How can organisations defend against Windshift?

How Windshift defenders should think about the problem

windshift-style activity is best treated as a targeted espionage campaign, not as generic spam. That means defenders need to combine mailbox protection, identity hardening, and alerting on account behaviour that looks like quiet, patient access rather than obvious malware detonation. The most useful signal is often a normal account doing abnormal things, especially in environments that handle policy, diplomatic, or similarly sensitive information.

Because the initial path is often email-led, message filtering alone is not enough. Teams should assume that a single lure can be enough to steal credentials, prompt a malicious sign-in, or establish persistence through mailbox rules and delegated access. Defenders get the most value when they correlate email events with sign-in telemetry and mailbox changes, rather than reviewing those areas separately.

For identity hardening, phishing-resistant MFA and conditional access are more effective than one-time user awareness training. The practical goal is to make stolen passwords insufficient, then narrow what an attacker can do if they reach an account. That includes limiting delegated mailbox access, reviewing high-risk sign-ins, and watching for changes that let an attacker remain in the mailbox after the first login has been blocked.

What to look for in email, identity, and mailbox activity

Defence works best when it is tuned to the behaviours that support espionage. Watch for document lures, shortened or redirected links, unusual forwarding rules, inbox rules that hide replies, and delegated access granted without a clear business reason. Those are often more actionable than raw volume-based alerts because they show intent to maintain access and quietly move information out of the environment.

Threat Actor Groups Guide is useful here because defenders should map suspicious activity to the broader group behaviour, not just the campaign name. That helps analysts recognise when a lure, alias, or infrastructure pattern is consistent with a known espionage operator rather than a one-off event.

Unusual sign-ins matter most when they align with sensitive accounts. A login from a new geography, a legacy protocol, an unfamiliar device, or a session followed quickly by mailbox rule creation should be treated as a likely compromise indicator. The same applies when sensitive mailboxes begin exhibiting low-and-slow exfiltration patterns, such as repeated access to a narrow set of messages or attachments over time.

Where containment should focus first

The highest-value containment move is to secure privileged and sensitive accounts before expanding to broad hunting. If an account can read policy, diplomatic, executive, or security material, it deserves faster triage, stronger authentication requirements, and tighter session review than ordinary user accounts. In practice, that means prioritising accounts with delegated access, admin rights, and long-lived sessions or tokens that can survive a password reset.

Use phishing-resistant authentication wherever possible and make recovery paths equally strong. If recovery still relies on weaker factors, an attacker can regain access even after the original sign-in is blocked. Review mailbox delegation, forwarding, and rule inheritance as part of containment, because these are common ways for adversaries to keep access without repeatedly triggering user-visible alerts.

For control baselines, NIST SP 800-53 Rev 5 Security and Privacy Controls is a strong reference for pairing access control, authentication, logging, and account monitoring. NIST SP 800-63 Digital Identity Guidelines is relevant where the key decision is how to raise authenticator strength against phishing and token theft.

Risk and Threat Considerations

Windshift activity creates disproportionate risk because the compromise path is often quiet, selective, and aimed at information value rather than disruption. The danger is not only stolen mail, but durable access to accounts that can observe internal discussions, alter mailbox behaviour, and exfiltrate material over time without obvious service interruption.

Failure mechanism: An attacker uses email lures, credential theft, or mailbox abuse to gain persistent access, then hides activity through forwarding rules, delegated permissions, or low-volume exfiltration from sensitive accounts.

Impact: Organisations can lose confidentiality of sensitive policy or diplomatic information, miss signs of continued access, and face follow-on compromise of adjacent accounts or trust relationships.

Practitioner Guidance

What to prioritise: Put your fastest response path on accounts with access to sensitive correspondence, not on the largest mailbox population. A compromised executive assistant, privileged operator, or policy account can matter more than dozens of ordinary user accounts.

What to verify: Confirm whether the account has new inbox rules, forwarding destinations, delegated access grants, or stale sessions that survived password change. If any of those are present, treat the case as a persistence problem, not just a login problem.

Practitioner takeaway: The decisive question is whether the attacker can still read, route, or remove sensitive mail after the first alert. If yes, containment must focus on mailbox control and session revocation, not only password reset.

Related resources from NHI Mgmt Group

• How should organisations defend against attack-as-a-service identity fraud?
• How should organisations defend biometric authentication against spoofing attacks?
• How should organisations defend against business email compromise when attackers use real conversations?
• How can organisations defend against AI-generated phishing and impersonation?