Microsoft Warns HPE Operations Agent Abused in Malware-Free Attacks

Microsoft disclosed a stealthy intrusion campaign where attackers, after compromising a third-party IT services provider, abused trusted enterprise management tools (HPE Operations Agent/Manager) to execute VBScript payloads and DLLs (notably 'mslogon' and 'passms.dll'), capture credentials on domain controllers and via LSA hooks, deploy web shells, and maintain covert remote access using ngrok and WMI-based execution; stolen credentials were encoded and exfiltrated, enabling prolonged lateral movement while blending into normal administrative workflows. Microsoft recommends EDR coverage, strict outbound controls, detailed logging, and adopting a zero-trust posture for third-party access.