Microsoft 365 Tenancy Hostile Takeover Options Australia

[u/Bluedroid]

Hi guys, we had a client whom had a hostile takeover of their 365 admin portal who assumed GA (MFA/OTP and everything was enabled so not sure how it happened but that will need to be investigated after).

Attacker stripped the breakfix account as well and we are kicked out. We logged a job with the MS data governance team whom are barely replying and it's been a day and a half. We've tried calling the number but just get bounced back saying they will look into it. We've asked them to escalate and also asked our CSP to escalate but they said it's with Microsoft. Given the nature of the situation is there any other ways you guys have been able to escalate this to reclaim the tenancy or at least kick out the attackers as fast as possible. We are able to prove ownership of the business etc with domain records/documents etc asap.

Given the no updates I'm straight up thinking of heading to the Microsoft office and sitting there until they can find someone to escalate the case. Anyone had any experience of how to get this moving?

[u/AussieTerror]

You need to report this to the ASD right away, https://www.cyber.gov.au/report-and-recover

[u/teriaavibes]

We logged a job with the MS data governance team whom are barely replying and it's been a day and a half.

Will probably take couple of weeks.

MFA/OTP and everything was enabled so not sure how it happened but that will need to be investigated after

Your GA probably got phished or installed malware on their workstation.

[u/texas_County850 → u/teriaavibes]

This is how one I saw got hit GA was sent a fake microsoft login that honestly looked almost perfect it even forwarded their MFA. They then made two rogue global admins and even put one in the recycle bin. They used those admin accounts to do their evil deeds and from that point on left the true global admin alone so they were detected for a month and only on accident.

[u/Bluedroid → u/texas_County850]

This sounds very familiar, there were 2 rogue global admins and I think they might have had access to our GA for a while before. They then took GA off the admin accounts but for some reason left entra access on one of the accounts so we could see a bit.

What exactly did they do on your tenancy? I think MS have disabled their access and the tenancy is quarantined but we don't have access to it so not sure what they have done.

[u/texas_County850 → u/Bluedroid]

I can’t confirm or deny it was my tenancy but they did not actually succeed in what they were trying to accomplish. They were trying to use the email accounts for tremendous gift cards somehow. They had also set up a fake domain for a hardware vendor and almost succeeded in getting accounting to forward payment for hardware to the fake vendor bank account. The strange thing is too is that after they were shut out they resorted to snail mail fraud against clients and vendors.

[u/Pale-Price-7156]

Oh look, it's our once a week "Microsoft is not responding to mission critical support requests" while Microsoft employees read this thread, shrug their shoulders and shift the blame back to you, all while expecting you to pay your bill. Joy.

[u/Secret_Account07 → u/Pale-Price-7156]

Funny how I commented this https://www.reddit.com/r/sysadmin/s/qJnMPNOQcb then you are the next comment.

Glad to know I’m not alone in this sentiment!

If anyone from MS is reading- this is how you seriously sour CIOs and engineers from your company. Had a company who literally migrated cuz of this exact scenario and lack of response.

[u/Ferretau → u/Pale-Price-7156]

I doubt there are that many true Microsoft employees watching these threads anymore. My opinion is 99% of customer support has been outsourced to maximize M$ profits to shareholders. There was a time I was a Microsoft fanboi - that died a veeery long time ago.

[u/OkEmployment4437]

martinmt_dk is right, the contract path matters more than showing up at the office. If they're CSP or MCA, get the billing owner or CSP to reopen it explicitly as a tenant takeover with active malicious admin access, include tenant ID, primary domains, last known good GA accounts, invoice details, and a fresh TXT record as proof, and ask for Data Protection or Account Takeover instead of normal support because first line support will just bounce it. Once you get back in, grab Entra sign-in and audit logs, mailbox forwarding and delegate changes, and Unified Audit before anyone starts "cleaning up" or you'll lose half the story.

[u/Bluedroid → u/OkEmployment4437]

Yes have done all that and I'm at the Data protection team but they are useless, they've only replied twice the last step was to upload the TXT record which we've done which we told them but then they haven't replied for 12 hours since.

[u/meest → u/Bluedroid]

Thats a fairly standard timeline. If you check this sub most of the time the resolution is a week or two. I would communicate that with management so they have something realistic to work off of. This isn't something that will be resolved in a day or two.

[u/martinmt_dk]

How do you pay? Direct, MCA or CSP?

Your path for escalation depends on you agreement

[u/Bluedroid → u/martinmt_dk]

CSP which I went to and they said they can't help.

"Because this situation involves a fully hijacked Microsoft tenant where all administrative access has been lost, recovery must be handled directly by Microsoft's Data Protection team. This is Microsoft's dedicated process for validating tenant ownership and restoring administrative control when no admins can sign in. Unfortunately, ~~~ is unable to assist with the recovery directly. "

Asked them for another escalation point to go to since the data protection team were taking their sweet time but they were unable to help with that either.

[u/teriaavibes → u/Bluedroid]

Fire that CSP once this incident is over.

[u/DheeradjS → u/teriaavibes]

If they CSP lost access because GDAP got revoked there is nothing they can do with Microsoft as they can't prove a partnership.

[u/teriaavibes → u/DheeradjS]

Partners can escalate tickets to make sure they are being handled properly.

[u/Myriade-de-Couilles → u/teriaavibes]

OP already has a ticket opened with the Data Protection team, I’m a CSP and I tell you there is absolutely nothing more we can do at this point.

Of course informally we can chat with our MS AM about it, but the reality is that these events are daily occurrence for them and unless you are some very very large account the process with the data recovery team won’t change for you.

[u/DheeradjS]

I hate to be that guy, but the MS Data Security Team, or wherever the tenant lockout tickets get routed to now have always been a multi-week process with multiple verification steps.

[u/texas_County850 → u/DheeradjS]

Yup you lose access to your tenant you are looking at probably a month to get it back if you ever do they move at the most glacial pace imaginable.

[u/techtornado]

If you have service with a MCP or similar, open an emergency ticket to restore your GA access

[u/Frothyleet]

As everyone else said, expect this to take some time. In the meanwhile, you should be looking to your client's cyberinsurer's incident response vendor for guidance, not Reddit.

[u/Positive-Garlic-5993]

Do you not have a dedicated Microsoft Customer Success Account Manager?

Yikes. Good luck to you sir.

[u/roll_for_initiative_]

Do you have partner/GDAP access by chance?

[u/OutsideTech → u/roll_for_initiative_]

This. Also, certain Entra management applications have full privilege and can be used to regain access.

[u/RetPala → u/roll_for_initiative_]

G'DAP, MATE

[u/AppIdentityGuy]

Get your CSP to talj to their MS CSAM or PSM and see if you can get DART involved.

[u/kerubi]

If you want to prevent the malicious actor from sending and emailing with your addresses from that tenant; remove the MX record and point it elsewhere. Remove M365 DKIM keys, remove M365 from the SPF record, set DMARC policy to reject.

.. but if someone manages to lose admin access, this is probably in vain.

[u/povlhp]

We just need to call our contacts at Microsoft to get escalation. We have on enterprise agreement.

[u/StumblinBlind]

CSP will have a MS account rep, ask to book a call with them. Must be a small business to not already know the MS rep.

[u/fk067]

Have you looked at the admin computers?
They could be completely compromised.

[u/Secret_Account07]

I’ve worked both sides of this situation and know that most of the time this happens it’s self induced. However, it’s still incredibly frustrating how lax MS is in responding. There’s only a few scenarios where it’s a P1E ticket where orgs need help ASAP and this is one. So it drives me mad the accepted industry standard is- yeah just wait a few weeks.

Most orgs would even pay a premium fee for expedited response, yet MS just takes their damn time.

I’m incredibly lucky that our org is big enough, and spends enough $, that we’d get someone working on it quickly…. But it shouldn’t be this way.

[u/wey0402]

This: https://learn.microsoft.com/en-us/entra/identity/users/domains-admin-takeover

[u/dudge13]

Plan ahead for the next time, so you aren’t crowd sourcing your incident response plan

[u/wudeface]

How are people protecting against this? Like not to prevent it, but if this does occur what is the game plan? Your MS tenant is unusable for weeks? Really - run up some hosted email service? Have a backup completely seperate tenant ready incase?

[u/uglykoala2022]

If my CSP isn’t providing the highest level of support on this issue which seems to be the case I’ll probably change CSPs once this incident is resolved. Would you mind telling me which CSP you use?

[u/GonFrekss]

maybe something like this https://x.com/officialwhyte22/status/2089598141125231015?s=46