RedVDS - Conditional Access Bypass via Legacy Auth (T1078)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Identifies login attempts from RedVDS infrastructure IPs deliberately utilizing legacy authentication protocols (IMAP/POP3) to bypass Modern Authentication Conditional Access policies.