These tactics allowed threat actors to bypass Multi-Factor Authentication (MFA) and Conditional Access policies-two critical security measures organizations rely on to protect their digital assets. Legacy authentication protocols, including BAV2ROPC, SMTP AUTH, POP3, and IMAP4, remain vulnerable targets due to their inherent lack of modern security features. When an application leverages BAV2ROPC, it simply sends credentials to Entra ID, which then issues tokens without user interaction, completely bypassing the normal authentication flow that would trigger MFA challenges or Conditional Access evaluations. The attackers specifically exploited outdated authentication methods to circumvent modern security controls, creating a concerning backdoor into enterprise environments. A sophisticated campaign targeting Microsoft Entra ID through legacy authentication protocols has been uncovered, operating between March 18 and April 7, 2025. Most concerning was the finding that approximately 90 percent of these attacks specifically targeted Exchange Online, indicating a deliberate strategy to access email communications and potentially harvest sensitive information and authentication tokens. This process occurs without displaying any login screens or generating the security alerts that would normally accompany authentication attempts. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The implementation works through a direct credential submission where the application code sends the username and password credentials directly to the authentication service. Notably, the attackers focused heavily on administrative accounts, with one subset receiving nearly 10,000 attempts from 432 different IP addresses within just 8 hours, demonstrating the highly automated and distributed nature of the campaign. This technical debt creates a significant security gap that malicious actors are increasingly targeting with sophisticated attacks. Tushar is a Cyber security content editor with a passion for creating captivating and informative content. The research team documented over 9,000 suspicious Exchange login attempts within the three-week period, with attacks originating primarily from Eastern Europe and Asia-Pacific regions. While Microsoft has deprecated or disabled many of these outdated methods, numerous organizations continue to maintain them for business continuity reasons or to support legacy systems. The silent nature of this protocol makes it particularly dangerous as a lateral movement technique once initial credentials have been compromised through phishing or other means.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 12 May 2025 10:35:09 +0000