Expel Quarterly Threat Report volume IV (Q1 2024): suspicious authentication sources

This Q1 Quarterly Threat Report highlights identity-related incidents observed by the SOC, emphasizing AiTM credential-harvesting campaigns that capture credentials and bypass MFA. It documents attacker techniques—frequent use of hosting providers/VPS (42%), VPNs/TOR (19%), residential proxies (4%), and geolocation anomalies (28%)—and recommends mitigations such as enforcing MFA plus additional restrictions like requiring authentication from managed devices.