Learn / Attack archive / Lesson 25

Help desks and admin consoles

How a phone call to IT became the most expensive attack in British history, how one admin login wiped a medical company's devices worldwide, and why powerful actions need two people.

Last updated: 2026-09-23

What it is

Every company has people whose job is to give access back: the IT help desk that resets a password or a phone's second factor. Every company also has admin consoles that can do anything to every account or device at once.

Attackers have learned that both are easier targets than the software:

• Help-desk social engineering. The attacker phones IT, pretends to be an employee who lost their phone, and sounds convincing. They have the name, job title and manager from LinkedIn, and sometimes the last four digits of an ID from an old leak. IT resets the login and the attacker walks in with a fresh password and their own second factor.
• Admin consoles as weapons. Once inside with an administrator's account, the attacker does not need malware. Device management, cloud consoles and backup tools have buttons that wipe, delete or export everything, and using them looks like normal admin work.

Why it is a rule

• MGM Resorts, September 2023. A group known as Scattered Spider found an employee on LinkedIn, called the help desk, and got access reset in a ten-minute call. Casinos and hotel systems went down for days. MGM reported about $100 million in losses.
• Marks and Spencer, Co-op and Harrods, April and May 2025. The same playbook against UK retailers. M&S stopped online orders for about seven weeks and estimated the cost at around £300 million. Co-op had empty shelves in some shops.
• Jaguar Land Rover, September 2025. An attack claimed by a group linked to the same crowd shut down car production for about five weeks. The UK's Cyber Monitoring Centre estimated the total damage to the British economy at about £1.9 billion, the costliest cyberattack in UK history. How the attackers got in has not been officially confirmed.
• Stryker, 11 March 2026. An Iran-linked group calling itself Handala got hold of an administrator account for Stryker's Microsoft Intune, the console that manages company laptops and phones. It sent a remote wipe to every enrolled device at once. Laptops in 79 countries were erased, and so were employees' personal phones enrolled in the bring-your-own-device scheme, with their photos and authenticator apps. Reports put the count between 80,000 and 200,000 devices. An ECG transmission service used by paramedics went offline across most of Maryland. No malware was needed: every command was a legitimate admin action.

Why it keeps working

• Help desks are measured on speed. A kind, fast agent is exactly what the attacker wants.
• Identity checks use facts attackers already have. Name, employee ID, date of birth and manager are all findable.
• Resetting the second factor resets everything. Whoever controls the reset controls the account.
• Admin power is all or nothing. One account can do the most destructive thing the system allows, to every device, with no one else asked.
• Destructive actions look legitimate. Security tools look for malware. A wipe command from the real console is not malware.

How to do it

1. Verify the person, not the facts

• Call back on a number already on file, never one given in the call.
• Ask the person's manager to confirm, on a separate channel.
• Use a video call with ID, or an in-person check, for any reset of a second factor.
• For admins and executives, do not reset by phone at all.

2. Make resets visible

Tell the account owner, on every channel on file, the moment their login or second factor is reset. A real employee will say "that was not me" within minutes.

3. Two people for destructive actions

Mass wipe, mass delete, changing admin roles, turning off logging, deleting backups: each should need a second administrator to approve. Microsoft Intune, most cloud providers and most backup tools now offer this as a setting.

Admin A:  requests  "wipe all devices in group: All-Staff"
System:   holds the request, notifies approvers
Admin B:  reviews and approves or rejects

4. Split and shrink admin power

Nobody should use an admin account for daily work. Give each admin only the roles they need, make admin roles time-limited (granted for an hour when needed), and keep one sealed break-glass account for emergencies.

5. Keep one copy out of reach

Backups that the same admin account can delete are not backups in this attack. Keep at least one copy that is immutable or held by a different account.

How we do it here

Only a business's own admin account may manage who can sign in to it, and that admin can see the full list of people with access. The permission to manage access is checked on the server for every change, not just hidden in the page. Backups are covered in Backups and secrets.

Benefits

• Call-back and manager checks defeat the most common playbook for almost no cost.
• Two-person approval turns a total wipe into a request someone can refuse.
• Time-limited admin roles mean a stolen admin session is often a powerless one.

Disadvantages

• Stricter help-desk checks make real users wait, and frustrated users complain.
• Two-person approval slows real emergencies. Plan for who approves at 3 a.m.
• Small teams may have only one admin, which makes two-person rules hard. A delay with notification is the next best thing.

Checklist

• Help desk resets use a call-back or manager check, never facts alone.
• Owners are notified whenever their access is reset.
• Mass-destructive admin actions need a second approver.
• Daily work never uses an admin account.
• At least one backup cannot be deleted by any single admin.

Sources

• CISA — Scattered Spider advisory
• Stryker — Customer updates on network disruption
• Microsoft Learn — Use multiple administrative approval in Intune
• Cyber Monitoring Centre, assessment of the Jaguar Land Rover incident, October 2025.
• Marks and Spencer Group, full-year results statement, May 2025.

Read this lesson as Markdown