A compromised client secret for a cloud backup service has been exploited to access Microsoft 365 environments. The initial access vector involves the theft of a vendor credential, which allows an attacker to authenticate as the application itself. This bypasses standard user-based protections such as multi-factor authentication. The threat affects any organization where the specific backup application is installed and consented. The risk is immediate because the stolen credential grants broad permissions to read and write mailboxes, files, and directory data. The scope extends to managed service providers, where a single compromised tenant can potentially expose multiple client environments. The attack is distributed through the abuse of legitimate vendor infrastructure, making it difficult to distinguish from normal service operations without detailed log analysis.
The attacker authenticates using the stolen client assertion to obtain Microsoft Graph access tokens. These tokens inherit the broad permissions originally granted to the backup service for data recovery. In one observed tenant, a secondary management application escalated its privileges by assigning itself the Global Administrator role. It then executed a script to add new client secrets to two other applications, including a security platform and an MSP management tool. This action created persistent access that does not rely on the original vendor credential. The attacker also performed password spraying against specific tenants using scripted requests from datacenter infrastructure. The activity was conducted from a hosting provider address, distinct from the vendor's normal private cloud traffic. The sequence of operations included role assignments and credential modifications, which were detected through audit logs showing unusual user agents and timing patterns.[/subscribe_to_unlock_form]
A compromised client secret for a cloud backup service has been exploited to access Microsoft 365 environments. The initial access vector involves the theft of a vendor credential, which allows an attacker to authenticate as the application itself. This bypasses standard user-based protections such as multi-factor authentication. The threat affects any organization where the specific backup application is installed and consented. The risk is immediate because the stolen credential grants broad permissions to read and write mailboxes, files, and directory data. The scope extends to managed service providers, where a single compromised tenant can potentially expose multiple client environments. The attack is distributed through the abuse of legitimate vendor infrastructure, making it difficult to distinguish from normal service operations without detailed log analysis.
The attacker authenticates using the stolen client assertion to obtain Microsoft Graph access tokens. These tokens inherit the broad permissions originally granted to the backup service for data recovery. In one observed tenant, a secondary management application escalated its privileges by assigning itself the Global Administrator role. It then executed a script to add new client secrets to two other applications, including a security platform and an MSP management tool. This action created persistent access that does not rely on the original vendor credential. The attacker also performed password spraying against specific tenants using scripted requests from datacenter infrastructure. The activity was conducted from a hosting provider address, distinct from the vendor's normal private cloud traffic. The sequence of operations included role assignments and credential modifications, which were detected through audit logs showing unusual user agents and timing patterns.[emaillocker id="1283"]
The incident highlights the critical risk of third-party application credentials in cloud environments. The attacker's motivation appears to be establishing persistent access and expanding control across multiple tenants. The campaign has affected at least one hundred and sixty-two confirmed tenants, with potential for broader impact. The use of valid cloud accounts and additional cloud credentials demonstrates a targeted approach to privilege escalation. Defensive implications require organizations to immediately disable affected applications and review all existing credentials. It is essential to verify that no unexpected secrets or certificates have been added to enterprise applications. Organizations should monitor audit logs for role assignments and application changes that deviate from normal vendor behavior patterns.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Execution | T1059.004 | Command and Script Interpreter | Python |
| Persistence | T1098.001 | Account Manipulation | Additional Cloud Credentials |
| Persistence | T1098.003 | Account Manipulation | Additional Cloud Roles |
| Credential Access | T1078.004 | Valid Accounts | Cloud Accounts |
| Credential Access | T1110.004 | Brute Force | Password Spraying |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Impact | B0022 | Remote Access |
| Defense Evasion | E1112 | Modify Registry |
| Anti-Behavioral Analysis | F0015 | Hijack Execution Flow |
| Execution | E1059 | Command and Scripting Interpreter |
| Communication Micro-objective | C0002 | HTTP Communication |
The following reports contain further technical details:
[/emaillocker]