscious of security. The organisation recently launched simulations of phishing attacks to assess how many staff would fall for various methods, and they were impressed by the results. Most staff members were able to recognize most phishing attempts. This training process will be ongoing at the organisation, especially when new members join the team.

4. Organisational learnings