Full Report
Explore how Huntress stopped a massive business email compromise (BEC) attack targeting multiple user accounts within a single organization.
Analysis Summary
# Incident Report: Massive BEC via Azure Administrative Privilege Escalation
## Executive Summary
A threat actor gained unauthorized access to an Azure Global Administrator account, leveraging high-level privileges to compromise multiple users within a single organization. The attacker established persistence by creating secondary admin accounts and implemented malicious inbox rules to facilitate financial fraud and data access. Huntress MDR for Microsoft 365 detected the activity, leading to a rapid response that thwarted the "smash-and-grab" attempt.
## Incident Details
- **Discovery Date:** July 2023 (during MDR for M365 beta phase)
- **Incident Date:** July 2023
- **Affected Organization:** Not disclosed
- **Sector:** Information Technology/Managed Service Provider (MSP) client
- **Geography:** Target: Not disclosed; Attacker Origin: Lagos, Nigeria
## Timeline of Events
### Initial Access
- **Date/Time:** July 2023
- **Vector:** Compromised Azure Global Administrator credentials.
- **Details:** The attacker logged into a legitimate Global Admin account from an anomalous IP address located in Lagos, Nigeria.
### Lateral Movement
- **Persistence & Scaling:** The attacker identified an underutilized user account, reset its credentials, assigned it a license, and granted it full Azure Administrative privileges to serve as a backup access point.
- **Account Takeover:** The attacker systematically granted themselves permissions to view inboxes and "send on behalf of" for multiple users across the organization.
### Data Exfiltration/Impact
- **Email Manipulation:** The attacker added malicious inbox rules across numerous accounts. These rules moved incoming emails from specific domains to the "Conversation History" folder and marked them as read to hide the attacker's presence and communications from the legitimate users.
- **Financial Fraud Attempt:** The techniques used (inbox rules and "send on behalf of" permissions) are primary indicators of an impending Business Email Compromise (BEC) financial redirect or wire fraud attempt.
### Detection & Response
- **Detection:** Huntress SOC identified suspicious inbox rules added in rapid succession by an administrator acting "on behalf of" users, originating from an unexpected geographic location.
- **Response:** SOC notified the partner; the compromised administrator account had its password reset, MFA was enforced, and malicious inbox rules were purged.
## Attack Methodology
- **Initial Access:** Valid Accounts (Cloud Administrative Account).
- **Persistence:** Creation of secondary Administrative accounts; credential resets of dormant accounts.
- **Privilege Escalation:** Assignment of Global Administrator roles to secondary accounts.
- **Defense Evasion:** Use of inbox rules to move messages to "Conversation History" and marking them as "Read" to bypass user notice.
- **Credential Access:** Credential resetting of existing users.
- **Discovery:** Cloud infrastructure and user account reconnaissance.
- **Lateral Movement:** Administrative impersonation ("Send on behalf of").
- **Collection:** Unauthorized access to user mailboxes and email monitoring.
- **Impact:** Business Email Compromise (BEC) and potential financial fraud.
## Impact Assessment
- **Financial:** Prevented potential significant loss (BEC attacks frequently result in six-figure wire fraud).
- **Data Breach:** Unauthorized access to multiple corporate mailboxes and sensitive internal communications.
- **Operational:** Disruption due to account lockouts, password resets, and the need for a full environment audit.
- **Reputational:** Risk to the organization’s standing with clients whose domains were targeted for filtering.
## Indicators of Compromise
- **Network:** Logins from Lagos, Nigeria (Anomalous Geo-location).
- **Behavioral:**
- Administrative accounts adding inbox rules to other users' accounts.
- Inbox rules moving mail to `Conversation History`.
- Granting Global Admin roles to infrequently used or newly licensed accounts.
- "Send on behalf of" permissions granted in bulk.
## Response Actions
- **Containment:** Disabled compromised administrative accounts and reset passwords.
- **Eradication:** Revoked unauthorized administrative permissions from secondary accounts and deleted malicious inbox rules.
- **Recovery:** Implemented Multi-Factor Authentication (MFA) requirements and restored legitimate mail flow.
## Lessons Learned
- **Admin Visibility:** Administrative actions can be a blind spot; monitoring "on behalf of" actions is critical.
- **MFA Gaps:** Even administrative accounts can lack enforced MFA, providing a single point of failure for the entire tenant.
- **Dormant Accounts:** Unused accounts provide a low-noise path for attackers to establish persistence if not properly deprovisioned.
## Recommendations
- **Enforce Phishing-Resistant MFA:** Strictly enforce MFA for all users, specifically those with administrative roles.
- **Least Privilege:** Limit the number of Global Administrators and use Just-In-Time (JIT) access if possible.
- **Anomalous Logins:** Configure alerts for logins from unexpected geographic locations or unrecognized IP ranges.
- **Audit Logging:** Enable and monitor Microsoft 365 Unified Audit Logs for suspicious `New-InboxRule` or `Add-MailboxPermission` events.