CY-GAP-IAS-7C4A91D2-01OPENHIGH
ACTOR_CAMPAIGN_IDENTITY
جارٍ تحميل البيانات التشغيلية
IAS
OAuth/OIDC, SSO/federation, MFA, session/token theft, identity-provider abuse, certificate-based authentication, privileged remote-access identity brokers, AD/Entra identity attack paths and identity control-plane security.
3
36
190
86
8
٠٣/١١/٢٠٢٦، ١:١٣ م
ACRIP-IAS-20261101T130700Z-D4B81F63 CLOSED/PASS. Third IAS Topic active; canonical/Method Yield/IAS SSOT/Commit Journal/Hot-Start readback passed. Prior IAS Topics preserved separately; protected Core unchanged.
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
الإجمالي: 16 Evidence
No independent public incident origin currently corroborates the exact Microsoft help-desk/Quick Assist→AD CS ESC1/ESC8 chain; actor identity, victim denominator and campaign prevalence remain unresolved.
Independent IR/EDR/CERT telemetry linking the same sequence, actor/infrastructure evidence, victim counts or authoritative campaign reporting.
No representative denominator establishes current enterprise prevalence of exploitable ESC1/ESC8 configurations, and no multi-environment dataset measures certificate-aware containment outcomes.
Representative AD CS posture telemetry plus independent incident/control-outcome measurements.
UNC6671/BlackFile, PREY-0058, Microsoft Storm labels and The-Com-linked operators cannot be safely merged from shared vishing/AiTM/SaaS-exfiltration tradecraft.
Shared victim/time/infrastructure/operator artifacts or authoritative alias mapping.
UNC6671/BlackFile, PREY-0058, Microsoft Storm labels and The-Com-linked operators cannot be safely merged from shared vishing/AiTM/SaaS-exfiltration tradecraft.
Shared victim/time/infrastructure/operator artifacts or authoritative alias mapping.
No representative denominator or controlled multi-environment dataset quantifies prevalence or comparative effectiveness of phishing-resistant MFA/device-bound passkeys, managed-device CA, device-code restrictions and strict security-info registration.
Representative tenant/sector denominator plus normalized control deployment and before/after outcomes.
No authoritative public denominator establishes widespread exploitation after disclosure; BeyondTrust last named two impacted customers and no observed activity since August.
Independent IR/CERT/provider victim telemetry or updated authoritative denominator.
Exact credentials successfully extracted, downstream identities/endpoints accessed and data-loss denominator remain incompletely public.
Victim vault audit, rotation scope, downstream session/file-transfer evidence and IR outcomes.
ARMORY CASTLE/UNC5221/WARP PANDA attribution is source-qualified but independent public forensic attribution beyond coordinated incident evidence is limited.
Separate authoritative/provider attribution with actor-linked infrastructure/malware/operational artifacts.