90 Days In The Dark

90 Days In The Dark

By Maxwell Skinner | December 31, 2025

We often hear that Multi-Factor Authentication (MFA) is the silver bullet for email security. But in the modern threat landscape, even silver bullets can miss.

At Bluewave Cyberdefense, we recently concluded a 90-day active intrusion investigation dubbed “Operation Locust.” This wasn’t a noisy ransomware attack that locked up servers in minutes. It was a silent, surgical campaign that started in the cloud, bypassed standard MFA, and pivoted to a physical endpoint—all while dodging traditional alerts.

Here is the technical breakdown of how the attack happened, how the adversary tried to cover their tracks, and how our proactive threat hunting team stopped them before a single dollar was stolen.

Phase 1: The Silent Entry (Cloud)

Timeline: September 17 – December 17, 2025

The attack began with a sophisticated Adversary-in-the-Middle (AiTM) phishing campaign using an “Axios” style kit. Unlike standard phishing that steals a password, this attack proxied the entire authentication session.

• The Bypass: The user successfully performed MFA, but the attacker captured the resulting Session Token. This gave them access to the account without needing to re-authenticate or trigger new MFA prompts.

• The Dwell: For roughly 90 days, the attacker sat quietly in the environment. They maintained access using a single compromised session token, periodically updating calendar configurations as a “heartbeat” to keep the session active.

• The Staging: To prepare for financial fraud, they created a hidden inbox rule named simply “.” (dot). This rule diverted emails from specific external domains directly to the “RSS Feeds” folder, ensuring the victim would never see incoming warning signs.

Phase 2: The Pivot (Cloud to Endpoint)

Timeline: November – December 10, 2025

Standard BEC actors stay in the email.  This threat actor moved laterally. “Operation Locust” attempted to bridge the gap between the cloud and the physical network.

1. The Cloud Probe: On November 18, the attacker attempted to register a rogue device named DESKTOP-RT45G directly into the client’s Entra ID environment to establish deeper persistence. Fortunately, Conditional Access policies blocked this attempt, flagging the device as unmanaged.

2. The Endpoint Infection: Undeterred, the attacker shifted tactics. On December 10, they successfully compromised a corporate laptop (FIN-LAPTOP-01) after the user downloaded a weaponized ZIP file (Q3_Financial_Review.zip) containing a malicious LNK shortcut.

Phase 3: The Cover-Up (Anti-Forensics)

Timeline: December 15, 2025

This is where the incident went from “suspicious” to “critical.”

On December 15 at 09:09 UTC, they ran the WEVTUTIL command four times in a single second.

Their goal? To wipe the Windows Security and System Logs entirely.

The Resolution: Hunting Wins Where Tools Fail

Containment: December 17, 2025

Despite the log wiping and the hidden inbox rules, the Bluewave team identified the intrusion during a proactive threat hunt.

We didn’t wait for a “virus found” alert. We looked for the anomalies that tools miss:

• User-Agent Analysis: Identifying a “Macintosh” user agent accessing a Windows-only user’s mail.

• Prefetch Analysis: Even though the Event Logs were wiped, Windows Prefetch files proved that NET.EXE, SC.EXE, and WEVTUTIL.EXE had been executed manually, confirming hands-on-keyboard activity.

The Outcome:

• Financial Fraud: $0.00 stolen.

• Data Exfiltration: None observed.

• Status: All sessions revoked, the rogue device blocked, and the endpoint isolated for remediation.

The Takeaway

Complexity is the enemy of security. “Operation Locust” succeeded initially because it exploited the complexity of session tokens and user trust. It failed because a human defense team was looking for the subtle signs of behavior that software ignores.

1. Tune Your Detections for “Anti-Forensics” Most monitoring tools look for malware installation. You need to look for cover-ups. Ensure your detection engineering includes rules for high-fidelity “red flags” like the execution of WEVTUTIL (log clearing) or the creation of single-character inbox rules (like the “.” rule we found). These are rarely legitimate administrative actions and almost always indicate a breach in progress.

2. Establish a Threat Hunting Cadence Tools are passive; hunters are active. Automated alerts will catch the “known bad,” but they often miss the “unknown weird.” You must have a regular cadence—whether weekly or monthly—where a human analyst proactively reviews logs for anomalies like “Impossible Travel” or User-Agent mismatches (e.g., a Mac accessing a PC-only user’s account). This human context is what caught the initial pivot in this case.

3. Harden Your Conditional Access (Do This Today) You don’t need a new vendor to do this. In this incident, the attacker tried to register a rogue device (DESKTOP-RT45G) to the cloud, but they were blocked by a Conditional Access policy that restricted unmanaged devices. Go into your Entra ID (Azure AD) settings and ensure you have policies that block “Join/Register” actions from unknown or non-compliant devices. This one configuration saved this client from a much deeper persistence foothold.