Loading story…
Mandiant published guidance on detecting backdoors in Microsoft 365 and Azure Active Directory, highlighting how attackers can establish persistent access in cloud identity environments after initial compromise. The report focuses on abuse of identity and administrative features that let intruders maintain control over tenant resources, evade remediation, and regain access even after passwords are reset.
The guidance emphasizes hunting for persistence mechanisms tied to cloud accounts, applications, and federation settings in Microsoft environments, reflecting growing concern over identity-layer attacks against enterprise tenants. For defenders, the publication frames Microsoft 365 and Azure AD as critical investigation points during incident response because compromised identity infrastructure can provide long-term access across email, collaboration, and cloud administration services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Mandiant released a blog post describing detection considerations for backdoors affecting Microsoft 365 and Azure Active Directory environments. The reference indicates publication of technical details and defensive guidance rather than a specific victim incident.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mandiant published remediation and hardening guidance for **Microsoft 365** environments aimed at defending organizations against activity associated with **UNC2452**, the threat actor tied to high-profile cloud and email compromise operations. The guidance focuses on reducing exposure in Microsoft 365 tenants and helping defenders address weaknesses that can enable persistence, unauthorized access, and abuse of cloud-based identity and messaging services. The advisory highlights practical steps for security teams to strengthen tenant security, improve detection, and remediate compromise paths in Microsoft 365. For CISOs and defenders, the publication serves as an operational reference for hardening cloud identity, email, and administrative controls against a sophisticated actor known for targeting enterprise and government environments.
Jul 12, 2026
Threat actors are increasingly leveraging adversary-in-the-middle (AitM) phishing techniques to compromise Microsoft 365 accounts. In a recent incident, attackers used a phishing email with a malicious link that mimicked the Microsoft login page, capturing both credentials and session cookies to bypass multi-factor authentication (MFA). The attackers expanded their access through password spraying, brute force attacks, and the use of VPNs and residential proxies to evade detection. Persistence was achieved by manipulating inbox rules and abusing OAuth permissions via legitimate email clients, allowing continued access to compromised accounts. Traditional detection methods, such as URL reputation and static fingerprinting, are proving ineffective against these sophisticated AitM phishing kits, which proxy the real Microsoft authentication flow and associated assets. In response, security researchers have developed new defensive measures, including browser extensions that detect AitM attacks at the point of interaction by monitoring for unexpected HTTP referers and injecting visible warnings. However, as attackers adapt and proxy more elements of the authentication process, even these advanced defenses face challenges, highlighting the need for continuous innovation in anti-phishing strategies.
Jun 29, 2026
Mandiant reported that enterprise intrusions are accelerating sharply, with handoffs between initial access brokers and follow-on operators dropping from more than eight hours in 2022 to an average of **22 seconds** in 2025. Exploit-based intrusions remain the leading entry vector, while attackers are increasingly using highly interactive voice phishing against IT help desks to bypass **MFA** and gain access to **SaaS** environments. The company also said zero-day exploitation is happening faster, with attackers often moving within about **seven days** before vendors can publish patches, and that AI is being used to support reconnaissance, social engineering, malware development, and credential theft rather than serving as the primary cause of most breaches. The findings show financially motivated groups prioritizing immediate impact through ransomware, while espionage actors favor stealth and persistence, with median dwell times reaching **122 days** in espionage cases. Ransomware operators are increasingly trying to cripple recovery by deleting cloud backup objects, encrypting hypervisor datastores, and targeting virtualization infrastructure. Mandiant said internal detection improved to **52%** of 2025 investigations, up from 43% a year earlier, and urged organizations to strengthen identity-centric defenses, train employees and help-desk staff, protect Tier-0, backup, and virtualization assets, extend log retention, and centralize identity governance across SaaS platforms.
Jun 29, 2026