I think the point is that autoresponders will autorespond to legitimate business emails as well as phishing/scam/whatever other emails.
UPD: also, I guess any attacker could just assume that you're Out of Office at night time.
Impersonate the person out of town to escalate to their privilege level.
Imposter: "My password isn't working, can you help me reset it?" Yes, this is unlikely to to work in smaller orgs where you know people face to face. It is more likely to work as the org scales up in size (think enterprises with their own helpdesk).
Once you have email and/or other federated access, you have a toehold. Bonus points if you've cloned their work cell SIM or have rerouted SIP for their desk phone to keep them out of the loop. I have seen weaker phishing attacks on financial/accounting staff who have the authority to move millions of dollars of corporate funds.
EDIT:
> Whom the would-be attackers send this email to?
Phishing target
> Do they send this email from their own email address?
Throw away address or spoofed address from a familiar-to-the-business domain.
> Is there an assumption that sysadmin/support team will blindly reset a password on someone else's request?
This is one assumption.
> How do attackers bypass corporate VPN?
VPN access might not be required to obtain the level of access desired. Do all of your SaaS providers require 2FA? Your business bank accounts?
This is only a few steps above Indian scammers taking remote control of users’ computers and convincing those users to send them hundreds of dollars of gift cards to prevent legal action by the IRS. Consider your average user, not the HN participant.
https://www.youtube.com/watch?v=YVqurfWzB-Q (Hacking Humans : Social Engineering Techniques and How to Protect Against Them - Stephen Haunts)
> Imposter: "My password isn't working, can you help me reset it?"
This doesn't have anything to do with being out of town or autoresponses.
- Whom the would-be attackers send this email to?
- Do they send this email from their own email address?
- Is there an assumption that sysadmin/support team will blindly reset a password on someone else's request?
- How do attackers bypass corporate VPN?
This is not a hypothetical scenario, almost every year there is some idiot saying they going for vacation in those mini-interviews in the local newspaper and then they get their house broken into.
However the probability that someone does email you and is a burglar at the same time is extremely small.