Attacker abuses Microsoft Entra ID to target downstream MSP clients

Dive Brief:

• Researchers are investigating the abuse campaign of a lone hacker who has been using stolen but still-valid Microsoft Entra ID credentials to sign into Microsoft 365 and Azure environments at various managed service providers, according to a recent report by Todyl.
• The hacker targeted 45 app registrations at about 18 organizations and successfully authenticated at least 33 of them. The attacker was then able to access 27 organizations, including downstream clients of these MSPs across various sectors, such as energy, government, food and agriculture, transportation and construction. 
• The hacker then ran searches across 25 tenants, while downloading a total of 81 files and gaining access to about 2,300 mailbox items, according to the report. Todyl researchers said hacking attempts are ongoing.

Dive Insight:

The operation in many ways operates like a self-propagating worm. Researchers believe a single operator is using a virtual private server to run through a stockpile of stolen credentials that were assembled prior to Nov. 1 and then power through MSPs, operating at machine speed. 

About 95% of the sign-ins were conducted using scripted clients, according to the report. Researchers noted rapid bursts of 24 sign-ins within 10 seconds, followed by fixed retry loops of 11 seconds. 

Huntress researchers have traced the activity to a hosting IP based in Poland. 

The cadence and speed lines up with the use of AI-assisted tooling, but researchers have not been able to link the attacks to any specific agentic workflow. They note, however, there is no evidence that directly ties these attacks to the recent campaign linked to ConnectWise Cloud Backup.

The actor associated with the ConnectWise campaign abused an agentic tool called Artex, which is normally used for pen testing and has been linked to a series of sophisticated attacks across the globe, targeting Japanese businesses and South Korean banks.