How should federal security teams defend email when attackers use compromised identities instead of known malware?

Why compromised identities change the email defense model

Email abuse is harder to stop when the attacker logs in with a real account, because the traffic often looks like normal user activity until the trust boundary is already crossed. That means defenders need to watch for the abuse of authenticated sessions, mailbox permissions, and post-login actions, not just malicious attachments or payloads. Identity-aware email defense is especially important in federal environments where account trust is often the first thing an adversary tries to inherit.

Once an identity is compromised, the attacker can blend into ordinary workflows, move from message access to inbox manipulation, and use the mailbox itself as an operational platform for follow-on activity. Controls therefore need to inspect what the account does after authentication, including anomalous delegation, rule creation, forwarding, token reuse, and access from unfamiliar locations or devices. A useful reference point is The 52 NHI breaches Report, which shows how stolen credentials and tokens repeatedly turn trusted access into breach paths.

Email teams should also treat identity compromise as a containment problem, not only a detection problem. If a mailbox is already being used for internal replies, data collection, or credential harvesting, the defender has to decide quickly whether to disable the session, revoke token grants, force reauthentication, or quarantine mailbox behaviors that suggest active abuse. That is why mailbox telemetry matters as much as message telemetry, and why controls around compromised access should be integrated with broader identity monitoring.

What to monitor inside the mailbox and sign-in path

The highest-value detections are usually the ones that expose the attacker’s next move, not the initial phishing email. Look for impossible or unusual sign-in patterns, rapid changes in device or location, token use that does not match the user’s normal behavior, and mailbox actions that create persistence or exfiltration paths. For federal teams, the key question is whether the mailbox is merely receiving malicious mail or is actively being used as a trusted launch point for lateral movement.

• Authentication anomalies, including unfamiliar geographies, atypical devices, and repeated MFA prompts that precede access.
• Mailbox rule abuse, especially hidden forwarding, auto-delete, or move-to-folder rules that suppress alerts.
• Suspicious delegation or consent grants that let another actor read or act as the mailbox.
• Token abuse or session persistence that keeps access alive after password reset.
• Outbound message patterns that signal internal impersonation, vendor fraud, or data staging.

Because compromised identities often bypass classic malware indicators, email security should correlate identity signals with message, endpoint, and cloud audit data. The objective is to spot the behavioral sequence, sign-in, mailbox change, and then data access, before the attacker turns the inbox into a foothold. The CISA cyber threat advisories remain useful for tracking current adversary tradecraft that targets trusted accounts rather than obvious malware.

Practitioner guidance for federal response and hardening

What to prioritise: Focus first on controls that break the attacker’s ability to reuse trust. Phishing-resistant MFA, conditional access, session revocation, and rapid mailbox rule review usually reduce more risk than adding another layer of content filtering. If a suspicious mailbox is in a sensitive team, treat it as a potential identity compromise until proven otherwise.

What to verify: Confirm that your telemetry can answer three questions quickly: who authenticated, from where, and what the mailbox did next. If you cannot trace those three elements together, you will struggle to distinguish nuisance phishing from active compromise. For control baselines, NIST SP 800-53 Rev 5 Security and Privacy Controls and CIS Controls v8 both support the core identity, audit, and account-management controls that make this style of defense operational.

What practitioners underestimate: A mailbox can be compromised without any malware on the endpoint, and a clean endpoint does not mean a clean account. In practice, the fastest path to containment is often to cut off the trusted session, reset the authenticated path, and then inspect mailbox persistence mechanisms before assuming the threat is over.

Practitioner takeaway: Treat email as a live identity surface, because once an adversary inherits a trusted account, the real security question is no longer what arrived in the inbox, but what the mailbox was allowed to do next.

Related resources from NHI Mgmt Group

• How should security teams defend against malware campaigns that use compromised email accounts and thread hijacking to deliver payloads like DanaBot?
• What happens when attackers use compromised email accounts and university identities to target recruitment teams?
• What happens when security teams investigate cloud threats without understanding how attackers use compromised identities?
• How should security teams adapt incident response when attackers use bribery and insider access instead of malware?