ACRIP Command Center

PRODUCTIONNeon main٠٧:٠٤ م

Canonical Run ID

ACRIP-IAS-20261101T100800Z-7C4A91D2

ناجح · PASS

What ran?GENERAL_DISCOVERY

Discover and select the highest-value current identity/authentication development from Hot-Start; rank freshness + technical impact + evidence strength + real-world exploitation + defensive value; exclude already-covered Topic identities before durable commit.

Why this Topic?Passkey-Themed Help-Desk Vishing → Cloud Identity Persistence & SaaS Exfiltration

NEW_TOPIC

Confidenceغير مسجل

Research result: PASS

HOT_STARTغير مسجلDISCOVERYغير مسجلVALIDATIONغير مسجلDEDUPEغير مسجلCOMMITPASSREADBACKPASSCLOSUREPASS

Domain: Identity & Authentication Security
Run date: ٠١‏/١١‏/٢٠٢٦، ٣:٠٠ ص
Last verified: غير مسجل
Prior memory: محمّلة
Source status: CLOSED
Publication: DRAFT

Raw top scorer Oct-30 AD CS chain was excluded as exact CY-TOP-IAS-001 duplicate. Selected passkey/help-desk vishing→AiTM/device-code/session compromise→attacker MFA persistence→Graph/SaaS collection; AuthMask CVE deprioritized because no public exploitation evidence.

EVIDENCE

الأدلة وما تثبته

4 سجل

Supports: Observed cloud identity takeover sequence, authentication persistence, Graph/SaaS collection and defensive controls.
Does not prove: Passkey protocol flaw, one actor/campaign, representative prevalence, or that every service access event equals exfiltration.
Confidence: غير مسجل
Context: AiTM or device-code → session/token compromise → authentication-method persistence

Microsoft Security Researchفتح المصدرCY-T2 / Primary vendor incident research

CONTRADICTIONS

التناقضات والقيود

لا توجد تناقضات مسجلة لهذه الجولة.

UNCERTAINTY

الفجوات غير المحسومة

{"Notes":"Identity-before-dedupe guardrail.","Gap ID":"CY-GAP-IAS-7C4A91D2-01","Impact":"Blocks single-actor attribution and campaign-unification claims.","Status":"OPEN","Gap Type":"ACTOR_CAMPAIGN_IDENTITY","Priority":"HIGH","Domain ID":"CY-DOM-004","Topic IDs":"CY-TOP-IAS-7C4A91D2,CY-TOP-IAS-001","Description":"UNC6671/BlackFile, PREY-0058, Microsoft Storm labels and The-Com-linked operators cannot be safely merged from shared vishing/AiTM/SaaS-exfiltration tradecraft.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-IAS-20261101T100800Z-7C4A91D2","Required Evidence / Resolution":"Shared victim/time/infrastructure/operator artifacts or authoritative alias mapping."}
{"Notes":"Strong mechanism/guidance does not establish causal population-level effectiveness.","Gap ID":"CY-GAP-IAS-7C4A91D2-02","Impact":"Blocks population-risk and generalized control-effectiveness claims.","Status":"OPEN","Gap Type":"PREVALENCE_CONTROL_EFFECTIVENESS","Priority":"HIGH","Domain ID":"CY-DOM-004","Topic IDs":"CY-TOP-IAS-7C4A91D2,CY-TOP-CSS-001","Description":"No representative denominator or controlled multi-environment dataset quantifies prevalence or comparative effectiveness of phishing-resistant MFA/device-bound passkeys, managed-device CA, device-code restrictions and strict security-info registration.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-IAS-20261101T100800Z-7C4A91D2","Required Evidence / Resolution":"Representative tenant/sector denominator plus normalized control deployment and before/after outcomes."}

FOLLOW-UP

المتابعات غير المحسومة

2 مفتوحة

Priority: HIGH · Created: ٠٣‏/١١‏/٢٠٢٦، ١:١٣ م

AUDIT TIMELINE

السجل الزمني الكامل

0 حدث

لا توجد run_events تاريخية لهذه الجولة؛ تُعرض حالات Lifecycle أعلاه كما هي من سجل Run ولا يتم اختلاق أحداث بديلة.

PERSISTENCE / READBACK

سلامة الالتزام والـReadback

Commit

ACRIP-COMMIT-IAS-7C4A91D2

COMMITTED · Readback PASS

SELF

SnapshotACRIP-SNAP-IAS-7C4A91D2

Integrity: PASS · غير مسجل

Evidence 142 · Hypotheses 100 · Runs 27

Payload fingerprint

4688716e1d258c29e90dc389b50b58034269136be15803ec88762d3adad4005a

Canonical persistence

Commit: PASS · Readback: PASS · Closure: PASS

PASS — CENTRAL CANONICAL COMMIT/READBACK + COMMIT JOURNAL + IAS SSOT + HOT-START Domain/Topic/Hypothesis/Gap/Watch/Recent-Run readback verified. Unique run-scoped IDs and 13 non-orphan edges confirmed. Shared Method Yield aggregate experienced concurrent last-writer contention; the run-scoped methodology observation remains persisted and was not used to inflate research truth. Protected Core root unchanged. Run package: https://docs.google.com/document/d/16YiGwVZxhVwkvIMl1pfV1j7MbZaUspS3Odnksqr1wDw/edit

Drive Run Domain Store

العودة إلى سجل الجولات

تدقيق الجولة

الأدلة وما تثبته

Active cloud intrusions use passkey/MFA/SSO help-desk lures to drive AiTM or device-code authentication, compromise sessions/tokens, add authentication methods, perform Graph reconnaissance and access M365 content.

التناقضات والقيود

الفجوات غير المحسومة

المتابعات غير المحسومة

ACTOR_CAMPAIGN_IDENTITY

PREVALENCE_CONTROL_EFFECTIVENESS

السجل الزمني الكامل

سلامة الالتزام والـReadback

UNC6671 uses help-desk vishing, AiTM SSO compromise, attacker-controlled MFA registration and automated Microsoft 365/Okta/SaaS data theft; replayed session cookies can retrieve content in ways recorded as FileAccessed rather than FileDownloaded.

Arctic Wolf tracks widespread PREY-0058 IT-impersonation/vishing that bypasses MFA through social engineering, gains Microsoft 365/SaaS access and performs rapid automated data exfiltration followed by extortion; overlap with UNC6671 is reported without identity equivalence.