For example, in the 2023 MGM attack, the attacker specifically accessed an account with Tremendous Admin permissions in Okta, which they combined with an inbound federation attack to impersonate any consumer inside the tenant, get Azure admin privileges, and authenticate towards the Azure-hosted VMware surroundings where by they deployed ransomware