CISA says unnamed US federal agency got hacked, attacker used valid credentials for users' Microsoft 365 and domain admin accounts

[xeni]

Originally published at: https://boingboing.net/2020/09/24/cisa-says-unnamed-us-federal-agency-got-hacked-attacker-used-valid-credentials-for-users-microsoft-365-and-domain-admin-accounts.html

…

[ficuswhisperer]

I wonder if multi-factor authentication would have largely mitigated this.

[spatley]

It undoubtedly would have avoided this particular vector.

[dragonfrog]

Using people’s legitimate credentials is definitely not an “unusual method” of hacking - it’s by far the most common one.