Dive Brief:
- Researchers are investigating the abuse campaign of a lone hacker who has been using stolen application secrets for Microsoft Entra ID to sign into Microsoft 365 and Azure environments at various managed service providers, according to a recent report by Todyl.
- The hacker targeted 45 app registrations at about 18 organizations and successfully authenticated at least 33 of them. The attacker was then able to access 27 organizations, including downstream clients of these MSPs across various sectors, such as energy, government, food and agriculture, transportation and construction.
- The hacker then ran searches across 25 tenants, while downloading a total of 81 files and gaining access to about 2,300 mailbox items, according to the report. Todyl researchers said hacking attempts are ongoing.
Dive Insight:
The operation in many ways operates like a self-propagating worm. Researchers believe a single operator is using a virtual private server to run through a stockpile of stolen credentials that were assembled prior to Nov. 1 and then power through MSPs, operating at machine speed.
About 95% of the sign-ins were conducted using scripted clients, according to the report. Researchers noted rapid bursts of 24 sign-ins within 10 seconds, followed by fixed retry loops of 11 seconds.
Researchers said the campaign is not considered a traditional supply chain attack. Supply chain attacks often leverage a compromised software update.
“The attacker already had valid secrets for application registrations in Microsoft Entra, which are the identities that software uses to sign in to Microsoft services without a person present,” Jon Semon, principal security operations analyst at Huntress, told Cybersecurity Dive.
Huntress researchers have traced the activity to a hosting IP based in Poland.
The cadence and speed lines up with the use of AI-assisted tooling, but researchers have not been able to link the attacks to any specific agentic workflow. They note, however, there is no evidence that directly ties these attacks to the recent campaign linked to ConnectWise Cloud Backup.
The actor associated with the ConnectWise campaign abused an agentic tool called Artex, which is normally used for pen testing and has been linked to a series of sophisticated attacks across the globe, targeting Japanese businesses and South Korean banks.
Editor’s note: Updates with additional information from Huntress and Todyl.
