Recently a new trend has emerged where criminals are attempting to hide their activity behind a barrage of spam email to the compromised mailbox or to any popular mailbox in the domain.
do I dare ignore what I see in the logs if my AV is giving me a clean bill of health? Can I really afford to rebuild this server when things seem mostly ok?
There's been a lively discussion with "breaking news" about the extent of the intrusion into networks and the solution to it over on our Ransomware and Security group. Now that it seems to have reached a stable information point I thought I would summarize that you need to know.
New ways to secure email use old tools like transport rules, some are anti-phishing rules, some are cloud app security policies, some are conditional access.