Follow us on Google News
Hackers have compromised cloud environments belonging to at least 27 organizations across the globe after exploiting legitimate application credentials and identities within Microsoft’s cloud ecosystem. The cyber intrusion, which has been active since November 1, bypassed software vulnerabilities entirely and instead targeted Microsoft Entra ID and Azure DevOps permissions. Affected institutions include government departments alongside entities in energy, agriculture, transportation, construction, legal, education, and non-profit sectors. By weaponizing trusted service connections, the perpetrators gained unauthorized access to Microsoft 365 environments, siphoned 81 sensitive files, and breached roughly 2,279 mailbox items across approximately 25 cloud tenants.
Attackers Bypass Authentication via Application Identities
The mechanics of the assault highlight a growing challenge in modern enterprise security, as the perpetrators relied heavily on non-human application identities rather than conventional user credentials. Within Microsoft Entra ID, applications interact autonomously using predetermined permissions that operate without standard password prompts or routine multi-factor authentication checks. Investigators discovered that the attackers obtained valid application credentials, enabling them to inherit existing enterprise privileges without triggering conditional access defenses. Evidence also pointed to the misuse of an Azure DevOps federated workload identity alongside the replay of legitimate user session tokens. Although investigators found no sign of vendor platform compromise, the exact point of initial credential theft remains unknown.
Intruders Harvest Credentials and Navigate Storage Repositories
Once authenticated, the perpetrators executed a structured lateral traversal through Azure Resource Manager, Key Vault, Microsoft Graph, and Storage services. Security analysts tracked 29 targeted wildcard searches executed via Microsoft Graph, followed by systematic data harvesting from SharePoint repositories at speeds reaching one file per second. The downloaded cache contained private cryptographic keys, VPN profiles, network backup credentials, password files, and remote access configurations. Cybersecurity specialists caution that these sensitive materials pose acute downstream risks, as stolen network profiles and encryption keys provide avenues to breach corporate infrastructures far beyond the perimeter of Microsoft 365.
Managed Service Providers Utilized to Expand Infiltration
A primary catalyst for the scale of the campaign was the exploitation of managed service providers maintaining delegated administrative links to client tenants. Investigators observed that a single compromised multi-tenant application allowed attackers to infiltrate as many as 15 distinct customer environments in rapid ten-second cycles. Approximately 95 percent of the observed sign-in activity originated from automated scripts, occasionally peaking at 24 authentication attempts in ten seconds. Analysts noted that intermittent lulls and shifting browser configurations indicate a human operator likely oversaw the scripted execution. With the source IP address 199.19.77.84 identified in connection with the intrusions, organizations have been advised to inspect service-principal sign-in logs, disable suspicious applications, and systematically rotate all exposed credentials.
