One MSP’s Clients Hit by Three Microsoft 365 Compromises in 72 Hours
Summary
Huntress reported three Microsoft 365 compromises across one MSP’s clients in 72 hours, involving malicious inbox rules. In one case, an attacker abused administrative permissions to access multiple mailboxes.
Key points
- The incidents affected clients in the legal, construction, and retail/distribution sectors.
- Attackers used inbox rules to divert messages into folders such as RSS Feeds and Conversation History, potentially hiding invoices and other emails.
- In the law firm case, rapid logins from Michigan and New York and distinct user agents preceded a rule redirecting messages from an insurance company employee.
- For the contractor, Huntress linked an anomalous login from Virginia to a rule moving all the user’s email into RSS Feeds; it reported the compromise and removed the attacker from the Microsoft 365 instance.
- In the retail case, the targeted employee lacked mandatory two-factor authentication; activity came through Nigerian and Irish IPs, and the attacker granted themself access to other users’ mailboxes.
- Huntress said it reported the incidents, locked out affected accounts, and alerted the relevant MSP partner.
Article Details
- Victim Organization
- Not disclosed
- Victim Domain
- Not disclosed
- Incident Type
- Three business email compromise (BEC) incidents involving Microsoft 365 accounts at three client organizations of one managed service provider.
- Incident Date
- 2023-06-21
- Disclosure Date
- 2023-06-27
- Affected Records
- Three client environments were affected; several employees were targeted in the retail-store incident. No record count is reported.
- Operational Impact
- Attackers created inbox rules to divert emails, and in the retail incident abused administrative permissions to access other users' mailboxes. Huntress reports that it locked out affected accounts, notified the relevant partners, and removed the threat actor from the Microsoft 365 instance. No broader service disruption is reported.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
MITRE ATT&CK
T1078 · Valid AccountsThe incidents involved unauthorized access to employee accounts, followed by malicious activity using those accounts.T1098 · Account ManipulationIn the retail incident, the attacker assigned themselves additional permissions and privileges, including full access to other users' mailboxes.T1114.003 · Email Forwarding RuleAttackers created inbox rules that moved or redirected selected emails into folders including RSS Feeds and Conversation History.
Vendors
Products
Azuremore complex, but it features inbox rule manipulation as a component of overall permissions abuse in Azure. This comes after a threat actor gained access to an account with full administrative permissions.Microsoft 365 Apps for EnterpriseHomeBlogOne MSP, Three Microsoft 365 Compromises, 72 Hours