#mandiant

Abusing Intimate Permissions for Lateral Movement and Privilege Escalation in Entra ID Native Environments: (In)tune to Takeovers

Recently, a client received assistance from the Mandiant Red Team in visualizing the potential consequences of an advanced threat actor breach. In order to compromise the tenant’s installed Entra ID service principals, Mandiant migrated laterally from the customer’s on-premises environment to their Microsoft Entra ID tenant during the evaluation.

Using a popular security architecture that involves Intune-managed Privileged Access Workstations (PAWs), we will discuss in this blog post a new method by which adversaries can move laterally and elevate privileges within Microsoft Entra ID by abusing Intune permissions (DeviceManagementConfiguration.ReadWrite.All) granted to Entra ID service principals. We also offer suggestions and corrective actions to stop and identify this kind of attack.

A pretext

The client had a well-developed security architecture that adhered to the Enterprise Access model suggested by Microsoft, which included:

An Active Directory-based on-premises setting that adheres to the Tiered Model.

A Microsoft Entra Connect Sync-synchronized Entra ID environment that synchronizes on-premises identities and groups with Entra ID. PAWs, which were completely cloud-native and controlled by Intune Mobile Device Management (MDM), were used to administrate this environment. They were not connected to the on-premises Active Directory system. To access these systems, IT managers used a specific, cloud-native (non-synced) administrative account. These cloud-native administrative accounts were the only ones allocated Entra ID roles (Global Administrator, Privileged Role Administrator, etc.).

A robust security barrier was created by separating administrative accounts, devices, and privileges between the Entra ID environment and the on-premises environment:

Because Entra ID privileged roles are associated with unique, cloud-native identities, a compromise of the on-premises Active Directory cannot be utilized to compromise the Entra ID environment. This is an excellent practice for Microsoft.

An “air gap” between the administration planes of the two environments is successfully created by using distinct physical workstations for administrative access to cloud and on-premises resources. Attackers find it very challenging to get through air gaps.

Strong Conditional Access regulations imposed by Privileged Identity Management assigned roles to the administrative accounts in Entra ID, necessitating multi-factor authentication and a managed, compliant device. Additionally, Microsoft recommends these best practices.

Attack Path

One of the objectives of the evaluation was to assign the Mandiant Red Team the task of obtaining Global Administrator access to the Entra ID tenant. Mandiant was able to add credentials to Entra ID service principals (microsoft.directory/servicePrincipals/credentials/update) by using a variety of methods that are outside the purview of this blog post. This gave the Red Team the ability to compromise any preloaded service principal.

There are a number well-known methods for abusing service principal rights to get higher permissions, most notably through the usage of RoleManagement.See AppRoleAssignment and ReadWrite.Directory.Application and ReadWrite.All.ReadWrite.All rights for Microsoft Graph.

However, the Mandiant Red Team had to reconsider their approach because none of these rights were being used in the customer’s environment.

Mandiant found a service principle that was given the DeviceManagementConfiguration after using the superb ROADTools framework to learn more about the customer’s Entra ID system.Go ahead and write.Permission is granted.Image credit to Google Cloud

The service principal is able to “read and write Microsoft Intune device configuration and policies” with this authorization.

Clients running Windows 10 and later can execute the unique PowerShell scripts used by Intune for device management. Administrators have an alternative to configuring devices with settings not accessible through the configuration policies or the apps section of Intune by using the ability to run scripts on local devices. When the device boots up, management scripts with administrator rights (NT AUTHORITY\SYSTEM) are run.

The configuration of Device Management.Go ahead and write.To list, read, create, and update management scripts via the Microsoft Graph API, all permissions are required.

The Microsoft Graph API makes it simple to write or edit the management script. An example HTTP request to alter an existing script is displayed in the accompanying figure.PATCH https://graph.microsoft.com/beta/deviceManagement/ deviceManagementScripts/<script id> { "@odata.type": "#microsoft.graph.deviceManagementScript", "displayName": "<display name>", "description": "<description>", "scriptContent": "<PowerShell script in base64 encoding>", "runAsAccount": "system", "enforceSignatureCheck": false, "fileName": "<filename>", "roleScopeTagIds": [ "<existing role scope tags>" ], "runAs32Bit": false }

The caller can provide a display name, file name, and description in addition to the Base64-encoded value of the PowerShell script content using the Graph API. Depending on which principle the script should be run as, the runAsAccount parameter can be set to either user or system. RoleScopeTagIds references Intune’s Scope Tags, which associate people and devices. The DeviceManagementConfiguration can likewise be used to construct and manage them.Go ahead and write. Permission is granted.

The configuration of Device Management.Go ahead and write.By changing an existing device management script to run a PowerShell script under Mandiant’s control, Mandiant was able to go laterally to the PAWs used for Entra ID administration with full authorization. The malicious script is run by the Intune management script when the device reboots as part of the user’s regular workday.

By implanting a command-and-control device, Mandiant could give the PAWs any instructions. The Red Team obtained privileged access to Entra ID by waiting for the victim to activate their privileged role through Azure Privileged Identity Management and then impersonating the privileged account (for example, by stealing cookies or tokens). By taking these actions, Mandiant was able to fulfill the assessment’s goal and gain Global Administrator rights in Entra ID.

Remediation and Recommendations

To avoid the attack scenario, Mandiant suggests the following hardening measures:

Review your organization’s security principals for the DeviceManagementConfiguration.ReadWrite.All permission:  DeviceManagementConfiguration should be handled by organizations that use Microsoft Intune for device management.Go ahead and write.Since it grants the trustee authority over the Intune-managed devices and, consequently, any identities connected to the devices, all permissions are considered sensitive.

Mandiant advises businesses to routinely check the authorizations given to Azure service principals, with a focus on the DeviceManagementConfiguration.Along with other sensitive permissions (like RoleManagement), there is the ReadWrite.All permission.See AppRoleAssignment and ReadWrite.Directory.Application and ReadWrite.All.ReadWrite.All.

Businesses that manage PAWs with Intune should exercise extra caution when assigning Intune privileges (either via DeviceManagementConfiguration).Use Entra roles like Intune Role Administrator or ReadWrite.All.

Enable Intune’s multiple admin approval: Intune allows you to use Access Policies to demand a second administrator’s approval before applying any changes. By doing this, an attacker would be unable to use a single compromised account to create or alter management scripts.

Think about turning on activity logs for the Microsoft Graph API: Graph API Activity logs, which provide comprehensive details about Graph API HTTP requests made to Microsoft Graph resources, can be enabled to aid in detection and response efforts.

Make use of the features that Workload ID Premium licenses offer: With a Workload-ID Premium license, Mandiant suggests using these features to:

Limit the use of privileged service principals to known, reliable places only. By guaranteeing that only trustworthy places are used, this reduces the possibility of unwanted access and improves security.

Enable risk detections in Microsoft Identity Protection to improve service principal security. When risk factors or questionable activity are found, this can proactively prohibit access.

Keep an eye on service principal sign-ins proactively: Monitoring service principal sign-ins proactively can aid in identifying irregularities and possible dangers. Incorporate this information into security procedures to set off notifications and facilitate quick action in the event of unwanted access attempts.

Mandiant has a thorough grasp of the various ways attackers may compromise their target’s cloud estate with some hostile emulation engagements, Red Team Assessments, and Purple Team Assessments.

China is stepping up its manipulation of US public opinion. It worked well for Putin in 2016 so why would Xi Jinping ignore the potential?

A Chinese marketing firm likely organized and promoted protests in Washington last year as part of a wide-ranging pro-Beijing influence campaign, according to new research. The Chinese firm also used a network of over 70 fake news websites to promote pro-China content in an example of the more aggressive efforts by pro-China operatives to influence US political debate in recent years, according to security firm Mandiant, which analyzed the activity. One of the protests was against a US government ban on goods produced in China’s Xinjiang region, where US officials have accused the Chinese government of systematic repression of the Uyghurs. The other protest was on the sidelines of a June conference on international religious freedom, Mandiant said. One of the protests only attracted roughly a dozen people but it showed the scope and ambition of the pro-China efforts. The hired protesters, who included self-proclaimed musicians and actors in the Washington, DC, area, apparently had no idea they were being enlisted in a pro-China influence campaign, the Mandiant researchers said. The campaign backed by the Chinese firm, Shanghai Haixun Technology Co., Ltd., is “intended to sow discord in US society,” Ryan Serabian, a senior analyst at Mandiant, told CNN.

Rent-a-protester is nothing new. There are companies like this one which will create a scene for you — for a price.

A bigger problem is the proliferation of bogus news sites. They often have names and branding which look like (but aren't identical) to those of legit news organizations.

It doesn't help matters that Google News is way lax about what it considers a "news" site.

Of course the most fertile ground for fake news sites is social media. Meta (Facebook, Instagram, etc.) is more interested in boosting activity than in accuracy of information. And Twitter (or whatever Elon is calling it today) these days has become a playpen for Nazis.

People need to SIMPLY STOP getting news from dubious social media sources.

There are plenty of respected sources for news. But it takes a bit more effort than just glancing at an unmoderated feed.

No source is 100% perfect; but a good news source will admit an error and then offer a correction.

Public broadcasters in liberal democracies are good sources. Even public broadcasters in some non-English speaking democracies may have English language content. Americans in particular need to get more news directly from reliable sources in other countries. It's a big world out there.

The corporatization and monopolization of local and regional newspapers in the US has been terrible news. However a lot of smaller excellent news sites have sprung up to fill the gap in local coverage in many municipalities.

So create your own news feed of legit sources – but keep it separate from strictly opinion sites.

If you do run across a dubious site pretending to be a news source, don't hesitate to call them out publicly. This "news site" may just be a propaganda boiler room operating in Shanghai or Saint Petersburg. It may seem like a game of whack-a-mole to some degree but keeping the lifespans of such sites short prevents them from building a base.

—··—— —··—— —··—— —··—— —··—— —··—— —··——

Speaking of China, apparently Foreign Minister Qin Gang has been purged.

Fake malware hosted directly on GOOGLEs servers - no problem.

The Call is Coming from Inside the House: When Alphabet Becomes the Malware CDN

Let’s take a moment to marvel at the sheer, unparalleled cybersecurity juggernaut that is Alphabet.

Here is a company with effectively infinite resources. They own Google Safe Browsing, the very shield that protects billions of users from the dark corners of the web. They own VirusTotal, the world’s premier malware scanning and threat intelligence database. They even dropped $5.4 billion to acquire Mandiant, basically buying the Avengers of incident response. Add in planetary-scale telemetry, and you’d think their own backyard would be the safest place on the internet, right?

Wrong.

Instead, threat actors are comfortably kicking back and using Google Cloud Storage as their personal, high-speed, highly reliable Content Delivery Network for malware.

Case in point: A wildly obvious Gate.io phishing clone. The cybercriminals didn't even have to work hard to find bulletproof hosting. They just spun up a bucket on Google's infrastructure and hosted their malicious payload directly at https://storage.googleapis[.]com/aicoin/Gate-x64.zip.

Let that sink in. The company that scans your Gmail for suspicious attachments, flags dodgy domains in Chrome, and literally owns the platform where the entire infosec industry uploads malware samples to be analyzed... is actively hosting the malware. It’s sitting right there on their own premises.

The payload itself isn't even trying to hide. Run it through a sandbox, and it lights up like a Christmas tree: persistence mechanisms, dropped DLLs, location checks—the whole nine yards of a classic crypto-stealing or remote access trojan setup.

It is profoundly unacceptable that a tech empire with billions of dollars and the world’s most advanced threat-hunting capabilities can't seem to police its own basic storage buckets. We are constantly lectured by big tech about "zero trust" and "advanced persistent threats," yet they can't even stop a generic phishing campaign from using their own domains to bypass security filters. (Because hey, who blocks googleapis.com, right?)

The Fox is Guarding the Henhouse: Why sites.google.com is a Scammer’s Paradise

Let’s get one brutally honest fact out of the way: sites[.]google[.]com is an untrustworthy wasteland. Threat actors—ranging from DPRK’s Stardust Chollima to Russian teenagers running the Angelferno drainer—are using Google's free infrastructure to host phishing sites and steal millions in irreversible crypto transactions. Their primary distribution method?

GOOGLE ADS used to lead users to GOOGLE SITES via first result Paying Google Ads to blast their scams to the absolute top of your search results. Google is quite literally cashing ad-buy checks from criminals to intentionally poison its own search engine. Truly, good job, Google.

Try reporting this blatantly obvious fraud, and you'll quickly discover that Google's "Report Abuse" button is a total black hole. You get no tracking ticket, no human to escalate to, and zero operational visibility. Instead, you're stuck waiting out a pathetic one-week review SLA, which gives scammers all the time they need to drain victims dry. The irony here is staggering: Alphabet owns top-tier cybersecurity firms like Mandiant and VirusTotal, yet their internal synergy is so spectacularly non-existent that the threat intelligence arm seems entirely disconnected from the ad-revenue arm.

While third-party defenders are forced to scramble and slap warning banners on these domains at the zero-minute mark, Google remains an immovable, opaque bottleneck.

LIST OF SCAMS (DO NOT OPEN THEM!)

sites.google.com/view/s3-uniswap-dex-dapp-ad-105/ sites.google.com/view/s3-uniswap-dex-dapp-ad-186 sites.google.com/view/s3-uniswap-dex-dapp-ad-339 sites.google.com/view/sign-ins-web-kraken sites.google.com/view/s3-uniswap-dex-dapp-ad-221 sites.google.com/view/s3-uniswap-dex-dapp-ad-947 sites.google.com/view/s3-uniswap-dex-dapp-ad-815 sites.google.com/view/s1-unilabs-dapp-ad

The next time you see a sponsored Google Sites link, do yourself a favor: assume it’s a trap, roll your eyes, and keep scrolling.

Google sites - the GeoCities of 2026 which nobody needs Imagine if Alphabet, the company which owns Google Ads, Google Sites, Mandiant and ViruStotal could make the three heads talk to each other and actually use all the telemetry in the world, which they already have.

Em uma medida que pode transformar o panorama da segurança cibernética, a Mandiant anunciou o lançamento recente de uma tabela rainbow dedicada ao protocolo de autenticação NTLMv1. Essa nova ferramenta, que se torna disponível para a comunidade de segurança, tem a capacidade de recuperar senhas fracas em menos de 12 horas utilizando hardware de baixo custo, acessível para a maioria dos usuários. Com um valor estimado abaixo de 600 dólares, a tabela é hospedada no Google Cloud e representa um avanço significativo para defensores, pesquisadores e, inevitavelmente, atacantes que buscam explorar vulnerabilidades em sistemas.(...)

Leia a noticia completa no link abaixo:

https://www.jornalo.com.br/mandiant-lanca-tabela-rainbow-para-quebrar-senhas-ntlmv1-em-12-horas

🛡️ AI-Powered Cyberattacks Are Coming — Sooner Than You Think

Cybersecurity expert Kevin Mandia, founder of Mandiant, has issued a warning that feels like a scene from a sci-fi thriller:

"Within a year, we could be facing real-world AI-driven cyberattacks."

But this isn’t fiction anymore. With artificial intelligence becoming more advanced and more accessible, cybercriminals are no longer bound by traditional hacking techniques.

They now have tools that can think, learn, and evolve on their own — and that's a game-changer.

💻 What Does an AI-Powered Cyberattack Look Like?

🔸 Autonomous Learning: AI won’t wait for instructions. It can probe defenses, test responses, and adapt on the fly — like a digital predator evolving mid-hunt.

🔸 Next-Level Phishing: Forget typos and bad grammar. Generative AI can write flawless, hyper-personalized emails that perfectly mimic your boss, your bank, or your best friend.

🔸 Deepfakes & Voice Cloning: Imagine getting a call from your mom… but it’s not your mom. It's AI. Scary? Yes. Possible? Absolutely.

🔸 Invisible Malware: These attacks won’t leave obvious traces. They’ll blend in, avoid detection tools, and even cover their own tracks. You might not know you've been hacked — until it’s too late.

⚠️ Why You Should Care (Even If You’re Not in IT)

This isn’t just a problem for tech companies or governments.

AI is democratizing cybercrime, meaning even low-skilled attackers could launch advanced attacks with point-and-click tools. Whether you're a freelancer, a student, a small business owner, or just someone with an email account — you’re a target.

The threats are getting smarter. Our defenses need to catch up.

🔒 What Can Be Done?

✔️ AI vs. AI: Use AI to defend against AI. Smart firewalls, anomaly detectors, and machine learning-based security are no longer optional — they’re essential.

✔️ Cyber Awareness: Training people to spot fake emails and videos is just as important as the software protecting them.

✔️ Ethical AI Policies: Governments and platforms need rules. Clear ones. Fast.

✔️ Collaboration: Cybersecurity is no longer a solo mission. Companies, countries, and communities need to work together.

We’re entering a new age — where the enemies in cyberspace don’t just follow instructions… they write their own playbooks.

Are we ready?

One aspect of vulnerability intelligence is also doing a best-faith effort to track the threat actors that are using the vulnerabilities. While that information often isn’t published, when it is we should include it. For example, less than 1% of data breaches publish the vulnerability associated with the initial compromise, and that is often the same with who was behind the compromise. Recently,…

Defenders must be vigilant as hacktivism rises globally

Since early 2022, Mandiant has seen hacktivist threat activities rise. This is decades after hacktivism started as an internet activism and years after many defenders last considered it a threat. This new hacktivism features a more complicated and frequently effective mix of strategies used by different actors to achieve their goals.

What is hacktivism? The use of hacking methods to further political goals, frequently in line with social activism, is known as hacktivism. It combines the concepts activism and hacking.

Today’s hacktivists can launch massive disruptive attacks, compromise networks to leak information, conduct information operations, and even tamper with physical world processes. They have used their skills to earn fame, propagate political ideas, and assist nation-state strategic goals. Hacktivist personalities and tactics are popular among state and non-state actors seeking cyber influence due of their anonymity and versatility.

In this blog post, Mandiant analyses the hacktivism threat landscape and gives analytical tools to estimate their risk. Mandiant‘s understanding from years of observing hacktivist actors, their claims, and attacks helps organisations assess and prioritise meaningful threat activity against their networks and equities.

Defenders must monitor hacktivist threats to anticipate cyberattacks

Mandiant defines hacktivism as attacks with the avowed goal of political or social activism. The sheer size of hacktivism’s return challenges defenders to proactively sift through the noise and assess the risk posed by many actors with varying degrees of competence. Hacktivist activity is often a minor danger, but in the largest hacktivist operations Mandiant has observed, threat actors have purposefully integrated various approaches in hybrid operations to augment each other.

Nation state actors have used hacktivist techniques to assist hybrid operations that hurt victims. As volume and complexity increase and new actors use hacktivist tactics, defenders must sift, assess, and neutralise new and developing threats. Defenders benefit greatly from proactive hacktivist threat monitoring:

Monitoring hacktivism messaging and behaviour can alert defenders to sophisticated threat activity. Not only is hacktivism overt, but it also hides action from nation-states and criminals.

Hacktivism has grown in frequency and scope over the past two years, threatening several organisations. Defenders must carefully filter through trivial activity to discover meaningful targeting of their organisations and establish mitigation methods, even if most attacks have minor impacts.

Hacktivist assaults are often inspired by global events but target organisations unrelated to the event. Targeting seemingly unrelated organisations allows players to claim greater attacks and choose high-profile targets like essential infrastructure or important enterprises to boost group prestige and notoriety.

Proactive monitoring lets defenders know when an organisation or region is at increased risk, what circumstances may precede hacktivist attacks, and when hacktivists have targeted similar industries or organisations.

In regions and industries with lesser cybersecurity maturity, networks are even more vulnerable and victims are more likely to suffer long-term consequences. In such instances, proactive monitoring helps organisations identify and mitigate imminent network dangers like other detection systems.

Scale and sophistication in the new hacktivism A Cult of the Dead Cow hacker coined “hacktivism” in the mid-1990s. Originally, it meant “online activism,” where actors attacked victims to influence audiences and spread political or ideological views. Most hacktivist groups first claimed anti-establishment goals that endangered governments and political institutions. In the early 2010s, Anonymous-affiliated hackers attacked networks vulnerable to DDoS attacks, garnering media attention. Eventually, anti establishment hacktivism and its methods became obsolete as cybersecurity improved, networks got more resilient, and law enforcement in some places took legal action against these individuals.

After years of low intensity, low impact operations, new hacktivist groups and strategies emerged around the Russian invasion of Ukraine and the Israel-Hamas conflict. Several hacktivist groups have professed their loyalty to parties in these wars and attacked a vast range of organisations and governments. Their attacks have targeted third parties with loose associations like nationality, commercial relations, or opposing loyalty across boundaries.

New hacktivist action differs from previous activity in scale and scope of groups and activities. Some hacktivists are more adept at coordinating attacks with communications to promote their threat activities and impact audiences. Hacktivism today is not limited to low-capability actors motivated by “traditional” anti-establishment ideals. We’ve seen more geopolitically and monetarily driven entities using hacktivist facades to hide threat behaviour.

Although hacktivist activity has been used as a front for state-sponsored action for over a decade, the current level of frequency, volume, and intensity is unprecedented.

Medium Is Message: Hacktivists’ Strategic Messaging Allows Information Operations Hacktivist attacks rely on influence and sometimes overlap with covert information operations, which use deception to manipulate information.

Strategic narrative promotion via hacktivist identities allows operators to maximise attack impact or acquire attention for their aims. Mandiant defines hacktivism as when the actor’s claims openly declare or imply political or social involvement and involve persona construction, customised message, and disruptive cyber behaviour. These strategies are crucial to hacktivism’s influence. As mentioned, hacktivism’s comeback is likely due to several variables, but its in-built mechanisms to communicate and hide identities may appeal to individuals with a variety of motivations.

Hacktivists adopt overt personas to hide their real operators and give the sense of organic public support for a topic or event.

Hacktivist personas usually propagate their messages via direct claims or persona-affiliated online assets like social media or actor-owned sites. Distributing “tainted leaks” or running big DDoS attacks during geopolitical or cultural events can likewise incorporate meaning in the attack. Strategic targeting and other high-profile allegations help groups acquire mainstream media notice.

Hacktivist tactics incentivize actors to exaggerate their impact and make false or fabricated claims, so Mandiant advises carefully analysing groups’ messaging, claims, and any independent evidence before drawing conclusions about an actor’s motivation, capability, or efficacy. Hacktivist personalities and their acts must be analysed over time and in context of other players’ communications. Sometimes conclusive evidence is impossible.

Geopolitically motivated hackers often advance nation-state strategic goals Given the overlap between hacktivist techniques and information operations, geopolitically driven hackers often aid nation-states achieve strategic goals. Hacktivists are usually independent, however we have found recent examples of actors with strong ties to state-sponsored cyber espionage outfits.