Name: The Modern Adversary’s Grip on M365: From Identity Incident to Crisis
Uploaded: 2026-02-18T19:31:08.933Z
Duration: 26 min 32 s
Description: The Modern Adversary’s Grip on M365: From Identity Incident to Crisis

Transcript for "The Modern Adversary’s Grip on M365: From Identity Incident to Crisis": thing that has a like, you don't see it? Okay. I'll just tell you. It's all good. Welcome, everybody. Excited to get started here in just a minute or two. Thanks for making the time from your busy week. I know it's a short week for a lot of us. So, typically, the shorter weeks end up being the busier weeks. It's five days of work and four days. So appreciate everybody making the effort. We're just gonna give it a couple seconds here, and then we'll get started, jump into today's content. Awesome. Looks like we're seeing a couple of folks trickle in. But if you're just joining us, we're just gonna give it a minute or two before we jump in. Appreciate you making the time. K. I think we can go ahead and get started knowing that a couple people will join, but they're not gonna miss much, just the the introduction here. So, again, thank you all for making the effort to join us today. Excited for the content that we have. It'll probably end up being closer to about, like, twenty to twenty five minutes in total depending on if there's a lot of q and a or chats that we wanna work through. But excited for what we have. It's a little bit unique, a little different than traditional webinars that we've put on as a company. But hopefully, this more immersive kind of theatrical, if you will, experience will peak your interest and just open your eyes in a different light. That's the intent of it anyway. I'll go ahead and kick it to Eddie to introduce himself and just kinda walk through what you're gonna see today. But, again, the chat and the q and I couldn't say this yet. The chat and the q and a, I believe, are open. So please, if you have questions or if you've even comments or thoughts, please share them because as Eddie will kind of show you, it's gonna be more of a sit back and enjoy and relax and and kinda see what this theatrical experience, you know, comes to mind. So if you have things that you're like, oh my gosh. This is crazy, or I had a similar experience, please share that. It helps for everybody as we're learning. And, you know, the more that we all share, typically, the better the session. So please do that. We'll be around in the background, but I'll go ahead and kick it to you, Eddie, and then we can go ahead and start the content. Great. Thanks so much. Good. morning and good afternoon. My name is Eddie Waslowski, field CTO for our SaaS business. And as Hannah was mentioning, this is this is a little bit different. You know, we we go through, we do these webinars, and, typically, it's us telling, you know, kind of the the story of why we're doing this and why it's important and those kinds of things. But the zero hour session is really designed to be that what Hannah was talking about, more immersive, more real real life scenarios to help provide more context of what we're seeing as it relates to the threat landscape against identity and three sixty five. You know, Rubrik has been in the three sixty five business for a number of years now, and the attacks that are that we're experiencing against the platform have changed quite significantly. So, you know, this is a kind of a cautionary tale of of Meridian Health's, what we call zero hour. And it's it really is a realistic depiction of what happens when an organization really isn't prepared during a a sophisticated, cyber attack. So in the chat, you know, it'd be great because we're gonna kinda go through as I as I turn it over to the video. We're gonna go through and play this. But, you know, really would like to, you know, understand from your perspective, does this resonate? Is this realistic? Is this something that you may have been thinking about as it relates to preparedness? So really observe, pay attention to the decisions that are being made, not just now, but, you know, what have potentially been decisions that have been critical earlier. And kind of the the key inflection points as kind of the the crisis gets a little bit more in in-depth. And, you know, really reflect on the experience, and and we're gonna come back afterwards and and wrap this up to you know, with some final thoughts around the attack itself. But, hopefully, this will give you some good context around the the fact that three sixty five data is really, you know, a lot of times, an organization's kind of blind spot as it relates to their collaboration environments. And if an identity layer is is breached and escalated privileges are obtained, really the damage that can be done in this case for for Viridian Health, which was which was fairly catastrophic. So greatly appreciate, everyone's, attendance. We'll look in the in the chat and see what you all are thinking. But, Hannah, if you wanna roll the video, we're gonna get started. The time is 07:30AM on Monday morning. The security operations center at Viridian Health is usually quiet, but an unsettling chorus of alerts is just beginning to sound. Security analyst Jason Lee is the first to see the warning signs. Emile, I've got a high severity alert on a clinic administrator's account. It's a successful sign in from an unknown device, but it's bypassed our MFA entirely. Bypassed MFA? Check the sign in logs. We need to see what's happening. It's a browser session from an IP in a region we don't operate in. This looks like adversary in the middle. The user likely clicked a proxy link this morning, and the attacker just hijacked their authenticated session token. They didn't need the password. They stole the keys after the MFA was already done. It's worse than a session hijack. Look at the logs from two minutes ago. That compromised account just activated a privileged role. And, Jason, they just registered a new Entra ID application called Dev Sync Tool. Oh, they're moving fast. They've granted that app tenant wide admin consent for directory read write. There's the kicker. They just use that app to rewrite our conditional access policies. They've added a new exclusion group that allows that specific app and any account they want to bypass MFA for the entire tenant. They're not just using a specific compromised identity. They fully compromised Entra ID. They've built a backdoor into the very system we use to trust our users. I'm initiating a major incident call with the CISO and CIO. At 8AM, the m three sixty five admin and the security analyst initiate an urgent call to the CISO and CIO to report their findings. They ask the application owner to join them. Danielle, we have a compromised admin. They bypassed MFA via session theft and have already promoted themselves to a privileged role administrator. Privileged role administrator? That's a significant red flag. What kind of compromise are we talking about here? If they have privileged role rights, they can rewrite the rules of the house. Emil, what have they touched? They've modified our conditional access policies. They added that dev sync tool app to our global MFA exclusion list. They've essentially built a way into our tenant that ignores every security gate we have. They've completely compromised our IDP. This isn't just a credential theft. It's complete persistence using our IDP functionalities against itself. This is a direct hit to our core systems. I'm starting a major incident call and getting the council on the line. Christine, are you seeing anything on the application side? Any performance issues or weird user behavior? I am. My team just confirmed it. They're seeing a high volume of failed queries and slow performance across our patient management and billing applications. It looks like the attackers are systematically querying and exfiltrating patient data. The system is struggling to keep up. This is our top priority. We need to move fast. I will get the director of IT and team together to address this immediately. With a major incident declared, the team is now on high alert. The attackers have breached their core systems, and the clock is ticking for them to contain the damage and protect sensitive patient data. It's 10:45AM. The initial shock of the morning has shifted into a grim, focused fatigue. The war room is live, and the dashboards are lighting up with activity that should not be happening. The attackers are no longer just in. They're expanding. Danielle, Stephanie, we've lost the trail. I just tried to pull the sign in logs to see where they're moving, but the feed is dead. Emile, what's the status of our SIEM integration? They've deleted our Azure diagnostic settings. They essentially cut the camera wires. We can see what they're doing now in the console, but we've lost the forensic trail of where they've been. They're blinding us. Michael, what's the status of our executive communications? We have a major leak in Exchange. I just flagged a new tenant wide forwarding rule. Every email sent to our legal audit and security response mailboxes is being piped to an external Gmail account. They are reading our response plan in real time. It's a disaster on the application side too. That DevSync tool app is bypassing site permissions. It's generating anonymous guest sharing links for our patient records vaults. These links don't require a login. Our PHI is effectively sitting on the public Internet right now. Another alert just came in. It looks like a pivot. Failed login attempts from on prem AD around 12PM. They're probably moving into active directory. I'm very concerned if they capture control of AD, it won't just be a disruption. We might not be able to cleanly come back from this quickly. That was one of my biggest concerns. They targeted our Entra Connect server. If they've compromised the sync engine, they have the service account credentials needed to jump straight into our on prem domain controllers. The path to our local network is paved. My team just confirmed it. EHR and billing systems are down. Doctors can't access patient records. Payments are stalled. We have no idea what data has been taken. I just got an email from the address in the ransom note. They're demanding 4,000,000 in Bitcoin. The deadline is in three days. The attackers have successfully blinded the security team, opened the floodgates for data theft, and begun the systematic destruction of the company's digital assets. The threat has jumped from the cloud to the very heart of their local network. It is now 8AM on Tuesday morning. The team has been working through the night in a war room. Their initial containment efforts have just been completed, but the atmosphere is far from celebratory. Okay. We've cut off the head of the snake. We've disabled the clinic administrator's account, revoked all active m three sixty five sessions, and forced a global password reset for the entire IT department. Wait. Jason, the sim is still dark, but I just refreshed the active users list in the portal. Three new global administrator accounts just appeared with randomized names. How? We disabled the user who started this. It's not a someone. It's the DevSync tool app registration. That's their persistence. They used its permissions to register more shadow apps and new admin accounts. Explain this to me, Stephanie. We killed the user, disabled the app, and revoked its certificate. Why do they still have access? Because before we killed the first app, it used admin consent to register three more shadow apps with their own certificates. We're not fighting one backdoor anymore. We're fighting a self replicating identity infection. She's right. Deleting the first user an app was like cutting a weed but leaving the seeds. The identity system is now weaponized against us. It's programmatically recreating its own access every time we try to clean it. It's getting worse. XDR is flagging living off the land techniques with alerts from the data center because the attackers have the bridge from Entre ID to our on premise active directory, and they're moving laterally across our servers targeting the hypervisor. It's like a game of VACMO. The attackers have established multiple persistent mechanisms. Even if we disable one attack vector, they'll use another. We can't seem to stop them. This is not a containment issue. It's a full blown crisis. Bring in Olivia. The media is going to pick this up. We need a plan for public communication. Another email just came in. They've seen our failed remediation attempt. They're raising the ransom to $6,000,000 and warning a public data dump if not paid within forty eight hours. They feel they have the upper hand and legally, they might. Even with modern security tools, attackers can establish multiple persistence mechanisms that make it extremely difficult to fully remediate an incident. This highlights critical gaps, including a lack of application control, insufficient tamper protection for EDR and AV solutions, and limited audit log dependency. It's 01:15 on Tuesday afternoon. The team is overwhelmed with managing the on premises ransomware deployment, and then a new high priority alert hits. We've confirmed mass data exfiltration. They're pulling from the anonymous SharePoint links we found earlier, and we are seeing high volumes of network traffic suggesting on prem data exfiltration. It's not a mystery anymore. They just sent a second ransom note to the entire executive team. They've attached a file manifest as proof. What's on the list, Stephanie? It's the crown jewels, patient records twenty twenty five, the billing vaults, and insurance claims. They didn't just take files. They took the entire structure of our clinical database. It's full PHI. Stop everything. The confirmation of PHI exfiltration fundamentally changes our legal position. We've just moved from a business continuity crisis to a major regulatory and legal event. What does that mean for us right now, Laura? It means we likely have seventy two hours to notify the California attorney general under CCPA. It means we have notification deadlines in every other state and country we operate in. We need to retain outside counsel specializing in breach notification, and we need to do it tonight. Outside counsel? Laura, what are the financial implications here? We need to establish a budget for credit monitoring for every customer in that database. The cost of incident just grew by an order of magnitude, and that is before the class action lawsuits begin. While we're discussing lawsuits, they're still in the system locking us out. They've created new retention policies to delete data and manipulated conditional access policies to block our admins. He's right. This is a full blown crisis. Rebuilding might be impossible if we cannot restore identity first. It doesn't matter. It's too late. The news is already out. What's the damage, Olivia? Reporters are calling, and our stock is dropping fast. The attackers have initiated a double extortion demand. They want payment for decryption and to prevent the public release of patient information. The estimated financial impact is now over 25,000,000 from fines and legal costs alone. Alright. New strategy. This is no longer just an IT incident. It's a battle for the company's survival. Legal PR coordinate our public facing response. Michael, Emile, forget finesse. What's the fastest path to a secure operational environment? I need options and fast. The team is now facing immense pressure from the attackers who are leveraging the company's lack of visibility and identity resilience against them. It's now been nearly seventy two hours since the attack began. The leadership team has gathered in the boardroom for a final agonizing decision. The air is thick with exhaustion and defeat. Our direct revenue loss stands at millions of dollars. Our stock is in free fall. The financial burden is mounting every hour, and a full clean rebuild of our environment is estimated to take at least three weeks. What is the plan? We have to address the ransom, but ping isn't a silver bullet. It doesn't guarantee data recovery or remove the attackers from our systems. What's to stop them from coming back into a shadow account? We are left with no good options. Team, the failure here is twofold. We have a failure of data recovery and a failure of identity trust. We fell into the native tool trap. We knew we had sensitive data, but we lacked any control of where it actually was. We relied on native recovery tools as our primary safety net, but because those tools live inside the same trust boundary these attackers are now in, they have been neutralized. It is a hard lesson. A data recovery strategy that lives inside the compromised tenant isn't a strategy at all. It's just a target. We needed our data secured and isolated outside of the primary infrastructure. Even if those in external backups were ready to go right now, we never tested our identity recovery. Without a way to restore and reset our hybrid identity stack to a trusted state, we could reintroduce the attackers into our environment. The issue is a complete lack of visibility. We can't tell you what specific PHI was stolen because we had no comprehensive data inventory. Our recovery attempts have failed and we can't even access critical m three sixty five data. In fact, we're in a dual front war because our on prem AD and Entre are synced. We had a plan for restoring users but not for the IDP configuration being weaponized against itself. We need an object level rollback of Entre to purge those malicious apps and permissions, but technically, that has to stay in lockstep with our AD forest restore. If we don't sync the recovery, we'll face massive identity mismatch errors and orphaned accounts. Relinking thousands of hybrid identities manually is an intensive process. It's not a forty eight hour fix. It's a multi week recovery effort. I must state for the record that I formally object to paying the ransom. But if we don't, the patient data will almost certainly leak. The single biggest quantifiable risk that we face is a public leak of that PII data. From a legal standpoint, paying the ransom is our only leverage, however small, to prevent that outcome. The general counsel is right. From a purely financial perspective, paying the $6,000,000, as painful as it is, is the only move we have left. It's the only business decision on the table. They were right. Our security teams told us our backup strategy for m three sixty five and identity infrastructure were not complete. We deprioritized the projects to meet deadlines for new features. We made this choice months ago. Now we are just paying the bill. Their story is a stark reminder that true cyber resilience is not an accident. It is the result of proactive investment in a modern data security strategy that gives you the one thing this team never had, a choice. I always wanted to, like, finish with that that kind of daunting, chime. Okay. So that's that's how things can play out. Alright. I I threw a couple of things in the in the chat there. I don't know that it's necessarily working, but in the in the QA, if you all wanna throw some comments in there, I'm more than more than welcome to do so. I'll say this. So this is kind of a a common kind of scenario. Right? The the identity portfolio within Rubrik is the fastest growing solution in the company's history. And, yeah, we built a great product and it's it's differentiated in the marketplace, but it's it's built because of these kinds of situations and and scenarios. Right? The ability to move laterally to be able to do what they were doing from an application perspective, to lock out users, to change permissions, to exfiltrate data. This is all the the objectives of these of these threat actors. And, you know, it's, you know, funny. Microsoft will tell us it's, what, 600,000,000 identity based attacks a day that are that are taking place, which is absolutely confounding. And, you know, they only the the the corny statement, they only have to be right once. Right? But it's it's true. So if you think about, you know, what Veridian had done and and what they had planned for, and and granted, you know, they're they're able to detect things and find things a little bit faster, I think, than we probably would normally in a in a real life situation and scenario. I don't think they're gonna figure it out in just a matter of of minutes and kind of a happenstance there. But that situation is is kind of how it how it plays out. So you think about, you know, what they did to prepare, how they reacted, you know, not having backups, right, is probably the the biggest glaring thing that we that we point out here. But also trying to understand and and see what are what are the act what is the activity of these users? Do they have escalated privileges? How do we roll those things back? And, ultimately, you know, have a mechanism that if we're under attack, it's it's simply a a blip on the radar. And for Verdi, unfortunately, because they didn't have a lot of this prepared for, right, the the catastrophic event of do we have to pay the ransom? Can we actually get our data back? You know, what is the impact of the business? These are all real board level, c level executive decisions or conversations that are that are being had with a number of our customers. And and last year, you know, I think Rubrik was responsible for recovering probably 60 to 70, organizations from catastrophic events like this. So while this is a virtual situation, you know, one of the things that I I would ask is to to go back and think about, the Viridian situation and the this kind of cautionary tale. How do you how does your organization stack up against Veridian? Do you have the same kind of plan, same kind of strategy? If an event like this were to take place, what ultimately would be the response and the strategy of your individual and your your specific organization? And are there blind spots in your data security strategy and your data recovery strategy that potentially need to, need to be addressed? Thus, Rubrik, we're always happy to meet with you and and discuss more about those strategies. What, you know, things like Rubrik is doing, technologies that Rubrik is releasing and developing that can help in these areas. If you've seen in the in the news today, we we actually introduced an exciting announcement of our Rubrik agent cloud, which helps a lot with with AI and and helping rewind the action of agents and govern agents, which is a very, very interesting topic, specifically around the Microsoft stack. So greatly appreciate everyone's attendance, your participation, even though if they were just emojis on our on our acting. But, you know, we'd love to have some individual dialogues with you all around your usage and your strategies as it relates to identity resiliency and three sixty five resiliency. So thanks, Hannah, so much for being our our master of ceremonies and and through this, and and thanks everyone for for spending some time with us today. Yeah. Thanks, Eddie. Yeah. I'm surprised there's not more response to our acting. But, no, it was good, and I I hope that everybody enjoyed kind of this different experience. Be on the lookout. I think we're gonna refine this even more. You would be interested in everybody's feedback as well. If there's things that you were like, oh, this would help make it even more impactful, like, please share that with us. You know, we put on these events so that, hopefully, everybody learns more about Rubrik, but also, you know, you learn something in general that would be impactful for your organization. We want it to be a value add. So keep us posted if there's any feedback that you guys have. But if not, thank you so much for your attendance today. We'll give you some time back, which is always a nice thing to do on a busy week. And, yeah, then look out for a follow-up email. Thanks, everybody. Appreciate you all. Breakthrough.