Identity-led intrusions drive cyber extortion tactics

ReliaQuest has published an analysis of cyber attacker techniques used between June and August, identifying identity-led intrusions as the clearest threat during the period.

Attackers repeatedly used phone calls and external Microsoft Teams messages to gain access to cloud accounts, then maintained that access even after routine security steps such as password resets. Groups including ShinyHunters and Helix turned compromised identities into SharePoint data theft and extortion.

According to the report, the most common initial-access technique in true-positive incidents was Domain Accounts, accounting for 29.6% of cases. Cloud Accounts made up 12.5%, followed by Spearphishing Links at 11.6%.

The findings suggest a shift away from malware and direct system compromise toward attacks that exploit trusted identities, software and collaboration tools. In several cases, the first visible sign for defenders appeared to be a legitimate sign-in, device registration or change to multi-factor authentication.

Persistent access

One tactic highlighted in the analysis was device-code phishing. In one campaign observed by ReliaQuest, attackers registered several devices to compromised Microsoft Entra ID accounts. Each device received a Primary Refresh Token that continued to renew while the device remained active.

As a result, a password reset or session termination could fail to cut off access if the unauthorised devices remained registered. Full containment required defenders to identify and remove every rogue registration, as well as unfamiliar authentication methods and tokens.

ReliaQuest also described attackers using company-themed and typosquatted domains to support social engineering. These domains imitated help desks, HR departments and identity portals such as Okta, and some were used on the same day they were registered.

This allowed attackers to swap out blocked infrastructure quickly while keeping the same underlying sequence of attack: stealing tokens, registering attacker-controlled authentication methods and downloading SharePoint data through legitimate application programming interfaces.

Extortion groups

ShinyHunters was identified as one of the most active operators using this model. Its campaigns replayed stolen refresh tokens, registered attacker-controlled devices and automated bulk data collection from software-as-a-service platforms.

Helix was cited as another example of identity-led extortion. In one observed case, SharePoint access took place six minutes after a new MFA method was registered, leaving little time for defenders to respond before the data was used in an extortion attempt.

The report said attackers sometimes separated data theft from the delivery of the extortion demand. In one Helix case, one compromised account was used over several days to enumerate and download SharePoint data, while a second account was later used only to send the extortion message through Microsoft Teams.

That distinction matters for investigators because focusing on the account that delivered the demand could miss the original account used for data theft.

Ransomware overlap

Although rankings among ransomware and extortion groups shifted during the period, the methods used after access was gained were becoming more uniform. Valid accounts, remote-support software, unmonitored virtual machines and Server Message Block were repeatedly used to move from initial access to encryption or wider compromise.

Qilin and The Gentlemen were the most prolific groups by number of organisations named on leak sites during the period, with 290 and 260 respectively. Those figures were more than three times the totals recorded for Inc Ransom at 85 and Akira at 55.

In one Booba ransomware incident, the attacker used an internal virtual machine without endpoint detection and response software and a previously compromised local administrator credential. Encryption began within seconds of authentication, with several hosts encrypted remotely over SMB.

Another intrusion began with an attacker impersonating IT support through an external Microsoft Teams tenant, using Quick Assist to obtain remote access and steal credentials. Those credentials were then reused through the organisation's virtual private network before the attacker moved through Remote Desktop Protocol, SMB and Impacket to gain full domain control.

Trusted tools

The report also described broader use of legitimate software and native system functions to hide malicious activity. It pointed to Gryxa, a financially motivated toolkit that used remote monitoring and management software alongside scheduled tasks, a Windows Management Instrumentation event subscription and duplicate file locations to maintain access.

Removing the visible remote-access client without eliminating the remaining persistence mechanisms could leave endpoint protection disabled or uninstalled within about 10 to 13 minutes. In one environment under investigation, defenders removed the visible implant, but another component remained active and the toolkit returned within seven days.

By sector, professional, scientific and technical services remained the industry most frequently named on data-leak sites, with manufacturing also a prominent target. Both sectors offer extortion groups either access to concentrations of client data and privileged connections, or valuable intellectual property and a low tolerance for operational disruption.

The report said defenders should link identity events to follow-on activity rather than treat them in isolation, including new device enrolments, MFA changes, SharePoint enumeration, bulk downloads and administrative protocol use from unexpected systems or accounts.