Attacker abuses Microsoft Entra ID to target downstream MSP clients

A campaign is using stolen Microsoft Entra ID credentials to break into organisations across many sectors through their managed service providers (MSPs).

Researchers believe a single operator is running the attack from a virtual private server, using a stockpile of credentials assembled before 1 November. The attack spreads through MSPs at machine speed, behaving much like a self-propagating worm. It is not a classic supply chain attack, because no software update was compromised. The attacker already held valid secrets for application registrations in Microsoft Entra, the identities software uses to sign in to Microsoft services without a person present.

Huntress traced the activity to a hosting IP address in Poland. About 95% of sign-ins used scripted clients, with bursts of 24 sign-ins within 10 seconds followed by fixed retry loops of 11 seconds. The tempo suggests AI-assisted tooling, but researchers have not linked the attacks to any specific agentic workflow.

Researchers found no evidence tying this activity to the recent ConnectWise Cloud Backup campaign. That campaign's actor used Artex, an agentic tool normally used for penetration testing, in attacks on Japanese businesses and South Korean banks.

Key points

• The attack uses valid, previously stolen application credentials in Microsoft Entra ID.
• It spreads through managed service providers into clients across various sectors.
• About 95% of sign-ins were made with scripted clients, in rapid bursts and retry loops.
• Researchers see no evidence linking it to the ConnectWise Cloud Backup campaign.