- Compromise a privileged account within the victim tenant (e.g., Global Administrator or Security Administrator).
- Establish inbound synchronization from an attacker-controlled tenant to the victim tenant.
- Provision malicious accounts within the victim tenant as needed.
- Maintain persistence and potentially move laterally across connected tenants.
Tag: Ransomware
Engage Report: Termite Ransomware
The Termite ransomware attempts to delete all Shadow Copies on the victim’s machine by executing the vssadmin.exe process with the necessary arguments. This is done to prevent the victim from recovering their system to a state before the files were encrypted.