ReliaQuest: Entra Rogue Devices and PRTs Let Attackers Persist After Password Resets

The findings, authored by Daniel Wroblewski and the ReliaQuest Threat Research team in their September 30, 2026 analysis of external third-party incidents, illustrate a stark operational reality for Windows and Microsoft 365 administrators. Threat actors are systematically turning compromised identities, native Windows utilities, and legitimate Software-as-a-Service (SaaS) APIs into high-speed data theft and ransomware engines. When the first visible indicator of an intrusion looks exactly like a routine sign-in, a new multi-factor authentication (MFA) enrollment, or a newly registered device in Microsoft Entra ID, how do defenders separate genuine administration from an extortionist quietly packing up the company's SharePoint sites?

By the Numbers: Identity Takes the Crown​

In ReliaQuest's dataset of true-positive security incidents between June and August 2026, traditional exploit-heavy entry vectors took a back seat to credential and account abuse. Across those verified incidents, initial access broke down along clear lines:

• Domain Accounts: 29.6% of true-positive incidents
• Cloud Accounts: 12.5% of true-positive incidents
• Spearphishing Links: 11.6% of true-positive incidents

Combined, valid domain and cloud accounts accounted for more than four out of every ten confirmed initial footholds in ReliaQuest's incident data. Rather than firing zero-day exploits at hardened perimeter firewalls, attackers targeted end users and unmanaged devices through voice phishing (vishing), device-code phishing, and IT support impersonation via external Microsoft Teams tenants.

Because phone calls to personal mobile devices and unmonitored external chat messages happen outside the view of traditional endpoint detection and response (EDR) sensors, defenders frequently saw zero pre-compromise alerts. The intrusion only entered corporate telemetry once the attacker was already inside, authenticating with valid tokens.

Section Summary: ReliaQuest's June–August 2026 incident data shows Domain Accounts (29.6%) and Cloud Accounts (12.5%) leading initial-access techniques, powered by social engineering that bypasses traditional perimeter detection.

Why a Password Reset No Longer Evicts the Attacker​

The most urgent technical takeaway for Microsoft Entra ID and Windows administrators lies in how threat actors cement their persistence seconds after gaining access. In one campaign documented by ReliaQuest, attackers used device-code phishing to trick users into authorizing rogue sessions, and then immediately registered multiple attacker-controlled devices to the compromised Microsoft Entra ID accounts.

Here is why that breaks standard remediation: in Microsoft Entra ID architectures, a registered device receives a Primary Refresh Token (PRT). A PRT is a key artifact of Windows and cloud single sign-on that continues to renew access as long as the registered device remains active and trusted by the directory. If a security analyst responds to an alert by resetting the user's password and clicking "revoke sessions" without auditing and deleting the newly registered devices, authentication methods, passkeys, or security keys, those rogue PRTs can continue renewing access right through the password change.

To support these social engineering lures, threat actors built agile, target-specific web infrastructure. ReliaQuest observed attackers registering brand-impersonation and typosquatted domains mimicking target organizations' help desks, HR departments, legal teams, document-sharing portals, and identity providers like Okta. Some domains were weaponized on the exact day they were registered, using naming patterns such as:

• {organization}[.]report
• {organization}-report[.]com
• {organization}[.]myaccountoptions[.]com

Whenever defenders blocked a malicious domain, operators simply swapped in a fresh one while keeping the underlying attack chain identical: capture or replay refresh tokens, register an attacker-controlled MFA method or device, and query cloud APIs directly.

Section Summary: By registering unauthorized devices to compromised Microsoft Entra ID accounts and obtaining renewing Primary Refresh Tokens (PRTs), attackers maintain persistent cloud access even after administrators reset passwords or terminate active browser sessions.

Six Minutes to Exfiltration: ShinyHunters and Helix in SharePoint​

Once an identity is locked down under attacker control, the clock for defenders runs down at breakneck speed. ReliaQuest highlighted two extortion groups—ShinyHunters and Helix—that refined identity-led SaaS data theft into an assembly line.

ShinyHunters repeatedly replayed stolen refresh tokens, registered rogue devices, and ran automated scripts against legitimate SaaS APIs to bulk-download corporate repositories. Helix paired vishing and device-code phishing with rapid Microsoft SharePoint site-enumeration searches and bulk file-download API calls. In one Helix intrusion analyzed by ReliaQuest, SharePoint access and data collection started just six minutes after a new MFA method was registered to the victim account. Unless a Security Operations Center (SOC) has automated correlation between identity modifications and SaaS file activity, a six-minute window leaves human analysts virtually no time to intervene before sensitive files are staged for extortion.

Helix also demonstrated a deceptive compartmentalization tactic designed to blindside incident responders. In one documented case, Helix used a primary compromised account over several days to quietly enumerate and download SharePoint data. Later, the group compromised a second, entirely separate account and used it solely to send the extortion demand over Microsoft Teams.

Think about how a harried IT team usually reacts when an extortion message pops up in Microsoft Teams: they immediately lock down and investigate the sender's account. By splitting the collection account from the messenger account, Helix ensured that a superficial investigation of the account that delivered the ransom note would completely miss the account that actually exfiltrated the SharePoint library.

At the same time, ReliaQuest cautioned defenders and legal teams not to treat an attacker's claim of data theft as automatic proof of confirmed exfiltration. In several incidents—including cases involving Chaos ransomware operators—attackers claimed to have stolen data, or telemetry showed access to internal file shares and cloud-storage connections, without sufficient audit logging to prove which specific files or what data volume actually left the network. Without centralized SaaS audit logs and outbound transfer visibility, organizations are forced into high-stakes breach notification and extortion decisions completely in the dark.

Section Summary: Groups like ShinyHunters and Helix abuse legitimate APIs to pillage SharePoint within minutes of MFA manipulation, sometimes using separate compromised accounts for data theft and Teams extortion demands to mislead investigators.

The Ransomware Overlap: Quick Assist, Unmonitored VMs, and SMB​

While cloud data theft grabbed headlines, traditional network compromise and encryption have hardly disappeared; instead, their post-access tradecraft has converged around valid accounts and built-in Windows tools.

Looking at ransomware data-leak site listings between June and August 2026, ReliaQuest noted significant shifts at the top of the leaderboard:

(Note: Leak-site figures reflect organizations publicly named by extortion groups during the reporting period, rather than independently verified compromises.)

Regardless of which ransomware brand appeared on the ransom note, the hands-on-keyboard tactics inside Windows environments looked remarkably consistent:

1. External Teams and Quick Assist Abuse: In one intrusion that led to full domain compromise, an attacker posed as internal IT support via an external Microsoft Teams tenant and persuaded an employee to launch Quick Assist, Windows' built-in remote support utility. During the session, the attacker harvested credentials, disconnected, and then re-entered the network through the corporate VPN, pivoting across Remote Desktop Protocol (RDP), Server Message Block (SMB), and Impacket to seize control of the domain.
2. Blind-Spot Virtual Machines and Rapid SMB Encryption: In a Booba ransomware incident, the operator staged the entire attack from an internal virtual machine that lacked an EDR sensor. Armed with a single previously compromised local administrator credential, the attacker authenticated to multiple hosts and began remote encryption over SMB within seconds. Because the actor skipped noisy credential-dumping tools and broad Active Directory discovery, the activity looked like routine Windows administration right up until files started encrypting.

Section Summary: While Qilin (290 listings) and The Gentlemen (260 listings) led leak-site counts, ransomware crews broadly relied on identical post-access building blocks: external Teams lures, Windows Quick Assist, unmonitored virtual machines, and rapid lateral movement over SMB.

Gryxa: The RMM Toolkit That Fights Back When You Delete It​

Perhaps the most sobering endpoint case study in ReliaQuest's research involves Gryxa, a financially motivated toolkit that weaponizes legitimate Remote Monitoring and Management (RMM) software alongside native Windows persistence mechanisms.

Why write custom malware from scratch when you can hide inside signed RMM binaries that IT admins already run? Gryxa embedded itself deeply into Windows hosts by distributing its persistence across three distinct layers:

• At least seven Windows scheduled tasks
• A permanent Windows Management Instrumentation (WMI) event subscription
• A redundant backup copy of its toolkit files stored outside the primary installation folder

If an admin spotted the rogue RMM client in Task Manager or Programs and Features and simply deleted the visible client or its main directory, Gryxa's trap sprung. The toolkit ran a heartbeat check every five minutes to verify connectivity to the attacker's command-and-control infrastructure.

Here is what happened when a partial cleanup severed that connection without wiping out the WMI subscription and scheduled tasks:

• After 2 consecutive failed checks (10 minutes): Gryxa automatically attempted to disable Microsoft Defender and terminate EDR agents matching a hardcoded list.
• After 3 consecutive failed checks (15 minutes): Gryxa attempted to silently uninstall the endpoint security agent altogether.

ReliaQuest estimated that removing only the visible RMM service could leave a Windows host with its endpoint protection disabled or uninstalled within roughly 10 to 13 minutes. Worse still, once Gryxa rebuilt its connection, it re-enabled Microsoft Defender so the host's security posture looked green and healthy in management consoles—while leaving behind custom Defender exclusions that kept the toolkit invisible.

In one environment ReliaQuest investigated, defenders removed the visible RMM implant, only for a surviving component to bring the entire toolkit back within seven days. During the interim, that surviving component quietly harvested Windows Event Logs and host artifacts documenting the defenders' incident response actions and uploaded them to the attacker, effectively handing the adversary a playbook of which defensive tools and admin accounts the SOC had used.

Section Summary: The Gryxa toolkit pairs legitimate RMM software with WMI event subscriptions and scheduled tasks, automatically disabling or uninstalling Microsoft Defender and EDR agents within 10 to 13 minutes if responders only remove the visible RMM client.

Sector Risk: Why Professional Services and Manufacturing Lead the Pack​

When breaking down leak-site victims by industry, Professional, Scientific, and Technical Services (PSTS) remained the most frequently named sector during the June–August 2026 period, closely followed by Manufacturing.

From a risk architecture standpoint, this targeting makes cold, mercenary sense. PSTS organizations—which include law firms, accounting practices, engineering consultancies, managed service providers, and software vendors—act as data and identity hubs. Compromising a single PSTS firm often yields sensitive intellectual property belonging to dozens of downstream clients, alongside federated identity roles, service accounts, API tokens, and remote-administration pathways into customer tenants.

Manufacturing brings a different kind of leverage: high-value proprietary designs paired with zero tolerance for factory-floor downtime. ReliaQuest highlighted a campaign linked to the Clop extortion group targeting PTC Windchill, a widely deployed product lifecycle management (PLM) platform used by manufacturers to house engineering blueprints. After exploiting CVE-2026-12569, attackers deployed a custom Windchill web shell capable of mapping engineering files in the application vault, decrypting administrative and directory credentials from its keystore, and loading Java code directly into memory. A single vulnerable PLM server yielded both the crown-jewel engineering files and the credentials needed for wider network movement.

Section Summary: Extortion groups heavily target Professional, Scientific, and Technical Services for their concentrated client data and third-party access, alongside Manufacturing for its operational sensitivity and high-value engineering repositories.

Action Plan: Hardening Windows and Entra ID Against Identity-Led Extortion​

Defending against attackers who log in rather than hack in requires linking identity telemetry, SaaS audit logs, and Windows endpoint events into a single narrative. Based on ReliaQuest's operational guidance and Windows administration best practices, IT and security teams should implement the following controls immediately:

1. Overhaul Your Account Containment Playbook​

Never treat a password reset as the finish line for a compromised cloud or domain account. When containment is required:

• Disable the user account and explicitly revoke all active sessions and refresh tokens across Microsoft 365 and Entra ID.
• Audit and delete every unfamiliar registered device (which invalidates associated Primary Refresh Tokens), authenticator app, passkey, OAuth grant, and FIDO2 security key attached to the identity.
• Enforce a controlled, verified MFA re-enrollment process before re-enabling the account.

2. Lock Down External Collaboration and Remote Support Tools​

Stop help-desk impersonators before they ever reach an employee's screen:

• Restrict external Microsoft Teams messages and calls to an explicit allowlist of approved partner tenants, blocking unknown external domains by default.
• Block or strictly limit Windows Quick Assist and third-party RMM software using AppLocker, Windows Defender Application Control (WDAC), or Intune policies so only designated IT support groups can execute them.
• Establish an out-of-band internal verification rule so employees never approve device codes, MFA prompts, or remote screen-sharing sessions based solely on an inbound voice call or Teams message.

3. Correlate Identity Changes with Follow-On SaaS and SMB Activity​

Build detection rules that link administrative changes to subsequent data access within tight time windows:

• Trigger high-priority alerts whenever a password reset, new MFA method registration, or new Entra ID device enrollment is followed shortly by Microsoft Graph queries, SharePoint site enumeration, bulk file downloads, or VPN/RDP logons.
• When investigating an extortion message delivered via Teams or email, audit all SharePoint and Microsoft Graph bulk-read activity across the tenant over the preceding weeks rather than focusing exclusively on the account that sent the ransom demand.
• Monitor for rapid SMB writes to administrative shares (C$, ADMIN$), Impacket execution patterns, suspicious Active Directory Certificate Services (AD CS) requests, and directory replication originating from unexpected workstations or virtual machines.

4. Hunt for Deep Endpoint Persistence Before Cleaning Up RMM Tools​

When responding to an unauthorized RMM tool or suspected Gryxa infection:

• Isolate the affected Windows host at the network or EDR layer before deleting files or killing processes, preventing heartbeat-failure scripts from communicating or uploading responder logs.
• Inspect Windows Scheduled Tasks, permanent WMI Event Subscriptions (root\subscription namespace), and non-standard file directories for secondary persistence components before removing the primary RMM binary.
• Audit Microsoft Defender exclusion lists via PowerShell (Get-MpPreference) or Intune after remediation; never assume a green "Protected" status icon means the endpoint hasn't been blinded by attacker-configured path or process exclusions.
• Verify that 100% of internal virtual machines, hypervisors, and backup servers carry active, healthy EDR sensors so attackers cannot stage SMB encryption from unmonitored infrastructure.