confirmed research (Todyl MXDR incident write-up, published Nov 3, updated Nov 4); unattributed
Hunt: one operator is signing in to MSPs' Entra ID and Azure DevOps as their own apps with stolen secrets, then fanning out to client tenants
IP:199.19.77.84 (high confidence, all confirmed sign-ins, downloads and token replays, Nov 1-3). Lower confidence: 199.19.77.18 and 65.87.223.26 (Azure CLI password spray); range 199.19.77.0/24 on AS203662.
Entra sign-in logs (service principal): app sign-ins from hosting IPs; an app requesting ARM then Key Vault tokens within seconds, often followed by Graph, Storage and Cognitive Services tokens; apps that had never signed in before suddenly authenticating.
Activity: single-wildcard (*) Graph searches; SharePoint downloads at about one file per second; Partner Center tokens issued to MSP apps; switch from curl/Python user agents to spoofed browser strings.
Respond: rotate secrets and certificates for every app in the affected tenant and in client tenants it can reach, then rotate whatever was in Key Vault and in downloaded files (VPN, RMM, MFA, backup, firewall). Apply Conditional Access for workload identities and block sign-ins from hosting ASNs; the actor keeps retrying old credentials and replaying refresh tokens.