How should a team use the UNC3944 reporting?
Use the reported behavior to identify prerequisites to inspect locally: the recovery route, the exact administrative change, the resulting authentication method, and the account’s authority. Confirm each transition with evidence before claiming the full path is possible.
A help-desk reset matters because of what the recovered account can do next. Use the UNC3944 reporting to review one account category and its recovery route, then establish which later actions the account would permit.
Start with the reported behavior
Mandiant’s June 2024 report describes UNC3944 impersonating employees at corporate help desks, using personal information during verification, and requesting password or MFA resets. The targeted accounts had significant privilege potential. Subsequent activity included internal reconnaissance and SaaS access, including abuse of Okta application assignments. Mandiant: UNC3944 Targets SaaS Applications
The July 2025 joint Scattered Spider advisory separately describes employee impersonation to obtain password resets and transfer MFA to attacker-controlled devices. It also describes attackers registering their own MFA tokens after compromise. Joint advisory: Overview and Execution, Persistence, and Privilege Escalation
These sources support a recovery-abuse review. They do not establish that your organization uses the same recovery mechanism. Mandiant describes overlap with several public group names; retain each source’s attribution rather than treating every name as an identical set of incidents.
The model below follows the recovery part of the attack. It is neither a complete UNC3944 lifecycle nor a claim that the reported intrusions used Microsoft Entra or a Temporary Access Pass.
Choose the account category before the scenario
The account’s permissions determine why the recovery decision matters. Review a category that your team can describe precisely: employees with access to a sensitive application, support staff who can change other accounts, or administrators with application-assignment authority.
Use a dedicated test account representing the selected category. The review should answer three questions before anyone tests a call:
- What recovery action can the service desk perform or approve for this category?
- What prerequisites would a recipient need to enroll a replacement method?
- Which application operation is approved for the assessment, and which permissions govern it?
For example, a test account may be allowed to read a harmless training page but prohibited from changing application assignments. Those are different capabilities. A successful page read cannot answer whether the account could assign itself another application. If that second capability matters, review its permissions with the identity owner and scope a separate check.
The caller verification guide supplies the procedure review. Here, the additional work is connecting that procedure to the account’s actual authority.
Translate “reset MFA” into an administrative action
Ask the identity owner to name the operation and show what it changes. In Microsoft Entra, method management, requiring re-registration, and session revocation are distinct actions. Require re-register MFA affects specified methods; it does not remove every credential. Microsoft: manage user authentication options
Now test the proposed explanation on paper. If an agent removes an old phone method, how would the requester complete the next authentication step? If a recovery credential is issued, who receives it? If enrollment remains restricted, what would permit the recipient to add a method?
Write unknown prerequisites as questions in the review. Do not fill them with a TAP, device join, password reset, or other action merely because it appears in another attack chain. The Temporary Access Pass review is relevant only when that is the recovery mechanism in scope.
Follow the recovery decision
Illustrative model informed by UNC3944 reporting
- Caller claims employee identity
Help desk checks the requester and requested change.
Only if recovery is approved
- Account change executes
Confirm the actor, target and scope that enable replacement-method registration.
Only if enrollment prerequisites are met
- Requester enrolls a method
Match the new method to the inventory and establish who controls it.
Only if sign-in succeeds
- Client requests application access
Record the specific operation: allowed or denied.
A failed prerequisite stops this path. Enrollment alone does not establish resource access.
Ask who can confirm each step
| Transition | Local question | Record to request |
|---|---|---|
Caller to recovery approval |
What evidence authorizes this change for this account category? |
Approved procedure and verification record |
Approval to account change |
Which operator can execute the action, and what exactly changes? |
Administrative action, actor, target, and result |
Change to method enrollment |
What permits registration, and who controls the resulting method? |
Enrollment prerequisites, method inventory, and recipient evidence |
Sign-in to resource operation |
Which permission permits the named operation? |
Application authorization and operation result |
A policy document answers what should happen. An assessment record answers what happened in the tested case. Keep both: the difference is often the finding.
For Entra investigations, identify the user, client application, and target resource before interpreting a sign-in. Microsoft documents these as separate components. Check the resource’s own records to find out what operation occurred. A sign-in result alone cannot tell you what happened inside the application. Microsoft: sign-in activity components
Record the controls that stopped the next step
A verification defect and a blocked continuation can coexist. If recovery is approved without the required check but delivery reaches only a previously approved destination unavailable to the requester, the delivery control may interrupt that path. It does not repair the earlier approval defect.
Record each result at the stage actually examined. Enrollment and resource access remain untested unless they were separately authorized and observed. The service-desk owner should address verification, while the identity owner checks whether the delivery destination can be replaced through the same unverified interaction.
Start with the first unanswered question
Bring the completed transition table to the service-desk and identity owners. Choose the first unresolved prerequisite that could change your assessment: a poorly defined exception, a recovery destination with no approved change history, or an account permission nobody expected.
For each issue, record the owner, the proposed fix, and the observation that would show it worked. If the fix changes the exception process, include a legitimate employee who cannot use the normal authenticator in the retest. The process still has to restore the right person’s access.
