Microsoft Warns of Attackers Using Trusted HPE Operations Agent for Malware-Free Intrusions

Microsoft Incident Response investigated a stealthy, long‑running intrusion in which attackers abused the trusted HPE Operations Agent managed by a third‑party IT provider to deploy VBScripts and web shells (Errors.aspx, Signoff.aspx, ghost.inc), register malicious DLLs on domain controllers (mslogon.dll, passms.dll) to capture plaintext credentials, and exfiltrate data via SMB/email and ngrok tunnels; the report includes IoCs and remediation recommendations such as EDR deployment, outbound default‑deny, and monitoring for unexpected authentication configuration changes.