{"id":48587,"date":"2022-09-23T10:01:00","date_gmt":"2022-09-23T10:01:00","guid":{"rendered":"http:\/\/918f5e4d-1faa-426b-ad95-8ba9d06bb0fa"},"modified":"2022-09-23T10:01:00","modified_gmt":"2022-09-23T10:01:00","slug":"why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\/","title":{"rendered":"Why MFA matters: These attackers cracked admin accounts then used Exchange to send spam"},"content":{"rendered":"<figure class=\"c-shortcodeImage u-clearfix c-shortcodeImage-large\">\n<div class=\"c-shortcodeImage_imageContainer\">\n<div class=\"c-shortcodeImage_image\"><picture class=\"c-cmsImage c-cmsImage_loaded\"><source media=\"(max-width: 767px)\" srcset=\"https:\/\/www.zdnet.com\/a\/img\/resize\/4ab1a044fcdfec1980d2266dc13ef5f394e27bcc\/2018\/03\/22\/ff012aa3-245b-46ae-9964-4bf4e9cae01c\/woman-annoyed-laptop-istock.jpg?auto=webp&amp;width=768\" alt=\"woman-annoyed-laptop-istock.jpg\"><source media=\"(max-width: 1023px)\" srcset=\"https:\/\/www.zdnet.com\/a\/img\/resize\/b437eba2c2fd9addaeb97f437c923ab2e05c4a6d\/2018\/03\/22\/ff012aa3-245b-46ae-9964-4bf4e9cae01c\/woman-annoyed-laptop-istock.jpg?auto=webp&amp;width=1024\" alt=\"woman-annoyed-laptop-istock.jpg\"><source media=\"(max-width: 1440px)\" srcset=\"https:\/\/www.zdnet.com\/a\/img\/resize\/21711b9e24f724eccd72ccf4cfeb5c34262377c1\/2018\/03\/22\/ff012aa3-245b-46ae-9964-4bf4e9cae01c\/woman-annoyed-laptop-istock.jpg?auto=webp&amp;width=1200\" alt=\"woman-annoyed-laptop-istock.jpg\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.zdnet.com\/a\/img\/resize\/21711b9e24f724eccd72ccf4cfeb5c34262377c1\/2018\/03\/22\/ff012aa3-245b-46ae-9964-4bf4e9cae01c\/woman-annoyed-laptop-istock.jpg?auto=webp&amp;width=1200\" alt=\"woman-annoyed-laptop-istock.jpg\" height=\"800\" width=\"1200\" fetchpriority=\"low\"><\/picture><\/div>\n<p> <!----> <!----><\/div>\n<p> <!----><figcaption> <span class=\"c-shortcodeImage_credit g-outer-spacing-top-xsmall u-block\">Image: Getty Images\/iStockphoto<\/span><\/figcaption><\/figure>\n<p>Microsoft has exposed a crafty case of OAuth app abuse that allowed the attackers to reconfigure the victim&#8217;s Exchange server to send spam.&nbsp; &nbsp; &nbsp;<\/p>\n<p>The point of the elaborate attack was to make mass spam \u2013 promoting a fake sweepstake \u2013 look like it originated from the compromised Exchange domain rather than the actual origins, which were either their own IP address or third-party email marketing services, according to Microsoft.&nbsp;<\/p>\n<p>The sweepstake ruse was used to trick recipients into providing credit card details and signing up for recurring subscriptions.&nbsp;<\/p>\n<div class=\"c-shortcodePinbox-textList c-shortcodePinbox-textList_floating g-border-thin-light-bottom g-outer-spacing-top-medium g-outer-spacing-bottom-medium\">\n<h3 class=\"c-sectionHeading\">More Microsoft<\/h3>\n<\/p><\/div>\n<p>&#8220;While the scheme possibly led to unwanted charges for targets, there was no evidence of overt security threats such as credential phishing or malware distribution,&#8221; the Microsoft 365 Defender Research Team said.<\/p>\n<p><strong>Also:&nbsp;<\/strong><a href=\"https:\/\/www.zdnet.com\/education\/computers-tech\/what-is-cybersecurity-and-why-cybersecurity-matters\/\" rel=\"follow\">What, exactly, is cybersecurity? And why does it matter?<\/a><\/p>\n<p>To make the Exchange server send their spam, the attackers first compromised the target&#8217;s poorly protected cloud tenant and then gained access to privileged user accounts to create malicious and privileged OAuth applications within the environment. OAuth apps let users grant limited access to other apps, but the attackers here used it differently.&nbsp;<\/p>\n<p>None of the administrator accounts that were targeted had multi-factor authentication (MFA)&nbsp;switched on, which could have stopped the attacks.<\/p>\n<p>&#8220;It is also important to note that all the compromised admins didn&#8217;t have MFA enabled, which could have stopped the attack. These observations amplify the importance of securing accounts and monitoring for high-risk users, especially those with high privileges,&#8221; Microsoft said.<\/p>\n<p>Once inside, they used Azure Active Directory (AAD) to register the app, added a permission for app-only authentication of Exchange Online PowerShell module, granted admin consent to that permission, and then gave global admin and Exchange admin roles to the newly registered app.&nbsp; &nbsp; &nbsp; &nbsp;<\/p>\n<p>&#8220;The threat actor added their own credentials to the OAuth application, which enabled them to access the application even if the initially compromised global administrator changed their password,&#8221; Microsoft notes.&nbsp;<\/p>\n<p>&#8220;The activities mentioned gave the threat actor control of a highly privileged application.&#8221;<\/p>\n<p>With all this in place, the attackers used the OAuth app to connect to the Exchange Online PowerShell module and change Exchange settings, so that the server routed spam from their own IP addresses related to the attacker&#8217;s infrastructure.&nbsp;<\/p>\n<figure class=\"c-shortcodeImage u-clearfix c-shortcodeImage-large\">\n<div class=\"c-shortcodeImage_imageContainer\">\n<div class=\"c-shortcodeImage_image\"><picture class=\"c-cmsImage\"><!----> <img decoding=\"async\" src=\"https:\/\/www.zdnet.com\/article\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\/\" alt=\"fig1-attack-chain.png\" height=\"576.9230769230769\" width=\"1200\" fetchpriority=\"low\"><\/picture><\/div>\n<p> <!----> <!----><\/div>\n<p> <!----><figcaption> <span class=\"c-shortcodeImage_credit g-outer-spacing-top-xsmall u-block\">Source: Microsoft<\/span><\/figcaption><\/figure>\n<p>To do this they used a Exchange server feature called &#8220;<a href=\"https:\/\/learn.microsoft.com\/en-us\/exchange\/mail-flow\/connectors\/connectors?view=exchserver-2019\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">connectors<\/a>&#8221; for customizing the way email flows to and from organizations using Microsoft 365\/Office 365. The actor created a new inbound connector and setup a dozen &#8220;<a href=\"https:\/\/learn.microsoft.com\/en-gb\/exchange\/security-and-compliance\/mail-flow-rules\/mail-flow-rules\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">transport rules<\/a>&#8221; for Exchange Online that deleted a set of headers in the Exchange-routed spam to boost the success rate of the spam campaign. Removing the headers allows the email to evade detection by security products.&nbsp;<\/p>\n<p>&#8220;After each spam campaign, the actor deleted the malicious inbound connector and transport rules to prevent detection, while the application remained deployed in the tenant until the next wave of the attack (in some cases, the app was dormant for months before it was reused by the threat actor),&#8221; Microsoft explains. &nbsp; &nbsp;<\/p>\n<p>Microsoft last year detailed how attackers were <a href=\"https:\/\/www.zdnet.com\/article\/microsoft-warns-about-this-phishing-attack-that-wants-to-read-your-emails\/\" rel=\"follow\">abusing OAuth for consent phishing<\/a>. Other known uses of OAuth applications for malicious purposes include command-and-control (C2) communication, backdoors, phishing, and redirections. Even Nobelium, the group that attacked SolarWinds in a supply chain attack, have <a href=\"https:\/\/www.microsoft.com\/security\/blog\/2021\/10\/25\/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">abused OAuth to enable broader attacks<\/a>.&nbsp;<\/p>\n<p>READ MORE <a href=\"https:\/\/www.zdnet.com\/article\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\/#ftag=RSSbaffb68\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>None of the accounts broken into had MFA enabled, which could have stopped the attack from progressing so fast.<br \/>\nREAD MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-48587","post","type-post","status-publish","format-standard","hentry","category-zdnet-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Why MFA matters: These attackers cracked admin accounts then used Exchange to send spam 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Why MFA matters: These attackers cracked admin accounts then used Exchange to send spam 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2022-09-23T10:01:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.zdnet.com\/a\/img\/resize\/21711b9e24f724eccd72ccf4cfeb5c34262377c1\/2018\/03\/22\/ff012aa3-245b-46ae-9964-4bf4e9cae01c\/woman-annoyed-laptop-istock.jpg?auto=webp&amp;width=1200\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Why MFA matters: These attackers cracked admin accounts then used Exchange to send spam\",\"datePublished\":\"2022-09-23T10:01:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\\\/\"},\"wordCount\":583,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/21711b9e24f724eccd72ccf4cfeb5c34262377c1\\\/2018\\\/03\\\/22\\\/ff012aa3-245b-46ae-9964-4bf4e9cae01c\\\/woman-annoyed-laptop-istock.jpg?auto=webp&amp;width=1200\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\\\/\",\"name\":\"Why MFA matters: These attackers cracked admin accounts then used Exchange to send spam 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/21711b9e24f724eccd72ccf4cfeb5c34262377c1\\\/2018\\\/03\\\/22\\\/ff012aa3-245b-46ae-9964-4bf4e9cae01c\\\/woman-annoyed-laptop-istock.jpg?auto=webp&amp;width=1200\",\"datePublished\":\"2022-09-23T10:01:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/21711b9e24f724eccd72ccf4cfeb5c34262377c1\\\/2018\\\/03\\\/22\\\/ff012aa3-245b-46ae-9964-4bf4e9cae01c\\\/woman-annoyed-laptop-istock.jpg?auto=webp&amp;width=1200\",\"contentUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/21711b9e24f724eccd72ccf4cfeb5c34262377c1\\\/2018\\\/03\\\/22\\\/ff012aa3-245b-46ae-9964-4bf4e9cae01c\\\/woman-annoyed-laptop-istock.jpg?auto=webp&amp;width=1200\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Why MFA matters: These attackers cracked admin accounts then used Exchange to send spam\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Why MFA matters: These attackers cracked admin accounts then used Exchange to send spam 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\/","og_locale":"en_US","og_type":"article","og_title":"Why MFA matters: These attackers cracked admin accounts then used Exchange to send spam 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2022-09-23T10:01:00+00:00","og_image":[{"url":"https:\/\/www.zdnet.com\/a\/img\/resize\/21711b9e24f724eccd72ccf4cfeb5c34262377c1\/2018\/03\/22\/ff012aa3-245b-46ae-9964-4bf4e9cae01c\/woman-annoyed-laptop-istock.jpg?auto=webp&amp;width=1200","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Why MFA matters: These attackers cracked admin accounts then used Exchange to send spam","datePublished":"2022-09-23T10:01:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\/"},"wordCount":583,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\/#primaryimage"},"thumbnailUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/21711b9e24f724eccd72ccf4cfeb5c34262377c1\/2018\/03\/22\/ff012aa3-245b-46ae-9964-4bf4e9cae01c\/woman-annoyed-laptop-istock.jpg?auto=webp&amp;width=1200","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\/","url":"https:\/\/www.threatshub.org\/blog\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\/","name":"Why MFA matters: These attackers cracked admin accounts then used Exchange to send spam 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\/#primaryimage"},"thumbnailUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/21711b9e24f724eccd72ccf4cfeb5c34262377c1\/2018\/03\/22\/ff012aa3-245b-46ae-9964-4bf4e9cae01c\/woman-annoyed-laptop-istock.jpg?auto=webp&amp;width=1200","datePublished":"2022-09-23T10:01:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\/#primaryimage","url":"https:\/\/www.zdnet.com\/a\/img\/resize\/21711b9e24f724eccd72ccf4cfeb5c34262377c1\/2018\/03\/22\/ff012aa3-245b-46ae-9964-4bf4e9cae01c\/woman-annoyed-laptop-istock.jpg?auto=webp&amp;width=1200","contentUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/21711b9e24f724eccd72ccf4cfeb5c34262377c1\/2018\/03\/22\/ff012aa3-245b-46ae-9964-4bf4e9cae01c\/woman-annoyed-laptop-istock.jpg?auto=webp&amp;width=1200"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/why-mfa-matters-these-attackers-cracked-admin-accounts-then-used-exchange-to-send-spam\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Why MFA matters: These attackers cracked admin accounts then used Exchange to send spam"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/48587","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=48587"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/48587\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=48587"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=48587"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=48587"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}