Huntress Launches Cross-Tenant Infrastructure Blocking for Microsoft 365
Summary
Huntress launched Adversary Infrastructure for Managed ITDR, which uses SOC-validated attacker infrastructure to create Conditional Access blocks across eligible, opted-in Microsoft 365 tenants.
Key points
- Huntress says Adversary Infrastructure turns hosting, relay, or proxy infrastructure confirmed in one tenant into Conditional Access blocks for eligible, opted-in Microsoft 365 tenants.
- Huntress says infrastructure nominations require tight evidence-based scoping, no legitimate logins from the addresses across its fleet, reports from at least two unrelated partners, and a second engineer’s review.
- For a Railway-hosted phishing operation targeting 344 organizations across five countries, Huntress says its block stopped 305 attack attempts without affecting legitimate logins.
- Huntress reports that an LSHIY LLC password-spray campaign used ROPC to compromise 78 accounts across 64 organizations; 55 affected accounts had Conditional Access policies requiring MFA.
- Huntress reports that a token-replay campaign using a German hosting provider’s IP range produced 497 successful sign-ins across 79 organizations, despite more than 200,000 failed attempts.
- The feature is live in Managed ITDR for Microsoft 365 at no extra cost. Existing partners are opted out by default; eligible tenants need Entra ID P1 or P2, Security Defaults off, and a healthy, fully onboarded Huntress tenant.
Article Details
- Event Type
- Launch of a cross-tenant blocking capability for attacker infrastructure, following phishing, password-spraying, and token-replay campaigns.
- Impact
- Huntress reports that a Railway-based device-code phishing campaign targeted 344 organizations across five countries in under three weeks; a block on Railway IP ranges stopped 305 attack attempts, with no legitimate logins affected. In a separate password-spraying campaign, 78 accounts across 64 organizations were compromised. A token-replay campaign resulted in 497 successful sign-ins across 79 organizations. The article says Adversary Infrastructure turns infrastructure confirmed in one tenant's incident into Conditional Access blocks for eligible, opted-in tenants.
MITRE ATT&CK
Threat Actors
Vendors
HuntressThat's the problem we built Adversary Infrastructure to solve. It's the newest capability in Huntress Managed ITDR, and it turns that one-time emergency response into continuous protection. When one tenant gets hit,Microsoftengine. Device code phishing lures hit 344 organizations across five countries in under three weeks. Microsoft had no reason to score those logins as risky. That was the whole point.
Products
Adversary InfrastructureHomeBlogHerd Immunity for Identity: Introducing Adversary InfrastructureEntra IDsettings page. Partners onboarding from today forward are opted in by default. Eligible tenants need Entra ID P1 or P2 (Business Premium, or E3 with P1, and up), Security Defaults off, and a healthy, fullyManaged ISPMWhere Managed ISPM fitsManaged ITDRRailway's IP ranges, validated it against 14 days of fleet traffic, and pushed it to every eligible Managed ITDR tenant. It stopped 305 attack attempts at the door. Zero legitimate logins were affected.Microsoft 365 Apps for EnterpriseAdversary Infrastructure blocks attackers at the Microsoft 365 sign-in, before they ever get a session.RailwayIn March, our SOC watched a phishing-as-a-service operation turn Railway, a developer cloud platform with a spotless IP reputation, into a token-harvesting engine. Device code phishing lures hit 344 organizations across