For weeks, an attacker had access to a staff member’s email account.
They hid selected messages from the account holder. They added their own authentication method. They used genuine business correspondence to make fraudulent payment requests more convincing.
The organisation was still working. Emails were still moving. Behind the scenes, someone else was using that access to attempt fraud.
The incident later escalated when the compromised account sent phishing messages to contacts, leading to further accounts being compromised.
This is an incident we investigated. It raises a question every organisation should consider: if someone got into a work account, how would you find out, and how would their access be stopped?
In another incident we investigated, an attacker accessed a Microsoft 365 account despite multi-factor authentication and restrictions on overseas sign-ins.
They used a VPN to make their connection appear to come from New Zealand. Investigators suspected they had also stolen an authenticated sign-in session, allowing them to access the account without completing a fresh MFA challenge.
The attacker began reading emails.
This time, a monitoring service raised an alert approximately six minutes after the recorded initial access. Our security team contacted the user, confirmed the activity was unauthorised, reset the password and revoked sign-in sessions.
While the account had been accessed, detection gave the team an opportunity to intervene.
The service was Identity Threat Detection and Response, or ITDR, delivered by Huntress, the provider we use for this protection.
Think of it as a round-the-clock security watch for your Microsoft 365 accounts. Huntress analyses sign-ins and account activity for signs of compromise, including stolen access and malicious email rules. Its detection technology is backed by security analysts who investigate suspicious activity, 24/7.
When containment is warranted, Huntress can automatically revoke active sign-in sessions and, with identity isolation enabled, lock the affected account. Our security team then works through investigation and recovery.
Artificial intelligence is increasing the speed and capability of attacks. New Zealand’s National Cyber Security Centre reports that attackers are using AI to research organisations, create convincing phishing messages and operate at greater scale. AI agents are also becoming capable of linking weaknesses together to carry out more complex attacks.
Your organisation doesn’t have to be singled out. Attackers also cast a wide net, trying passwords across accounts and looking for an opportunity to get in.
Keeping your organisation secure means continually improving your technology, controls and working practices, helping your people recognise threats and preparing for when something goes wrong.
We now strongly believe that 24/7 ITDR is a fundamental security requirement. Organisations need the ability to detect account compromise and act to contain it, at any hour.
If you’d like to understand your current protection and where ITDR could help, we’d love to talk to you.
%20(3).jpg)
