There is a dangerous assumption I still hear from businesses – it’s in Microsoft 365, so Microsoft has it backed up.
Microsoft certainly builds a lot of resilience into its cloud services, but resilience and backup are not the same thing.
A recent attack investigated by Microsoft is a useful reminder of why that distinction matters.
Security researchers found that a threat actor Microsoft tracks as Storm-3168, associated with JadePuffer, compromised two Azure service principals and used those trusted cloud identities to explore and then attack an organisation’s Azure environment.
This wasn’t somebody trying passwords at a login screen. The attacker had identities the cloud environment already trusted and once those identities were compromised, things moved quickly.
More than 100 storage accounts targeted for deletion
According to Microsoft, one compromised service principal spent hours mapping the Azure environment.
The second was then used for destructive activity and credential collection.
During a 35-minute period, Microsoft recorded more than 150 destructive or credential-related operations.
The most destructive part lasted around seven minutes.
More than 100 Azure Storage accounts were targeted for deletion, alongside attacks against other resources including a Key Vault and Function App. Attempts were also made against SQL databases.
But there is another part of the story that particularly caught my attention.
The attackers also went after recovery.
Microsoft says Azure Site Recovery locks and Azure Backup protection locks were among the resources targeted.
That makes perfect sense from a criminal’s point of view.
Deleting somebody’s data causes a problem. Deleting their data and their route back causes a much bigger one.
Microsoft said the behaviour was consistent with tactics that could support ransomware and extortion, although it did not observe a ransom note or confirm that data was successfully exfiltrated.
This isn’t really a story about Azure
Most small businesses aren’t running complex Azure environments full of SQL databases, Function Apps and service principals.
So it would be easy to read the story and move on.
I think there is a much simpler lesson. If an attacker compromises an identity with enough permission, the cloud will quite happily carry out the instructions that identity is authorised to give it.
That matters if your business runs on Microsoft 365.
Think about what is sitting there.
Email.
OneDrive.
SharePoint.
Teams.
Customer documents.
Financial information.
HR files.
Years of business records.
For many organisations, Microsoft 365 has quietly become one of their most important business systems.
That makes recovery worth thinking about before you need it.
Microsoft 365 retention isn’t the same as an independent backup
Microsoft 365 includes useful retention, recycle-bin and recovery features.
We absolutely want those switched on and configured properly, but I don’t believe they should be your only recovery plan.
Neither does the National Cyber Security Centre.
Its guidance for small organisations specifically says you shouldn’t rely solely on cloud services’ version history and deleted-file recovery mechanisms for important data.
It recommends keeping an independent copy in another safe place or service.
There is an important reason for the word independent.
The NCSC also advises organisations using SaaS platforms to make sure an incident affecting the main service cannot affect all of the backups as well.
It describes this as having separate “blast radiuses”.
Ideally, compromise of your Microsoft 365 environment shouldn’t automatically give somebody the keys to your backup environment too.
That is one of the reasons we recommend a dedicated third-party backup for Microsoft 365. A backup should give you another route back when something goes badly wrong.
Backup is only useful if the attacker can’t destroy it too
There is another lesson in the JadePuffer attack.
Simply having something labelled “backup” isn’t enough.
Attackers know backups make extortion much harder, so recovery systems increasingly become targets themselves.
The NCSC’s ransomware-resistant backup guidance recommends controls such as making backups resilient to destructive actions, retaining previous versions and generating alerts around significant or privileged changes.
So there are some useful questions to ask whoever looks after your Microsoft 365 environment:
Is our Microsoft 365 data independently backed up?
Does the backup use separate security and access controls?
Could a compromised Microsoft 365 administrator delete the backup as well?
How long can we go back?
Have we actually tested restoring data from it? A backup you have never restored is still partly a theory.
Protect the identity as well as the data
There is a second lesson from this incident.
Identity has become part of the security perimeter.
Traditional cyber security concentrated heavily on the laptop.
Protect the endpoint. Block the malware. Patch the machine.
Those things still matter, but an attacker using a stolen account, session token or authorised application may not need to install malware at all. They can simply log in.
That is why we increasingly recommend Identity Threat Detection and Response (ITDR) alongside traditional endpoint protection.
For Microsoft 365 environments, Huntress Managed ITDR can monitor for behaviour including suspicious logins, session hijacking, account takeover, malicious inbox rules, privilege abuse and rogue OAuth applications, with its SOC investigating threats around the clock.
That doesn’t mean Huntress ITDR would necessarily have detected the specific Azure service-principal compromise described by Microsoft.
It does address the wider problem the incident demonstrates what happens when somebody starts using an identity your systems already trust?
Stop as much as possible before the login is stolen
Then there is the layer before that.
Many identity compromises still begin with an email.
A convincing Microsoft 365 login page.
A fake document share.
Device-code phishing.
An invoice.
A request to “re-authenticate” an account.
This is why we also recommend adding a specialist email security layer such as Check Point Email Security rather than relying purely on Microsoft’s standard email filtering.
The aim isn’t to expect the person behind the keyboard to spot every clever attack. It is to stop as much malicious content as possible before they ever have to make that decision.
Security awareness still matters.
But good cyber security should put protection around people, not simply hand them another annual training course and make them responsible for catching whatever technology missed.
The answer isn’t another pile of security products
For a small business, this can start to sound daunting very quickly.
Backup.
MFA.
Email security.
Endpoint protection.
Identity monitoring.
Privileged accounts.
Recovery testing.
Another dashboard.
Another acronym.
Another thing somebody apparently needs to become an expert in.
That isn’t what we are suggesting. The objective is to build a few sensible layers around the systems the business genuinely depends on.
For a Microsoft 365-based small business, I’d start with these:
Protect access.
Use strong MFA, keep administrator accounts separate and minimise who has privileged access.
Protect email.
Reduce the chance of phishing, malicious attachments and impersonation reaching people in the first place.
Watch identities.
Look for the signs that somebody may already be using an account they shouldn’t have.
Back up independently.
Keep a recoverable copy of important Microsoft 365 data outside the same failure domain.
Test recovery.
Make sure you know how to get the data back.
That’s far more useful than buying security products because somebody frightened you into them.
Assume that prevention can fail
One thing I have learnt after more than 30 years working in IT is that occasionally things go wrong.
A password gets compromised.
Somebody grants permission to the wrong application.
A configuration gets changed.
A vulnerability appears.
An attacker finds a route nobody had considered.
Good cyber security isn’t based on pretending you can prevent every incident. It is about reducing the likelihood of one happening, spotting it quickly when it does, limiting how far it can spread and making sure you can recover afterwards.
The JadePuffer incident is an unusually technical example. But the lesson for a five-person business running Microsoft 365 is surprisingly straightforward:
Don’t just ask how you are protecting your Microsoft 365 data.
Ask how you would get it back.
Want to check your Microsoft 365 protection?
At Black Swan Cyber Security Solutions, we help small and micro businesses put proportionate protection around Microsoft 365 without needing their own cyber security team.
We can review your Microsoft 365 security, identity protection, email security and backup arrangements and explain what is worth fixing in plain English.
Book a free cyber security review and we’ll help you work out where the real gaps are.
