BEC Attackers Abused Azure Admin Privileges to Take Over Multiple Accounts

Summary

Huntress describes a BEC attack in which a compromised Azure administrator reset passwords, created additional admin accounts, and accessed multiple Microsoft 365 inboxes. The organization regained control after remediation.

Key points

Huntress says suspicious inbox rules across multiple accounts led analysts to a compromised Azure administrator account logging in from Lagos, Nigeria.
The attacker reset credentials for underused accounts, granted them Azure admin privileges, and assigned licenses to one secondary account.
The attacker granted access to user inboxes and permission to send email on users’ behalf, then created rules to move messages and mark them as read.
After the legitimate administrator reset credentials and refreshed a token, the attacker regained access through a second account and created a third admin account.
The organization regained control of the compromised accounts in about 15 minutes, according to Huntress.
Huntress recommends enforcing MFA for administrators, using conditional access policies, and regularly auditing administrative permissions.

Article Details

Attack Vectors: A threat actor logged in using a compromised Azure administrator account from an unexpected location in Lagos, Nigeria.
The actor reset credentials for infrequently used accounts and granted them Azure administrative privileges, then assigned licenses to a secondary administrator account.
The actor granted permissions to view users’ inboxes and send email on their behalf, then created inbox rules that moved messages from a legitimate-looking domain to Conversation History and marked them as read.
The actor repeatedly reset credentials and re-enabled accounts to regain access after remediation actions.
Defensive Notes: Require multi-factor authentication for all users, especially users with administrative privileges.
Consider conditional access policies to block logins from unexpected countries.
Audit Azure administrative permissions regularly; remove unnecessary privileges or temporarily revoke them when appropriate.
During a compromise, reset credentials, refresh tokens, disable compromised accounts, remove malicious inbox rules, and audit other accounts with administrative permissions.