Identity Extortion Spree: Threat Group PREY-0058 Targets C-Suite in Microsoft 365 Vishing and Data Theft Attacks
Executive Summary
Threat intelligence researchers at Arctic Wolf Labs have disclosed comprehensive details on an aggressive, highly targeted cyber extortion campaign tracked under the cluster moniker PREY-0058 (The Hacker News). Sharing significant operational tradecraft and infrastructure overlaps with Google Mandiant's UNC6671 and the extortion group Cinder (a continuation of Pink operations), the threat actors selectively target corporate directors, vice presidents, and C-suite executives across U.S. enterprises. By weaponizing telephone voice phishing (vishing) and Adversary-in-the-Middle (AiTM) credential interception, the group bypasses Multi-Factor Authentication (MFA) to conduct massive, malware-less data exfiltration from Microsoft 365 environments for multi-million-dollar extortion demands.
Deep-Dive Technical Analysis
The Malware-Less Vishing & Token Replay Lifecycle
Unlike traditional ransomware syndicates that deploy endpoint lockers or rely on network vulnerability exploits, PREY-0058 operates purely within legitimate SaaS identity boundaries:
1. Executive Target Profiling & Pretexting: Attackers conduct in-depth open-source intelligence (OSINT) gathering on LinkedIn and corporate registries to map corporate reporting chains. Threat actors place phone calls directly to executive mobile numbers, impersonating internal corporate IT help desk or security operations staff resolving an "urgent account compromise" or "mandatory MFA token update."
2. Adversary-in-the-Middle (AiTM) Interception: The victim is directed to navigate to a customized corporate lure portal hosted on newly registered typosquatted domains (e.g., [company]-sso-auth[.]com). The reverse-proxy architecture proxies legitimate Microsoft Entra ID login flows, seamlessly capturing the user's primary credentials and active session cookies/OAuth tokens during real-time authentication.
3. Residential Proxy Evasion: To bypass Conditional Access policies and geographic anomaly detections, the attackers immediately replay the stolen authentication tokens through commercial residential proxy networks located within the victim's geographic region, matching the expected IP range and ASN profile.
4. En Masse Cloud Data Harvesting: Once authenticated with executive privileges, threat actors bypass endpoint EDR agents entirely by utilizing native cloud APIs and administrative sync utilities. The group performs bulk downloads across Microsoft SharePoint repositories, OneDrive vaults, Exchange mailboxes, and corporate Box environments, specifically searching for M&A deal documents, proprietary trading strategies, intellectual property, and litigation files.
5. Direct Executive Extortion: Within days of data exfiltration, the attackers contact executive leadership, threatening public data dumps on dark web leak sites unless seven- to eight-figure ransom payments are remitted in cryptocurrency.
Targeted Sectors & Identity Threat Landscape
Arctic Wolf's telemetry highlights broad sector targeting across the United States:
* Targeted Industries: The campaign disproportionately targets construction and engineering, healthcare and pharmaceuticals, financial management and private equity, real estate, and legal professional services.
* The Rise of Identity-First Extortion: Operating without endpoint malware nullifies traditional anti-virus and EDR protections. The attack emphasizes that modern corporate perimeters are defined by identity and session tokens rather than network firewalls.
Actionable Recommendations & Mitigations
1. Enforce Phishing-Resistant FIDO2/WebAuthn MFA: Eliminate reliance on SMS codes, voice calls, and standard mobile push notifications by mandating FIDO2/WebAuthn hardware security keys (e.g., YubiKeys) for all executive and privileged corporate accounts. FIDO2 tokens bind cryptographic authentication to the verified domain name, rendering AiTM reverse proxies ineffective.
2. Deploy Microsoft Entra ID Conditional Access Hardening: Configure Conditional Access policies requiring managed, compliant device states (Intune/Hybrid Azure AD Join) for all SaaS application access, preventing token replay from unmanaged residential proxy endpoints.
3. Enable Continuous Access Evaluation (CAE): Activate CAE in Microsoft 365 to allow real-time revocation of active user sessions when network location shifts or user risk flags trigger.
4. Implement Help Desk Out-of-Band Verification: Establish mandatory out-of-band verification procedures (such as in-person or cryptographically signed supervisor approval) for any password reset, MFA device re-registration, or account unblocking request.
________________
Sources & References: The Hacker News.