attack-path / defense (cmmc contractor) / cred-theft-lateral-movement

Cred theft AA24-057A

Engine-driven compliance rail for Credential theft → MFA fatigue → lateral movement (remote-user SaaS path) on the Defense (CMMC contractor) protect-surface layout. Step controls cycle through the engine's Trust-Failure chain; each step shows the in-scope provisions the failure implicates and, where a regulatory clock applies, the obligation diamond.

advisoryCISA · Joint Cybersecurity Advisory AA24-057A — SVR Cyber Actors Adapt Tactics for Initial Cloud Access (AA24-057A)

resolved atDefense (CMMC contractor) · Defense contractor with CUI enclave · Remote user opens a SaaS application

step 01TF2observedATT&CK T1110

stage 2

Adversary obtains password via brute force or password spraying against a remote-user SaaS login surface. AA24-057A: "SVR use password spraying and brute forcing as an initial infection vector."

mitigating controls

idpmfa-authenticatorca-pkikms-secretspam

in-scope provisions (6)

partialPR.AA-01 — Identity Management, Authentication, and Access Controlnist-csf-2-0disc:highpendingEvidence
partialPR.AA-02 — Identity Management, Authentication, and Access Controlnist-csf-2-0disc:highpendingEvidence
partialPR.AA-03 — Identity Management, Authentication, and Access Controlnist-csf-2-0disc:highpendingEvidence
partialPR.AA-04 — Identity Management, Authentication, and Access Controlnist-csf-2-0disc:highpendingEvidence
partialPR.AA-05 — Identity Management, Authentication, and Access Controlnist-csf-2-0disc:highpendingEvidence
partialAccount Managementnist-sp-800-171-r3disc:highpendingEvidence

obligation

no regulatory clock for this step

protect-surface storyline (DAAS cards)

01
Initial Access
identity-svc
Phishing-resistant MFA is not enforced for every principal. A high-privilege identity yields its password to a phishing portal; the PE accepts the reused secret.
02
Discovery
crm
The compromised identity logs into Salesforce and pivots through field-level data, mapping the customer base and the privileged-user list for the next hop.
03
Lateral Movement
google-workspace
The same federated identity is replayed against Google Workspace. AA24-057A documents Midnight Blizzard’s SaaS-to-SaaS pivots via OAuth tokens granted under the assumed principal.
04
Exfiltration
customer-pii
Customer PII is exported through legitimate SaaS APIs under the stolen identity — no anomaly fires because the access pattern is a valid-account one (T1078).

Compliance rail (text fallback)

Step 1 — TF2 (stage 2) · ATT&CK T1110 · evidence: observed

Adversary obtains password via brute force or password spraying against a remote-user SaaS login surface. AA24-057A: "SVR use password spraying and brute forcing as an initial infection vector."
- Mitigating controls: idp, mfa-authenticator, ca-pki, kms-secrets, pam
- Provisions in scope: nist-csf-2-0#PR.AA-01 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-02 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-03 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-04 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-05 (partial, disc:high, pendingEvidence); nist-sp-800-171-r3#03.01.01 (partial, disc:high, pendingEvidence)
Step 2 — TF2 (stage 2) · ATT&CK T1621 · evidence: observed

MFA bombing — adversary repeatedly pushes MFA prompts until the user accepts. AA24-057A: "The SVR repeatedly push MFA requests to a victim's device until the victim accepts the notification, providing SVR access to the account."
- Mitigating controls: idp, mfa-authenticator, ca-pki, kms-secrets, pam
- Provisions in scope: nist-csf-2-0#PR.AA-01 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-02 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-03 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-04 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-05 (partial, disc:high, pendingEvidence); nist-sp-800-171-r3#03.01.01 (partial, disc:high, pendingEvidence)
Step 3 — TF3 (stage 3) · evidence: reported

No device-trust posture signal reaches the PE — the request originates from an attacker-controlled device that the tenant has no enrollment record of, but device-enrollment policies are not enforced. AA24-057A explicitly calls out "device enrollment policies… to only permit authorized devices" as a mitigation.
- Mitigating controls: idp, edr-xdr, mdm-uem, cdm
- Provisions in scope: nist-csf-2-0#PR.AA-01 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-02 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-03 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-04 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-05 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.PS-01 (partial, disc:high, pendingEvidence)
Step 4 — TF5 (stage 5) · ATT&CK T1098.005 · evidence: observed

PE / PA accepts attacker device-registration request. AA24-057A: "SVR actors have… registered their own device as a new device on the cloud tenant." With the new device registered, subsequent re-auth flows succeed without additional friction.
- Mitigating controls: idp, siem-soar, pam, iga
- Provisions in scope: nist-csf-2-0#PR.AA-01 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-02 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-03 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-04 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-05 (partial, disc:high, pendingEvidence); nist-csf-2-0#RS.MI-01 (partial, disc:high, pendingEvidence)
Step 5 — TF6 (stage 6) · ATT&CK T1090.002 · evidence: observed

Adversary uses residential proxies so PEP egress checks treat the source as expected user traffic. AA24-057A: "Residential proxies… make traffic appear to originate from IP addresses within ISP ranges used for residential broadband customers and hide the true source."
- Mitigating controls: ztna-gateway, dlp, siem-soar, ca-pki, kms-secrets, pam
- Provisions in scope: nist-csf-2-0#PR.AA-01 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-02 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-03 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-04 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-05 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.DS-01 (partial, disc:high, pendingEvidence)
Step 6 — TF7 (stage 7) · evidence: reported

Session continues at the SaaS boundary; behavioural baselining is not in place, so the off-pattern login from a newly-enrolled device on a residential proxy raises no alert.
- Mitigating controls: idp, edr-xdr, mdm-uem, ztna-gateway, dlp, siem-soar, kms-secrets, pam, cdm
- Provisions in scope: nist-csf-2-0#DE.AE-02 (partial, disc:high, pendingEvidence); nist-csf-2-0#DE.AE-03 (partial, disc:high, pendingEvidence); nist-csf-2-0#DE.AE-04 (partial, disc:high, pendingEvidence); nist-csf-2-0#DE.AE-06 (partial, disc:high, pendingEvidence); nist-csf-2-0#DE.AE-07 (partial, disc:high, pendingEvidence); nist-csf-2-0#DE.CM-01 (partial, disc:high, pendingEvidence)