attack-path / financial services / cred-theft-lateral-movement

Cred theft AA24-057A

Engine-driven compliance rail for Credential theft → MFA fatigue → lateral movement (remote-user SaaS path) on the Financial Services protect-surface layout. Step controls cycle through the engine's Trust-Failure chain; each step shows the in-scope provisions the failure implicates and, where a regulatory clock applies, the obligation diamond.

advisoryCISA · Joint Cybersecurity Advisory AA24-057A — SVR Cyber Actors Adapt Tactics for Initial Cloud Access (AA24-057A)

resolved atFinancial Services · Hybrid SaaS + VPC · Remote user opens a SaaS application

step 01TF2observedATT&CK T1110

stage 2

Adversary obtains password via brute force or password spraying against a remote-user SaaS login surface. AA24-057A: "SVR use password spraying and brute forcing as an initial infection vector."

mitigating controls

idpmfa-authenticatorca-pkikms-secretspam

in-scope provisions (6)

partial3.A - Change Default Passwordscisa-cpgs-v2disc:highpendingEvidence
partial3.B - Establish Minimum Password Strengthcisa-cpgs-v2disc:highpendingEvidence
partial3.F - Implement Multifactor Authentication (Mfa)cisa-cpgs-v2disc:highpendingEvidence
partial3.G - Administrators Maintain Separate User And Privileged Accountscisa-cpgs-v2disc:highpendingEvidence
partial§314.4(c)(1) Access controls — least-privilege baseline + as-appropriate physicalglba-safeguardsdisc:highpendingEvidence
partial§314.4(c)(5) Multi-Factor Authentication — universal default + QI compensating-control surfaceglba-safeguardsdisc:highpendingEvidence

obligation

no regulatory clock for this step

protect-surface storyline (DAAS cards)

01
Initial Access
identity-svc
Phishing-resistant MFA is not enforced for every principal. A high-privilege identity yields its password to a phishing portal; the PE accepts the reused secret.
02
Discovery
crm
The compromised identity logs into Salesforce and pivots through field-level data, mapping the customer base and the privileged-user list for the next hop.
03
Lateral Movement
google-workspace
The same federated identity is replayed against Google Workspace. AA24-057A documents Midnight Blizzard’s SaaS-to-SaaS pivots via OAuth tokens granted under the assumed principal.
04
Exfiltration
customer-pii
Customer PII is exported through legitimate SaaS APIs under the stolen identity — no anomaly fires because the access pattern is a valid-account one (T1078).

Compliance rail (text fallback)

Step 1 — TF2 (stage 2) · ATT&CK T1110 · evidence: observed

Adversary obtains password via brute force or password spraying against a remote-user SaaS login surface. AA24-057A: "SVR use password spraying and brute forcing as an initial infection vector."
- Mitigating controls: idp, mfa-authenticator, ca-pki, kms-secrets, pam
- Provisions in scope: cisa-cpgs-v2#3.A (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.B (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.F (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.G (partial, disc:high, pendingEvidence); glba-safeguards#314.4.c.1 (partial, disc:high, pendingEvidence); glba-safeguards#314.4.c.5 (partial, disc:high, pendingEvidence)
Step 2 — TF2 (stage 2) · ATT&CK T1621 · evidence: observed

MFA bombing — adversary repeatedly pushes MFA prompts until the user accepts. AA24-057A: "The SVR repeatedly push MFA requests to a victim's device until the victim accepts the notification, providing SVR access to the account."
- Mitigating controls: idp, mfa-authenticator, ca-pki, kms-secrets, pam
- Provisions in scope: cisa-cpgs-v2#3.A (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.B (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.F (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.G (partial, disc:high, pendingEvidence); glba-safeguards#314.4.c.1 (partial, disc:high, pendingEvidence); glba-safeguards#314.4.c.5 (partial, disc:high, pendingEvidence)
Step 3 — TF3 (stage 3) · evidence: reported

No device-trust posture signal reaches the PE — the request originates from an attacker-controlled device that the tenant has no enrollment record of, but device-enrollment policies are not enforced. AA24-057A explicitly calls out "device enrollment policies… to only permit authorized devices" as a mitigation.
- Mitigating controls: idp, edr-xdr, mdm-uem, cdm
- Provisions in scope: cisa-cpgs-v2#2.B (partial, disc:high, pendingEvidence); dora#art-24-25 (partial, disc:high, pendingEvidence); dora#art-26 (partial, disc:high, pendingEvidence); dora#art-7-10 (partial, disc:high, pendingEvidence); glba-safeguards#314.4.c.2 (partial, disc:high, pendingEvidence); glba-safeguards#314.4.d (partial, disc:high, pendingEvidence)
Step 4 — TF5 (stage 5) · ATT&CK T1098.005 · evidence: observed

PE / PA accepts attacker device-registration request. AA24-057A: "SVR actors have… registered their own device as a new device on the cloud tenant." With the new device registered, subsequent re-auth flows succeed without additional friction.
- Mitigating controls: idp, siem-soar, pam, iga
- Provisions in scope: cisa-cpgs-v2#3.F (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.G (partial, disc:high, pendingEvidence); glba-safeguards#314.4.c.1 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-01 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-02 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-03 (partial, disc:high, pendingEvidence)
Step 5 — TF6 (stage 6) · ATT&CK T1090.002 · evidence: observed

Adversary uses residential proxies so PEP egress checks treat the source as expected user traffic. AA24-057A: "Residential proxies… make traffic appear to originate from IP addresses within ISP ranges used for residential broadband customers and hide the true source."
- Mitigating controls: ztna-gateway, dlp, siem-soar, ca-pki, kms-secrets, pam
- Provisions in scope: cisa-cpgs-v2#3.I (partial, disc:high, pendingEvidence); glba-safeguards#314.4.c.1 (partial, disc:high, pendingEvidence); glba-safeguards#314.4.c.3 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-01 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-02 (partial, disc:high, pendingEvidence); nist-csf-2-0#PR.AA-03 (partial, disc:high, pendingEvidence)
Step 6 — TF7 (stage 7) · evidence: reported

Session continues at the SaaS boundary; behavioural baselining is not in place, so the off-pattern login from a newly-enrolled device on a residential proxy raises no alert.
- Mitigating controls: idp, edr-xdr, mdm-uem, ztna-gateway, dlp, siem-soar, kms-secrets, pam, cdm
- Provisions in scope: cisa-cpgs-v2#2.B (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.O (partial, disc:high, pendingEvidence); cisa-cpgs-v2#3.Q (partial, disc:high, pendingEvidence); dora#art-24-25 (partial, disc:high, pendingEvidence); dora#art-26 (partial, disc:high, pendingEvidence); dora#art-7-10 (partial, disc:high, pendingEvidence)