Rotating IP infrastructure across intrusion stages for same identity

Ibrahim Saud@tektrix

•updated Sep 16, 2026•0•0•1

Detects a sequence of user activities—authentication, MFA registration, Graph API reconnaissance, and data exfiltration—originating from a rotating set of distinct source IP addresses for the same user within a 24-hour period. This behavior is indicative of coordinated infrastructure rotation tactics used by threat actors in cloud intrusions.