Lessons learned from a Man-in-the-Middle attack

Fox-IT reports a September 19, 2017 incident in which an attacker obtained access to their third-party domain registrar account, modified DNS records and deployed a fraudulent SSL certificate to perform a Man-in-the-Middle attack against their ClientPortal and briefly redirect email; the attacker intercepted 12 file transfers (10 unique), credentials for nine users (2FA prevented misuse), and some user metadata. The incident was detected and contained within ~10 hours, law enforcement was engaged, affected parties notified, and Fox-IT published remediation steps and recommendations (use of 2FA at registrars, certificate transparency monitoring, regular password rotation, and full packet capture).