Got hacked by a rambler.ru account

I agree with Sasha. I too have been hacked by rambler.ru and I too worked for Microsoft for many years. I have not received any useful help or direction on how to recover my account to regain access to my OneDrive or the O365 app I paid for. I have followed the instructions to recover the account multiple times but the hacker is so good, none of my responses to questions is accurate anymore. Please find an answer!

Hi Rob

I am impressed. Your background sound somewhat similar toind except I have 2nd level support plus data base correction with enterprise functional support and a little cyber security thrown in. You can imagine how freaked out I was to see my emails were taken over and spamming ppl.. Mostly you have been correct and have comprehended all facets of my issue. The only part that was nott completely known was that I have 3 other registered accounts used for sisterting each other and multifmulti factor authentication. I had my phones linked to Microsoft as well but the Pi link from microsoft... which I never requested not touched I suspect was the trigger. The Microsoft website states since 2020 that this trojan/bot does bypass all multifacotor authentication such you discussed above and I had/have in place now. Trust me. The issues that arise from having a multifacotor authentication method that you can it log into and update are mindbending.

Many thanks for some intelligent and focused replies...

Yes, Sasha, that email indicates the person, or more likely bot, that took over your account had already managed to acquire and use whatever password and other security verification method(s) were breached or collected in order to receive that email providing access to managing the account.

That's not the question, you've established you lost control of the account. The only question that remains to be answered is how they got access to most likely the password, as well as at least one other form of verification in order to be allowed to generate that message, since the password alone has never been enough.

It may not ever be possible to confirm this with any certainty, but it's critical that you understand how the account might have been breached in order to ensure you're protecting your new one. If your password was relatively short and especially simple, like a word or two, that alone could have allowed that to be breached, but duplicate passwords used on other websites that were breached, along with malware on your personal systems are possibilities as well.

As for the other form of verification, it's less likely they managed to directly breach a phone number or text, though if you ever responded to a supposed text message sent by Microsoft or provided this information to a 3rd party, those are common ways these are acquired from the account owner himself. Easier though is to acquire access to an alternate email account that's not as well protected, like a cable or similar email address that was included in the list of optional verification methods for your original account.

My own verification methods including the wireless company personal account that provides access to my smartphone information, as well as my alternate email account, all include 2-factor (2-Step in Microsoft terminology) authentication. Meaning you'd need 2 forms of identification typically including the password as the first, so the password can never be used alone and is never the same on any of these sites as any other, as well as relatively complex with no simple words or other easily hacked patterns.

Only you can determine what combination of less well secured verification method(s) may have been used to hack that older account, since only you know the answers to these questions, if anyone. In some cases, it's not possible to know how your password was acquired, but understanding the risks lets you better create and protect this in the future to avoid it ever happening again.

Note that I'm a past computer administrator and security professional who worked for and with computer, education and other major corporate customers, so I have a background in dealing with these issues for hundreds or thousands of users for over 40 years. In that time, I've seen all sorts of things, but typically my greatest problem was the employees, students and personal users of the devices themselves, since they've always been the easiest way to breach any system or account.

Rob