Need suggestions for stopping some recent spam emails.

[In2Photos]

As the title suggests I need some help with stopping some spam/potential malware. Yesterday I received a suspicious email. It was a "reply" to an email discussion from someone making very convincing argument to be someone I know. Essentially the name of the person, the subject line, and the body of the email were all from this previous discussion. The part that caught my attention was the attachment. I didn't expect an attachment for a reply on this particular conversation. And then I noticed that the attachment was a Zip file and the body of the email also contained a password. Immediate Red Flag! So I looked back at the email address next to the name and it was not the correct email address of the person. I flagged the email as spam but I was still very concerned as I felt this other person may have been hacked. A few hours later and I received a similar email, but from an entirely different discussion.

A few hours later I discovered that another party was involved in these email discussions. That person apparently opened an attachment on another email a few days earlier. So here is what I believe may have happened. When that attachment was opened it gave some hacker access to the email, username, and password of this person. The hacker has used this info to retrieve emails from this person's account. The hacker is using these emails to send malware to others that had recent discussions with this person.

So how do I stop the emails from coming in?

Unfortunately this is a business email address and others in our office are also getting emails, so I liked to try and stop them from getting in.
Email is an account with my ISP. We do not have our own email server. I contacted the ISP and was told they couldn't really do anything.
Of the 10 emails I have received with this style so far, only 2 have been flagged by AVG as containing a virus and been quarantined. Others have reported similar results.

Any help is greatly appreciated, I'm not even sure what to search the internet for, results have been unrelated.

 

[compcons]

This is typical emotes behavior with thread hijacking.

I will try to remain impartial here so I will point you to a well regarded security vendor who has a writeup. You can do some further Google searches after you read through that.

Case Study: Emotet Thread Hijacking, an Email Attack Technique

Thread hijacking, recently used to distribute Emotet, uses stolen copies of messages collected from infected users’ email clients to attack others.

unit42.paloaltonetworks.com

That said, the answer to this type of attack is to use an email security solution to stop these from getting to the end user. Unfortunately, your ISP is clearly not using something good. The fix is really not trivial. You can either change ISPs and hope they use something better or stand up your own email system and layer in something that stops the type of thing (and Microsoft's security solutions are hot garbage).

End user security awareness training may help as well.

Good luck!