By 
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has revealed that an unnamed state government organization's network environment was compromised through an administrator account belonging to a former employee.
According to a joint advisory published by the agency and Multi-State Information Sharing and Analysis Center (MS-ISAC), the threat actor managed to successfully authenticate to an internal virtual private network (VPN) access point. The threat actor connected to the [virtual machine] through the victim's VPN with the intent to blend in with legitimate traffic to evade detection.
It is suspected that the threat actor obtained the credentials following a separate data breach as the credentials appeared in publicly available channels containing leaked account information.
The admin account, which had access to a virtualized SharePoint server, also enabled the attackers to access another set of credentials stored in the server, which had administrative privileges to both the on-premises network and the Azure Active Directory (now called Microsoft Entra ID).
The attackers behind the malicious activity are presently unknown.
A deeper investigation into the incident has revealed no evidence that the adversary moved laterally from the on-premises environment to the Azure cloud infrastructure.
The attackers ultimately accessed host and user information and posted the information on the dark web for financial gain, prompting the organization to reset passwords for all users, disable the administrator account as well as remove the elevated privileges for the second account.
