Mandiant APT29 Microsoft 365 2022

APT29 has renamed malicious DLLs with legitimate names to appear benign; they have also created an Azure AD certificate with a Common Name that matched the display name of the compromised service principal.

APT29 has used a compromised account to access an organization's VPN infrastructure.

APT29 has gained access to a global administrator account in Azure AD and has used `Service Principal` credentials in Exchange.

APT29 has used a compromised global administrator account in Azure AD to backdoor a service principal with `ApplicationImpersonation` rights to start collecting emails from targeted mailboxes; APT29 has also used compromised accounts holding `ApplicationImpersonation` rights in Exchange to collect emails.

APT29 has enrolled their own devices into compromised cloud tenants, including enrolling a device in MFA to an Azure AD environment following a successful password guessing attack against a dormant account.

APT29 has successfully conducted password guessing attacks against a list of mailboxes.

APT29 has collected emails from targeted mailboxes within a compromised Azure AD tenant and compromised Exchange servers, including via Exchange Web Services (EWS) API requests.

APT29 has used compromised identities to access networks via VPNs and Citrix.

APT29 has compromised email accounts to further enable phishing campaigns and taken control of dormant accounts.

APT29 has used residential proxies, including Azure Virtual Machines, to obfuscate their access to victim environments.

APT29 has disabled Purview Audit on targeted accounts prior to stealing emails from Microsoft 365 tenants.