m.blake (Michael Blake, Director of Research) gets hit with a credential phishing email from microsoft-secure-signin.com, followed by MFA push bombing from 203.0.113.88 (Taipei, Taiwan). Three pushes are denied, then a fourth gets approved under fatigue. The attacker gets into the admin portal and tries to disable MFA for the pioneer account, but SOAR playbook PB-002 fires automatically and locks things down. There are signs this is linked to TA-001 IRON CHIMNEY, suggesting coordinated activity.
Click each step to expand. Open the linked tool page, walk through what's there, then ask the discussion questions.
Open Identity and go to Sign-ins. Filter by m.blake. Show the three MFA push denial events, then the fourth that was approved. Point out that the approved login came from 203.0.113.88 (Taipei), and m.blake had no history of logging in from Asia. The risk score jumped to 82 after the approval. This is the moment the attacker got in.
Open the SIEM and go to Investigations. Open INV-2024-0086. Show the alert timeline: ALT-7285 fired when the third MFA push was denied (burst detected), then ALT-7288 fired when the admin portal login came in from the external IP. Point out the gap between the two alerts and ask students what they would have done if they saw ALT-7285 come in.
Open MailGuard and go to ATO Cases. Find ATO-002 for m.blake. Then go to Threats and show THREAT-005, the credential phishing email from microsoft-secure-signin.com. MailGuard blocked the email but the attacker still had the credentials from a previous breach or separate phish. This is a good moment to discuss how blocking the email is not enough if the credentials were already out there.
Open SOAR and go to Cases. Find CASE-2024-0142. Then go to Playbooks and open PB-002 MFA Fatigue Lockdown. Show the nodes: suspend the m.blake account, block 203.0.113.88 at the firewall, revoke all active sessions, and alert the identity team. The playbook ran automatically when ALT-7288 fired. The attacker's attempt to disable MFA for the pioneer account was blocked mid-action.
Open the TIP and go to IOCs. Find IOC-002 for 203.0.113.88. Show that this IP is attributed to TA-001 IRON CHIMNEY, the same threat actor behind the main ransomware campaign. Then go to Campaigns and show where this IP appears in CAM-001 Operation SMELTING. This is an important moment: two separate incidents turn out to be the same threat actor running parallel operations.