BackBox News
Latest news and insights on Security
Company Blogs
Hacking Tools
[wp-rss-aggregator feeds="kitploit" limit="10" pagination="off"]
Exploit DB
[wp-rss-aggregator feeds="exploit-db" limit="10" pagination="off"]
Latest news and insights on Security
German Police Unmask REvil Ransomware Leader
/in General NewsShchukin is accused of extorting more than $2 million as the head of the GandCrab and REvil ransomware operations.
The post German Police Unmask REvil Ransomware Leader appeared first on SecurityWeek.
SecurityWeek – Read More
Medusa Ransomware Fast to Exploit Vulnerabilities, Breached Systems
/in General NewsThe group is using zero-days, quickly weaponizes fresh bugs, and exfiltrates and encrypts data within days of initial access.
The post Medusa Ransomware Fast to Exploit Vulnerabilities, Breached Systems appeared first on SecurityWeek.
SecurityWeek – Read More
White House Seeks to Slash CISA Funding by $707 Million
/in General NewsThe Trump administration says the FY2027 budget refocuses CISA on its core mission: protecting federal agencies and critical infrastructure.
The post White House Seeks to Slash CISA Funding by $707 Million appeared first on SecurityWeek.
SecurityWeek – Read More
Common Entra ID Security Assessment Findings – Part 3: Weak Privileged Identity Management Configuration
/in General NewsThis post is part of a small blog series covering common Entra ID security findings observed during real-world assessments. Each article explores selected findings in more detail to provide a clearer understanding of the underlying risks and practical implications.
What Is Privileged Identity Management?
Privileged Identity Management (PIM) is a service in Microsoft Entra ID that enables organizations to manage, control, and monitor privileged access.
The main features are:
A common use case is to avoid permanently assigning the Global Administrator role. Instead, users or group members are made eligible to activate the role only when needed and only for a limited period.
The activation of a role can be protected by additional requirements such as MFA, approval, or justification. For stronger protection, activation can also require an Authentication Context1, which allows Conditional Access policies to enforce specific controls again at activation time.
PIM is available for:
This blog post focuses on PIM for Entra ID roles, but the same principles also apply to PIM for Groups and PIM for Azure roles.
Common Weaknesses in PIM Configuration
During security assessments, we frequently observe the same weak PIM configurations. In some cases, the use of PIM is sometimes even used to justify the absence of other important hardening measures, based on the assumption that administrators are already “protected by PIM.” In this chapter, we look at several weak configurations that can occur in practice and explain why PIM may provide less protection than expected when it is configured too permissively.
PIM Not Used
In some environments, PIM is not used at all, even though the required Entra ID P2 licenses are available. As a result, highly privileged roles such as Global Administrator remain assigned permanently. If such an account is compromised, for example through a phishing attack, an attacker can immediately obtain privileged access to the tenant.
High-Privilege Roles Missing from PIM Protection
Another common issue is that PIM is used for well-known sensitive roles such as Global Administrator, while other highly privileged roles remain permanently assigned.
MFA Requirement Relies Only on Built-In Azure MFA
In many environments, even highly privileged roles such as Global Administrator are protected only by the built-in Azure MFA requirement:
If an attacker can steal tokens that were issued after MFA authentication and therefore already contain the MFA claim, they may be able to activate the role themselves without an additional MFA step-up.
Another important aspect is that PIM only adds protection at the moment of role activation. If an attacker has stolen a user’s refresh token, they can wait for the legitimate user to activate the privileged role and then use the stolen refresh token to obtain a new access token with the elevated privileges.
Permanent Active Assignments Are Allowed
If permanent active assignments are allowed, privileged roles can be assigned without an expiration date, increasing the risk of long-term privileged access.
Missing Notifications
Highly privileged roles are usually not needed for day-to-day operations. Notifications for role assignments and activations can help detect unusual or unexpected use, for example outside normal working hours.
Excessive Activation Duration
Highly privileged roles are usually only needed for short administrative tasks, such as assigning other privileged roles. They should therefore only be activated for a limited time. In many environments, however, the maximum activation duration is set to more than four hours. Although users can select a shorter duration, these settings are often left unchanged in practice, which increases the exposure window.
Attack Examples
The following examples show the consequences of relying solely on the built-in Azure MFA requirement. In these scenarios, we assume that an attacker has obtained authentication tokens for the Azure portal, for example through phishing.
Example 1: Satisfying the Built-In Azure MFA Requirement
In this example, we assume that no further restrictions for administrators are enforced through Conditional Access policies and that only MFA is required. The admin user Alice has an eligible assignment for the Entra ID role Conditional Access Administrator. In the PIM role settings, only Azure MFA is required and no approval is necessary for activation.
The stolen access token contains the value
mfain theamrclaim. This indicates that the user Alice authenticated using MFA:The access token obtained in this case does not contain the scope2 required to query the Conditional Access policies. However, the token is still highly powerful and can be used for the BroCi 3 auth flow, for example with tools such as EntraTokenAid, to obtain a new token with the required
Policy.Read.Allscope:The newly obtained token includes a large number of pre-consented scopes of the Microsoft first-party application
ADIbizaUX, including those required to interact with Conditional Access policies:Since the Conditional Access Administrator role is not permanently assigned, access to Conditional Access policies is still not possible:
However, the user object ID contained in the access token can be used to verify that the user is eligible to activate the Conditional Access Administrator role:
The role ID can then be used by the attacker to activate the role directly:
To use the newly activated role, the attacker only needs to refresh the token and reconnect to the Microsoft Graph PowerShell module. The refreshed token now provides access to the Conditional Access policies:
With the Conditional Access Administrator role, the attacker can modify the policies, for example by excluding users or disabling them:
This example shows that PIM may offer only limited protection if it is configured too permissively and an attacker obtains a powerful token, such as one issued for an administrative portal session. If role activation had required an Authentication Context that enforces re-authentication during activation, this abuse path would have been significantly more difficult to exploit.
Example 2: Using a Stolen Refresh Token
In this second example, MFA is not enforced by a Conditional Access policy and is required only during activation of a privileged role such as User Administrator.
In this scenario, the attacker obtained authentication tokens for Alice’s Microsoft Teams client. Because Alice did not authenticate with MFA, the
amrclaim does not contain the valuemfa:Since activation of the User Administrator role requires MFA, the attacker cannot activate the role directly. However, if the session lifetime is not limited through Conditional Access policies, a stolen refresh token may remain valid for up to 90 days and can continue to be extended through repeated renewal. In addition, there is no limit on the number of valid refresh tokens that exist simultaneously. Because PIM protects only the moment of role activation, the attacker can simply wait until the user activates the role.
Assume that Alice later activates the role through the portal. At that point, she must complete MFA because it is enforced by PIM:
The attacker only needs to refresh the token to obtain a new access token that now includes the newly activated privileges. In addition, the attacker can use the refresh token’s FOCI (Family of Client IDs)4 capability to request a token for the Office 365 Management client (
00b41c95-dab0-4487-9791-b9d2c32c80f2), which has the delegated API permissionUser.ReadWrite.Allpre-consented:Inspection of the access token shows that it still does not contain the value
mfain theamrclaim:However, because Alice activated the role through PIM and completed MFA, the attacker can now use the refreshed token to abuse those permissions. For example, the attacker may be able to reset another user’s password:
This example shows that PIM protects only the moment of role activation. It does not revoke existing sessions or require MFA again after the role has been activated. If role activation had required an Authentication Context that enforced re-authentication, this abuse path would have been prevented.
Limitation of Authentication Context
In the previous two examples, an Authentication Context was described as an important additional protection. The obvious question is whether an Authentication Context is sufficient to prevent these attacks completely.
Unfortunately, there is an important limitation: “The policy factors in five minutes of clock skew when every time is selected, so that it doesn’t prompt users more often than once every five minutes.5”
This means that Example 1 may still work if the attacker obtains freshly issued tokens that already contain the MFA claim and uses them within five minutes to activate the role. In our experience, this even work when additional grant controls are configured, such as requiring a compliant or hybrid-joined device.
One possible mitigation is to create an additional Conditional Access policy that blocks access unless specific conditions are met, such as a trusted IP range or a device filter, and assign it to the same Authentication Context. Although this approach is not officially documented by Microsoft, our testing showed that it can prevent role activation during the first five minutes after authentication.
Detecting Weak PIM Configuration with EntraFalcon
EntraFalcon enumerates the PIM settings for all Entra ID roles in the tenant. It provides an overview table of the most important role settings and allows direct navigation to the detailed configuration of each role. In addition, it includes built-in checks to identify weak configurations, particularly for Tier-0 roles.
For example, the check PIM-002 identifies direct assignments to Entra ID Tier-0 roles that therefore do not require PIM for activation:
Another example is the check PIM-009, which identifies Tier-0 roles that do not require approval or an Authentication Context:
Examples of other PIM-related checks include:
The PIM report also includes a table-based overview of all PIM role settings:
The detailed configuration of each role can also be reviewed directly:
Recommendations
Appropriate recommendations depend heavily on the organization, the role concept, and the additional protection mechanisms in place, such as phishing-resistant authentication methods, privileged access workstations for Tier-0 administrators, or IP- and device-based restrictions. The following recommendations should therefore be understood as general guidance and adapted to the specific environment.
It is also important to note that PIM alone is not sufficient to fully protect privileged access. Especially for sensitive accounts, it should be combined with a restrictive Conditional Access Policy configuration, for example by enforcing device-based controls.
Recommendations for Tier-0 / Control-Plane Roles
Highly privileged roles such as Global Administrator should only be used for very specific and typically short tasks. Therefore, it is generally feasible to apply restrictive PIM settings. In addition to protecting these roles, restrictive settings also reduce the likelihood that administrators continue using them out of convenience.
Examples of such roles include:
* For the Application Administrator and Cloud Application Administrator roles, the risk depends on whether privileged applications exist in the tenant. However, since this is the case in many environments, it is often reasonable to treat these roles as highly privileged as well.
Recommended settings:
* This can help prevent abuse during the first five minutes after authentication. If equivalent restrictions are already enforced through Conditional Access policies, this may be unnecessary.
** For the strongest protection, a robust approval workflow can help prevent attackers from activating the role themselves, even if they have compromised an administrator’s device.
*** Permanent active assignments should only be considered for roles used by emergency accounts.
Recommendations for Lower-Tier Roles
Lower-tier roles may be used for daily operational tasks, for example by service desk staff managing user accounts. Therefore, requiring approval and generating notifications for every activation often adds little security value while creating unnecessary approval and alert fatigue.
However, not all lower-tier roles are equal. Some are used daily, while others are assigned only occasionally or still provide access to sensitive functions. The appropriate settings should therefore depend not only on the role itself, but also on its actual use and effective assignments in the tenant.
A pragmatic baseline can be:
* Note that the Authentication Context may have no usability impact if the role is activated within five minutes of authentication.
Where a role is rarely used or still enables sensitive changes, stricter settings may still be appropriate.
References
Compass Security Blog – Read More
China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware
/in General NewsA China-based threat actor known for deploying Medusa ransomware has been linked to the weaponization of a combination of zero-day and N-day vulnerabilities to orchestrate “high-velocity” attacks and break into susceptible internet-facing systems.
“The threat actor’s high operational tempo and proficiency in identifying exposed perimeter assets have proven successful, with recent
The Hacker News – Read More
Flowise AI Agent Builder Under Active CVSS 10.0 RCE Exploitation; 12,000+ Instances Exposed
/in General NewsThreat actors are exploiting a maximum-severity security flaw in Flowise, an open-source artificial intelligence (AI) platform, according to new findings from VulnCheck.
The vulnerability in question is CVE-2025-59528 (CVSS score: 10.0), a code injection vulnerability that could result in remote code execution.
“The CustomMCP node allows users to input configuration settings for connecting
The Hacker News – Read More
Wynn Resorts Says 21,000 Employees Affected by ShinyHunters Hack
/in General NewsThe high-end casino and hotel operator has likely paid a ransom to avoid a data leak.
The post Wynn Resorts Says 21,000 Employees Affected by ShinyHunters Hack appeared first on SecurityWeek.
SecurityWeek – Read More
I found Android Auto’s hidden shortcut that automates any task in your car – and it’s brilliant
/in General NewsAndroid Auto’s best feature is one you probably haven’t discovered yet – and Custom Assistant takes only a minute to set up.
Latest news – Read More
LG G6 vs. Samsung S95H: I compared the best OLED TVs of 2026 and made a tough choice
/in General NewsThe LG G6 and Samsung S95H are two premium-grade OLED TVs with excellent picture and sound, but which is the better buy?
Latest news – Read More
Samsung’s latest TV firmware update fixes the Chromecast issue for older models – finally
/in General NewsSamsung’s 2026 TV lineup will feature built-in support for Google Cast, but with the latest firmware, models as far back as 2024 will also get an update.
Latest news – Read More