Adversary Infrastructure New Huntress ITDR Feature

* A phishing-as-a-service operation targeted Railway, a developer cloud platform, in March.
* Device code phishing lures hit 344 organizations across five countries in under three weeks.
* Microsoft did not score logins from Railway's IP ranges as risky.
* A Conditional Access policy was hand-built to block Railway's IP ranges, validated against 14 days of fleet traffic, and pushed to Managed ITDR tenants.
* This action stopped 305 attack attempts at the door with zero legitimate logins affected.
* Adversary Infrastructure blocks attackers at the Microsoft 365 sign-in before a session is established.
* When a compromise is confirmed in one tenant, blocking policies are applied across every eligible tenant.
* The process involves SOC confirmation of hosting/relay infrastructure, validation by detection engineers (requiring evidence from multiple partners), deployment of blocks to canary tenants, and rollout to all others.
* Each block generates a Low severity incident report naming the identity, source, and campaign, and rotates the credential.
* Two specific campaigns included LSHIY LLC with 81 million login attempts and 1337 Services GmbH with token replay from a German hosting provider's IP range.

The narrative pivots on the difference between reactive, single-tenant incident response and proactive, fleet-wide infrastructure defense. The shift described moves security from placing specific policies (like ISPM, which sets broad posture controls) to dynamic, context-aware response (Adversary Infrastructure). The core implication is that identity attacks are no longer about exploiting a single gap but exploiting the entire supply chain of infrastructure rental and automated lure generation. Attackers have optimized their methods by renting clean cloud space and using AI for personalization, which defeats static blocklists. Adversary Infrastructure addresses this by treating observed infrastructure as an instantly actionable threat signal distributed across the entire identity footprint, effectively creating "herd immunity" for identity by ensuring that a failure in one area creates systemic resistance everywhere else. The tension lies between the established baseline controls (ISPM) and the dynamic response layer (Adversary Infrastructure); the success seems to depend on how seamlessly the plumbing of posture management can integrate with real-time, distributed threat intelligence to maintain agency over access.
Bridge Questions: If identity protection relies on a shared, distributed defense mechanism like this, what are the potential risks associated with centralized or shared control over fleet-wide blocking policies? How does the emphasis on immediate, automated response affect the human oversight required in post-incident review when dealing with dynamically shifting infrastructure? What alternatives exist for organizations to maintain localized autonomy when relying on vendor-managed distributed controls?