How did attackers use Microsoft Intune?

What investigators say happened

Security researchers and reporting indicate the intrusion leveraged a device-management channel to amplify the impact inside a global corporate network. According to public reporting, the attackers issued a remote wipe command through Microsoft Intune — a legitimate enterprise tool that administrators use to manage, update and, when necessary, remotely wipe corporate endpoints. That command appears to have been used to erase or disable Windows devices that were connected to the victim’s Intune tenant.

The incident disabled large parts of the company’s Windows estate and left employees and contractors worldwide without access to core systems. The outage coincided with claims from pro‑Iran hacktivist groups and with broader regional tensions; public statements by the attackers and some forensic observers tied the disruption to those geopolitical events, but attribution remains contested in open reporting.

Why this matters for enterprise security

• Management-plane compromise: If an attacker gains access to an MDM/EMM console, they can push destructive or disruptive commands at scale.
• Blast radius: Remote-wipe capabilities are purposely powerful; abused, they can turn routine administration tools into weapons.
• Supply-chain and segmentation failures: Over-reliance on a single management domain makes recovery harder when that domain is targeted.

Short-term and long-term implications

In the short term, organizations hit by similar tactics should isolate management consoles, verify admin credentials and restore critical systems from out‑of‑band backups. Long term, the incident underscores the need for layered defenses around device-management systems: strict role-based access, multi-factor authentication for admin accounts, just-in-time privileges, audit logging forwarded to an immutable store, and network segmentation that prevents management-plane credentials from being repurposed to reach endpoints. It’s still unclear how the attackers originally obtained the necessary credentials or what gaps in monitoring allowed the remote-wipe command to succeed at scale.