If you or one of your fellow admin users falls for a phishing attack, hackers can gain access to your Microsoft 365 environment. Once inside, they often set up persistent access, allowing them to remain undetected for a while as they plan their next move.
How Hackers Exploit Microsoft 365
When hackers compromise an account, they have two potential paths:
- Sell the access on the dark web to other malicious actors.
- Use the access to monitor financial transactions and carry out scams.
They typically lay low, waiting for opportunities to manipulate invoices or impersonate suppliers, eventually redirecting payments to their own accounts. These attacks can go unnoticed until customers or vendors alert you to something suspicious.
A hacker updates payment details on an invoice
In Australia alone, 50,000 businesses fell victim to these types of attacks in 2022, costing a staggering $77 million. Globally, businesses lose around $5 billion each year, not counting the cost of restoring reputations and regaining customer trust.
How Hackers Remain Hidden
Even after you realize your business has been breached and take steps like deleting the hacker’s account, resetting passwords, and enabling phishing-resistant forms of Multi-Factor Authentication (MFA), hackers may still be hiding. Why? Because they often create a backdoor using Entra ID apps (formerly known as Azure AD apps) with application permissions.
How do we Prevent and Address These Attacks?
To defend your business from these types of attacks, follow these best practices:
- Limit Admin Privileges: Ensure only necessary personnel have admin access, and use privileged access management if available.
- Apply the Principle of Least Privilege: Give each user the minimum permissions they need to perform their job effectively.
- Zero Standing Access: Avoid giving permanent admin rights. Instead, assign temporary admin access as needed.
- Use Separate Admin Accounts: Admin accounts should not have mailbox access. This separation makes it harder for hackers to use email phishing to compromise admin privileges.
- Enable Phishing-Resistant MFA: Use advanced MFA methods like FIDO2 keys (e.g., YubiKey) or device passkeys to reduce phishing risks.
- Monitor Uncommon Applications: Tools like Defender for Cloud Apps can detect high-risk apps or those with unusually high permissions.
- Upgrade Security Licenses: Consider upgrading your Microsoft 365 security licenses or implementing a SIEM (Security Information and Event Management) solution to monitor for suspicious activity, such as unusual sign-ins or changes to app credentials.
Protect Your Business Today
At GCIT, we specialise in helping businesses secure their Microsoft 365 environments against advanced threats like these. If you’re concerned about your cybersecurity, or if you’d like to learn more about how to defend your business from these attacks, contact us today.
