The independent researcher Kevin Beaumont found out that the outage is still ongoing. Apparrently affected systems were restored from backups, but the threat actors retained access and encrypted additional systems [3]. This indicates that the containment and eradication steps during the incident response process were not completed successfully the first time around. It is likely that the threat actors established a persistent way of accessing the internal network. 3/4🧵

Prevention The following measures can be used to detect or prevent this attack path: - Implementing Conditional Access for the M365 environment. Access is only granted after verification of certain connection or device details. Specific Microsoft licensing is required. - Using phishing-resistant 2FA methods such as FIDO 2 security keys, passkeys, Windows Hello for Business etc. - Implementing e-mail filtering and analysis services, web filtering through proxy solutions. -Raising the awareness of employees for this attack vector through appropriate training.

We identified this malware as #HijackLoader, with the final payload being Arechclient2 RAT. This combination has been previously observed by @redcanary here: xitter.cf/redcanary/status/19154… A complete analysis of HijackLoader is beyond the scope of this thread, but stay tuned for long-form content 👀 6/7🧵