Once enrolled, APT29 was able to use the account to access the organization’s’ VPN infrastructure that was using Azure AD for authentication and MFA,” Bienstock explained. Because the account was dormant, Azure AD prompted APT29 to enroll in MFA.

The threat actor successfully guessed the password to an account that had been setup, but never used. “In one instance, APT29 conducted a password guessing attack against a list of mailboxes they had obtained through unknown means. To do that, the user must only have the correct username and password, which means that an attacker who has that knowledge can access the account and set up MFA for it. When implementing MFA, most organizations and platforms allow users to enroll their first MFA device at the next login.

Attackers take over dormant Microsoft accounts and set up MFAĭouglas Bienstock, an IR manager at Mandiant, shared last week a new tactic by APT29 (aka Cozy Bear, aka Nobelium) and other threat actors that involves taking advantage of the self-enrollment process for MFA in Azure Active Directory and other platforms. More recently, Mandiant and Mitiga researchers have documented different approaches that allow attackers to (mis)use Microsoft MFA to their advantage. We have already seen attacks involving SIM swapping, exploitation of vulnerabilities, rogue apps, legacy authentication protocols, MFA prompt bombing (aka MFA fatigue), stolen session cookies, and ( custom) phishing kits with MFA-bypassing capability.

Microsoft has been pushing for the use of multi-factor authentication (MFA) to thwart attackers for many years.īut threat actors are keeping up with the increasing enterprise adoption of MFA and are constantly coming up with ways to bypass the additional protection it offers.

Mfa setup microsoft