Urgent and Official: Benefits Enrollment
A sophisticated social engineering incident in Los Angeles
“Nick” turned 27 in December 2023. His nickname is “Shorty,” even though he’s 6’1”. The nickname is ironic given his height, but it makes more sense when you learn about his family: his mom is 6’2” and has lived in Ohio most of her life. His dad is 6’4” and owns a farm in the mountains near San Ramón, Costa Rica. Nick’s older step-brother is 6’7” and teaches under-18 basketball in Spain. He backpacks all over Europe whenever he gets bored of teaching under-18 basketball in Spain.
Nick left his hometown of Mansfield, Ohio, after graduating high school in 2015 to pursue an acting career in Southern California. He arrived with savings from summer jobs but quickly realized how expensive it was to live there. He worked various jobs—waiting tables, parking cars, working in retail—while attending open casting calls and auditions in his free time. In February 2022, his persistence, grit, and determination paid off when he landed an unpaid internship as a creative assistant at a medium-sized entertainment company in Los Angeles. This opportunity allowed him to make connections in the industry and learn about the business side of entertainment. His hard work was eventually recognized, and he was offered a paid position at the company in November 2022.
Throughout his long and arduous journey in Southern California, Nick found a supportive community of friends who share similar goals, hobbies, quirks, and passions—individuals with legendary nicknames like El Chunky, Big Fit, Whopper Jr., Bandido, and Noodles. They would meet every Thursday night at Live Oak Park in Manhattan Beach to play basketball and visit a different local food spots every other Saturday. They also shared interests in voice acting, hand doubling, video game casting, stage acting, stunt performance, cinematography, script supervision, film composing, set design, and location management, often collaborating on small projects.
After his unpaid internship turned into a paid full-time job in late 2022, Nick was able to move from a cramped shared living situation in Florence to a decent apartment in El Segundo. He got a more reliable car and even flew his mom out to visit him in the summer of 2023.
Contents
Shorty & Co.
Benefits Enrollment
“The threat actors wasted no time…”
Notifications
Lessons Learned
Benefits Enrollment
On Tuesday, November 14, 2023, Nick started his day early as usual. He had a quick breakfast of oatmeal, fruit, and coffee, then dropped off some laundry at his local dry cleaner. After that, he stopped by a coffee shop for a second cup of coffee for his hour-long commute to work. Despite the typical Tuesday rush, traffic was surprisingly easy to deal with.
That day marked Nick’s one-year anniversary as a full-time employee. A few colleagues congratulated him, and he settled into his workspace. When he turned on his computer, he saw a new email from that morning. It looked like it was from the company’s Human Resources (HR) department, specifically from the business partner responsible for employment benefits. The email congratulated him on his one-year anniversary and asked him to complete his benefits enrollment by clicking a link. The email seemed timely and official, with the business partner’s logo and a format similar to other HR emails he had received before. Wanting to get administrative tasks out of the way, Nick decided to complete the benefits enrollment before starting his daily work.
“The threat actors wasted no time…”
Nick’s company provides services to several large media and entertainment companies in Los Angeles and other markets across the U.S., Mexico, Canada, and parts of Europe. These services include production support, content syndication, post-production, scriptwriting, casting, original programming, audience research, music video production, tour management, merchandise development, and pilot development.
A few days after Nick received an email about benefits enrollment, things took a turn for the worse. When Nick clicked on the link in the email and entered his login details, they were stolen by cybercriminals. These credentials gave the attackers access not only to Nick’s work email but also to various company services, including project management and client communication tools.
The attackers quickly used Nick’s credentials to explore the company’s network. They studied communication patterns and key contacts, focusing on interactions between Nick’s company and its major clients, looking for valuable information.
A few days later, the attackers used the information they had gathered to launch a larger phishing attack. They created emails that mimicked the style of communication between Nick’s company and its partners, vendors, and clients. These emails, sent from Nick’s already-compromised account after working hours, were designed to look legitimate and were immediately deleted from the Sent folder.
The emails claimed there were issues with project files and asked recipients to log in to a well-known project management tool to fix the problems. However, the links led to a phishing site meant to steal login credentials. The emails were convincing, and several employees at larger client organizations fell for the scam, compromising their security.
* * *
On Thursday, December 7, 2023, security analysts at a Managed Security Service Provider (MSSP) in Los Angeles noticed a coordinated phishing attack targeting big players in the entertainment industry, including film and TV studios, production companies, record labels, entertainment law firms, and talent management agencies. The attack involved a surge of fraudulent emails attempting to trick recipients into giving up sensitive information or clicking on malicious links.
Over the following days, the MSSP team traced the source of these phishing attempts. They found that the attacks came from foreign IP addresses and that the emails were sent from compromised accounts belonging to legitimate small- and medium-sized entertainment companies in Los Angeles.
This suggested a sophisticated attack strategy where the cybercriminals first targeted smaller, potentially less secure companies within the entertainment industry. By hijacking these email systems, the attackers made their phishing attempts more credible, increasing the chances that recipients at larger organizations would trust and respond to the deceptive emails. The MSSP analysts continued to monitor the situation, working to limit the damage and advising the affected companies to improve their cybersecurity defenses.
Notifications
The MSSP analysts informed the affected companies that their compromised accounts were being used in a phishing campaign. They contacted each company’s IT Director, providing details about the breach, evidence of the compromised accounts, and steps to prevent further damage. After the initial contact, the analysts followed up with a more detailed briefing, explaining how the attack happened and suggesting ways to improve security.
In Nick’s case, the process was straightforward:
Once the MSSP confirmed that Nick’s work email was compromised, they informed his company’s IT Director on Monday, December 11. The director then notified Nick and the relevant teams about the breach.
Nick was advised to change his password immediately, and the IT department added multi-factor authentication for extra security.
The IT department carried out a thorough review of their network and systems to check for other breaches or vulnerabilities. This included looking at access logs to understand the extent of the compromise.
They also hired external digital forensic experts to analyze how the phishing email bypassed security filters, how many emails were delivered, and who else interacted with them. The experts also checked for any malware or spyware left by the attackers.
The company increased cybersecurity training for all employees, focusing on spotting phishing attempts and securing account access. This was part of a broader effort to strengthen their overall cybersecurity culture.
Additionally, the company reviewed and upgraded its cybersecurity policies and systems, investing in better email filtering and intrusion detection tools.
The IT department kept all employees updated on the progress of the remediation efforts and any new cybersecurity policies introduced.
Lessons Learned
The relatively quick actions taken by the MSSP and Nick’s employer were crucial in containing the breach. They highlighted the need for having an incident response plan that can be quickly activated.
The incident also underscored the critical role of continuous training in cybersecurity practices for all employees. It is not just about having the right tools and systems, but also ensuring that every employee is equipped to recognize and respond to security threats.
Strong, multi-factor authentication across all accounts and regularly updating and patching systems can drastically reduce the likelihood of a successful network breach.
Regular system audits and monitoring are essential to detect and respond to threats before they cause significant damage.
P.S. If you enjoyed this post please consider sharing it. That’s how I meet new people, build my network, and then have more opportunities to work on investigations that produce stories like this one!
If you like what you just read, let’s connect on LinkedIn and/or buy me a coffee.