Microsoft’s Office 365 suite of cloud applications is now the most popular cloud service in the world by user count. While this has fast-tracked Microsoft’s path to becoming a cloud-first enterprise software company, it has also put a bulls-eye on Office 365, making it a target of choice for hackers. …

KnockKnock has been active since May 2017 and is currently still active. To go undetected, the hacking activity occurs in short stints, averaging 3-5 attempts of guessing the password of the system account before moving on to a different account within an organization. Moreover, it doesn’t display the same level of activity across multiple organizations. As it ramps up its number of attempts in one organization, it ramps down in others, further making detection difficult.