Retail at risk: How one alert uncovered a persistent cyberthreat

Retail at risk: How one alert uncovered a persistent cyberthreat details how a single Defender Experts alert about a Possible web shell installation on a SharePoint server led to uncovering a major multi-part attack. The investigations tie the intrusion to vulnerabilities CVE-2025-49706 and CVE-2025-49704, which cyberattackers used to spoof identities and inject remote code, followed by a second phase that began with a compromised identity.

Attackers progressed by abusing self-service password resets, mapping the organisation’s identity structure with Microsoft Entra ID and Microsoft Graph API, and escalating access via Azure Virtual Desktop and Remote Desktop Protocol, employing tools such as PsExec and SQL Server Management Studio, and maintaining control through Teleport, Azure CLI, and Rsocx proxy.

Nine of 20 accounts had elevated access without proper tiering, highlighting an identity management weakness that facilitated lateral movement, according to Microsoft Incident Response. In response, DART deprivileged compromised accounts, revoked tokens, and conducted mass password resets with identity re-attestation, while patching vulnerable systems and enforcing MFA under Zero Trust principles. The post urges ongoing vigilance, patching, and strict identity controls as essential to defend against similar retail-targeted cyberthreats.