Commercial Property
Commercial client (anonymised) | UK
UK | Commercial Property | Managed Infrastructure, Connectivity & Cyber
CHALLENGE
The operating problem
Most organisations believe multi-factor authentication is enough to protect them from cybercrime. It is not.
Modern phishing toolkits are built to defeat basic MFA in real time. The attacker sits between the user and the login page, captures the session as it is authenticated, and reaches corporate systems while the user believes nothing unusual has happened.
This client was targeted in exactly that way. Two employee accounts received convincing login prompts. Both members of staff entered their credentials and approved the MFA request as they would on any normal working day. The attackers intercepted the live authentication session and moved to gain access before anyone noticed.
APPROACH
How Altus delivered
The client estate is monitored by Sentinel, the Altus managed detection and response service. Sentinel runs 24/7/365 and is built to identify a compromised session in minutes rather than days.
Within minutes of the accounts being used, Sentinel flagged three signals together: abnormal overseas login attempts, sign-ins from unrecognised devices, and traffic to infrastructure associated with known phishing operations.
The response was immediate:
- Both accounts locked
- All active sessions terminated
- A full forensic investigation opened across sign-in activity, mailbox access, forwarding rules, outbound communications and application permissions
The investigation established the scope of the incident rather than assuming it. That distinction matters, because this kind of access is normally followed by hidden mailbox rules and invoice fraud.
OUTCOME
What changed
The threat actor did not gain access to corporate systems. The incident was contained before the attackers could establish persistence, target customers or move laterally across the estate.
- No customer communications were compromised
- No fraudulent invoices were issued
- No sensitive information was extracted
- No reputational exposure occurred
MFA remains essential. It is no longer sufficient on its own. The control that made the difference here was continuous monitoring and a response measured in minutes.
TECHNOLOGY PARTNERS
Infrastructure stack
Sentinel – an Altus product, ISO 27001, Cyber Essentials Plus
Without active monitoring and rapid response, the outcome could have been materially different.
Commercial client · Confidential
THE NEXT STEP
Book a Critical Systems Review of your business.
We will look at where your infrastructure stack stands today, identify the gaps, and tell you straight what needs to change.