Yet another authentication/credential management provider has experienced a network breach. The attack on Retool is similar to recent ones on Microsoft, Okta, Twilio, and others in that the TTP's were advanced and well executed. One TTP in particular, assuming it's true, is mind blowing:
"After [a phished Retool employee] logging into the fake portal – which included a MFA form – the attacker called the employee.
The caller claimed to be one of the members of the IT team, and deepfaked our employee’s actual voice. The voice was familiar with the floor plan of the office, coworkers, and internal processes of the company."
Even if the Retool disclosure author is playing fast and loose and the call or voice wasn't actually AI generated, it's still amazing that the attackers had a live human with knowledge of Retool's, business on hand. If AI is now being successfully leveraged in real world social engineering, it's hard to overstate the significance.
I asked Retool to clarify, and it declined, citing an ongoing law enforcement investigation.
@dangoodin I'm not usually one for conspiracy theories but that sounds an awful lot like a cover story for Occam's Razor: it was an inside job. All of those things could be explained by the member of the IT team working against the company, and AI spoofing is a hot-button topic that would make a good cover story...
