Ariful Huq (ahuq@exaforce.com) is a legitimate employee in the Product department managed by Ankur Singla. The account has privileged admin access across multiple platforms: Google Workspace (_SEED_ADMIN_ROLE) and Azure (Global Reader). This level of access makes the account highly valuable to attackers, as it provides extensive control over organizational resources and data. The administrative privileges associated with this account significantly escalate the risk posed by potential compromise. Note that all resource names have been analyzed solely from a behavioral perspective, ignoring any environmental context that could be faked by an attacker.

The access originated from Moscow, Russia (146.70.231.10) using ASN9009 (M247 Europe SRL), which represents a complete anomaly from the user's established pattern. Historical data shows the user typically accesses systems from the US (142 IP addresses), primarily South San Francisco, with occasional access from various other countries but never from Russia. While M247 Europe SRL does provide VPN services, it doesn't match any corporate VPN providers (like Zscaler AS22616 or Netskope AS55256) previously used by this principal. Most critically, concurrent sessions were detected from US locations within the same timeframe, making this a clear case of impossible travel rather than legitimate international travel.

The suspicious session specifically targeted sensitive financial and corporate governance documents, including: Series-A folder, Investor Presentation folder, Board Meeting Minutes folder, and "Exaforce Board Meeting Minutes - Signed Copy.pdf". The session consisted entirely of view operations, suggesting reconnaissance or data exfiltration rather than modification. This pattern is consistent with an attacker identifying and accessing high-value information. The sequential access pattern shows deliberate navigation through folders to locate specific documents of interest, particularly focusing on board meeting minutes and investor presentations, which would contain highly confidential corporate information.

The resources accessed during this session contain highly sensitive corporate information. The Series-A folder and Investor Presentation folder likely contain confidential financial data, funding details, and information that would be valuable to competitors or for financial market manipulation. The Board Meeting Minutes document represents critical corporate governance information that could reveal strategic decisions, undisclosed business plans, and other highly confidential internal matters. The sequential access pattern suggests the attacker knew what they were looking for and navigated directly to these high-value documents.

The session exhibits several behavioral red flags: 1) It originated from a location never before used by this principal, 2) It occurred concurrently with legitimate sessions from US locations (impossible travel), 3) It targeted specific high-value documents rather than showing normal work patterns, 4) It used a non-corporate VPN provider, 5) The access occurred at approximately 06:11 UTC, which would be very early morning in the US where the user is based. The user's legitimate authentication from US-based IP addresses via SSO during the same timeframe strongly suggests credential compromise rather than account sharing or other explanations.

Both the user Ariful Huq and manager Ankur Singla failed to respond to the confirmation workflow within the critical severity timeout period of 12 hours. This lack of response is particularly concerning for an incident of this severity level, as security protocols typically require prompt acknowledgment from the user or their manager for suspected account compromises. The non-response could indicate several possibilities: 1) The user might be unavailable or unaware of the confirmation request, 2) The user's communication channels may also be compromised, 3) The severity of the situation was not properly communicated or understood, or 4) There might be legitimate reasons for non-response such as travel or time off. Regardless, the lack of response further elevates the concern about this activity and necessitates escalated investigation.

This finding warrants Critical (P0) priority based on: 1) Critical severity due to confirmed compromise of an administrative account, 2) Strong recommendation for immediate investigation given the clear evidence of account compromise, 3) High business impact due to exposure of sensitive financial and board-level documents, and 4) The lack of response from both user and manager within the critical severity timeout period, which further increases the risk. The combination of administrative privileges and access to highly sensitive corporate governance documents creates an exceptional risk requiring immediate response.