Active edge device exploits feed Microsoft 365 OAuth app abuse, defenders say

Managed security providers and incident responders on Wednesday reported active exploitation of edge appliances feeding cloud account takeover across North America and Europe. Intrusions begin with Fortinet FortiOS SSL VPN CVE-2024-21762 and Ivanti Connect Secure CVE-2023-46805 and CVE-2024-21887, then pivot into Microsoft 365 by registering malicious OAuth applications to harvest mail and file data.

The activity matters because it couples fast exploit cycles on network devices with durable cloud persistence that survives password resets and MFA. The same tradecraft was documented in 2024 by Microsoft and Mandiant in intrusions attributed to Midnight Blizzard, also known as APT29.

Edge to cloud intrusion chain

Responders describe unauthenticated device exploitation to drop web shells, scrape device configs, and extract credentials and session data. Once an Azure AD Global Administrator account is obtained, attackers create or modify an Entra application, add a service principal, and grant high value permissions such as Mail.Read, Files.Read.All, and offline access. They then mint and cache refresh tokens that enable long lived access without interactive logins.

In several cases, the adversary disabled user consent restrictions, added additional app secrets, and configured multi tenant access to facilitate lateral movement to partner tenants. Exfiltration proceeds through Microsoft Graph API calls and SharePoint endpoints using benign source addresses and throttled request rates to blend with normal usage.

CVE-2024-21762 and the Ivanti chain remain on CISA’s Known Exploited Vulnerabilities catalog. Both classes of devices are frequently exposed to the internet, and many organizations still operate versions that require manual upgrades and certificate rotation after compromise.

Mitigation path for defenders

Patch FortiOS and FortiProxy to fixed versions for CVE-2024-21762 and upgrade Ivanti Connect Secure and Policy Secure for CVE-2023-46805 and CVE-2024-21887. After any suspected device compromise, rotate local accounts, replace device certificates, and invalidate VPN sessions.

In Microsoft 365, disable user consent to apps and require an admin approval workflow. Restrict app permissions with an Admin Consent Policy and limit consent to verified publishers. Audit Application and Service Principal changes in Entra, review sign in logs for non interactive service principal activity, and alert on new high privilege Graph permissions.

Revoke refresh tokens and app credentials for suspicious service principals, then remove the objects. Enforce Conditional Access for workload identities, set token protection and lifetime policies, and require step up approval for privileged operations. Monitor Graph and SharePoint API usage for anomalous read patterns and long running export jobs.

For the broader technology landscape, the pattern reinforces that edge device patching is only the starting point, since cloud identity and application permission abuse now deliver persistence and scale. Security programs will need equal investment in identity governance, workload identity controls, and telemetry for consent and service principal activity to close the gap.