This report explores a highly sophisticated mass-wipe attack executed by a state-aligned threat actor against a large multinational enterprise. It covers the architectural vulnerabilities exploited, the data protection infrastructure targeted, and the strategic capabilities needed to prevent and recover from cloud control plane compromise.

Attack Vector & Execution

Threat actors in this incident did not need to deploy custom malware to endpoints to achieve mass data deletion. Based on current threat intelligence, the attack chain likely proceeded as follows:

• Initial Access via Infostealers: Evidence suggests the initial intrusion was facilitated by compromised credentials obtained from underground infostealer exchanges, a rapidly growing threat vector leveraged to bypass standard enterprise perimeter defenses.
• Privilege Escalation & Cloud Lateral Movement: Following initial access, attackers reportedly compromised a Microsoft Intune administrator account and successfully escalated privileges to create a new, rogue Global Administrator account.
• Lateral Movement to Backup Infrastructure: Attackers also compromised a single sign-on (SSO) account, enabling them to bypass primary perimeter defenses and gain access to the organization's data protection environment.
• Execution (Mass Device Wipe): Operating under the guise of legitimate administrative authority in Microsoft, threat actors weaponized Microsoft Intune by issuing native "wipe" commands via the Microsoft Graph API, remotely erasing tens of thousands of corporate and bring-your-own-device (BYOD) endpoints globally.

Data Protection Architecture & Configuration Context

Understanding the scope of the attack and recovery efforts requires a grasp of the victim's data protection topology.

The organization managed nearly 70 backup clusters, spanning physical datacenters, more than 40 edge sites and cloud environments. Their workloads included critical VMware infrastructure (i.e. Domain Controllers), Azure VMs, and databases including SAP HANA and Oracle.

The organization relied on an "Archival Reader" pattern for data recovery. Local clusters archived data directly to cloud storage vaults (Azure/RCV). In the event of a disaster, they relied on standing up new, clean clusters and attaching these existing cloud archival locations as readers to execute recoveries.

Architecture Traversal

For maximum destruction, threat actors bypassed traditional network and endpoint data planes to operate almost entirely within the cloud management plane. 

Architectural abuse included:

• Microsoft Entra ID (Identity Plane): Functioning as the cloud identity authority, threat actors exploited Entra ID to escalate privileges and establish a Global Administrator foothold.
• Microsoft Intune (Control Plane): The organization's MDM solution was weaponized to push destructive wipe commands to managed endpoints.
• Data Protection Environment: Attackers accessed a compromised, non-MFA-enabled SSO account in an attempt to destroy the organization's safety net and solidify data loss.

Gaps Exploited

This incident underscores the evolving challenges of securing cloud identity planes against advanced evasion techniques. Key areas targeted by the adversaries included:

1. Circumventing Perimeter Controls: Attackers utilized advanced techniques and harvested credentials to successfully bypass primary authentication perimeters and access administrative environments.
2. Identity Escalation Paths: Threat actors successfully navigated cloud identity structures to elevate privileges, expanding their operational reach across the tenant.
3. Absence of Multi-Admin Approval (MAA): The organization likely allowed standard admin roles to retain bulk wipe capabilities without a secondary authorization gate.

Quorum Authorization as Last Line of Defense

Attackers successfully executed mass-wipe operations on live endpoints due to Microsoft Intune’s lack of a multi-admin approval (MAA) gate. To inflict mass data loss, attackers focused on the data protection environment.

Operating inside the Rubrik console via the compromised SSO account, attackers attempted to manually delete backups for approximately 20 critical hosts.

While live data and devices were lost, quorum authorization (QAuth) capabilities prevented irretrievable data loss. Strict policies requiring secondary, out-of-band approval from uncompromised administrators to execute destructive actions (i.e. deleting snapshots or altering SLA policies) blocked threat actors’ deletion commands.

Customers undeniably suffered operational setbacks in rebuilding infrastructure, but their data was ultimately preserved. Absent QAuth, attackers may have purged backups, resulting in permanent and catastrophic data loss.

Post-Incident Recovery & Critical Learnings

Engineering and support teams have been actively assisting the organization in rebuilding edge sites following the attack by recovering data via cloud archival readers and ensuring legal holds are safely applied.

To prevent future occurrences, incident learnings can be categorized into operational adjustments and tactical identity improvements:

Operational Learnings

The incident exposed several operational data protection gaps that serve as vital strategic learnings for all enterprises relying on hybrid cloud backups:

• Validating Asset Protection – During complex cyber recoveries, rapid restoration depends on continuous validation of Tier 0/1 assets. Ensuring continuous SLA assignment audits prevents visibility gaps for essential infrastructure during recovery.
  • The Takeaway: Organizations must continuously audit and validate that all Tier 0/1 assets are actively protected. Assuming critical servers are backed up without verifying their SLA assignments creates blind spots during recovery.
• Archival Lag at Remote Sites – Limited bandwidth at remote edge locations led to a 3-5 day ingest lag in archiving cloud snapshots. While local snapshots existed on edge appliances, the most recent backups had not fully replicated to the cloud vault.
  • The Takeaway: Organizations using archival reader patterns must monitor remote archival bandwidth and queue lengths closely to ensure recovery point objectives (RPOs) are met in offsite, immutable vaults.
• Capacity Pressure During Cyber Investigations – Cyber incidents freeze standard data lifecycles to protect forensic evidence and prevent further destruction. Following the attack, a cyber event lockdown was activated to automatically disable snapshot expiration and garbage collection. Combined with an aggressive, continuous workload like SAP HANA ingesting approximately 50TB of new data per day, the lack of garbage collection quickly drove cluster capacity usage to over 94% of capacity. Only after free space was controlled and the lockdown lifted were surgical legal holds applied to necessary snapshots
  • The Takeaway: Preparedness is key. Organizations must develop a comprehensive cyber recovery plan and test it regularly for validation. For any cluster in cyber event lockdown, testing recovery plans highlights workflows that cannot be paused, especially those with high data ingest rates that fill the cluster quickly. Organizations must ensure adequate free space is available during a cyber attack.

Tactical Learnings: Identity Hygiene & The Case for Identity Resilience

Advanced identity resilience solutions provide the continuous visibility required to proactively identify compromised credentials and enforce posture checks, a necessity for defending against modern cloud control plane attacks.

To address such gaps, organizations must map foundational hygiene directly to advanced identity resilience visibility. Capabilities include:

• Phishing-Resistant MFA & Credential Hygiene
  • Learning: Attackers utilized old credentials from infostealer logs and compromised administrative accounts (including SSO) that lacked rigorous MFA, allowing raw username/password pairs to bypass the perimeter.
  • Action: Implement FIDO2 hardware keys for all administrative roles and enforce strict password rotation. Build unified inventories of identities and continuously scan for hygiene failures. Policies including "Service accounts with old passwords" and "Weak MFA or MFA disabled for privileged identities" would have automatically flagged stale accounts and SSO accounts lacking SSO, neutralizing infostealer credentials before attackers acquired them.
• Just-In-Time Elevation & Blast Radius Containment
  • Learning: Privileged roles were permanently assigned over PIM workflows, giving standard accounts global reach.
  • Action: Mandate Just-In-Time (JIT) access and remove permanent privileged role assignments. Implement identity segmentation via Intune Scope Tags to contain the blast radius. Monitor Entra ID for privilege escalation risks. Policies such as "Approval isn't required to activate a sensitive directory role via PIM," should trigger alerts to ensure organizations enforce strict elevation gates.
• Enforcing Multi-Admin Approval 
  • Learning: The organization allowed standard admin roles to retain bulk wipe capabilities without a secondary authorization gate. Just as QAuth saved backups by requiring a second approver, Microsoft Intune required MAA to save the endpoints.
  • Action: Security teams must mandate native MAA workflows for destructive actions like wipe, retire, or delete. Continuously assesses identity posture to ensure over-privileged roles are flagged and identity segmentation configurations remain intact, guaranteeing no single identity retains unilateral destructive power.
• Detecting Rogue Accounts and Orchestrating Tamper-Resistant Recovery
  • Learning: During the attack threat actors created a rogue Global Administrator account to facilitate the mass wipe. Adversaries at this level typically clear native event logs to hide their tracks.
  • Action: Monitor Active Directory and Entra ID independently of native Windows event logs to prevent tampering. The creation of rogue Global Admin profiles should generate immutable, near real-time alerts. Orchestrated recovery should allow DFIR teams to surgically roll back unauthorized modifications to Entra ID users, roles, enterprise apps, and conditional access policies directly, ensuring swift eviction of the adversary.

By enforcing continuous identity posture management alongside robust data protections like quorum authorization, organizations can ensure that a single compromised credential does not result in ultimate data loss or the total destruction of the enterprise fleet.