Business Email Compromise, Contained. Attacker Evicted from M365 — Full Forensics and Hardening Delivered.
The client received an email from a known, trusted contact — someone they'd worked with for years. But that contact's Microsoft 365 account had been silently compromised weeks earlier through an AiTM (Adversary-in-the-Middle) phishing attack that bypassed MFA by stealing the live session token after login. The attacker spent time in the inbox learning the business relationship, then launched a mass mail blast to the contact's full address book, including our client. BEC — Business Email Compromise — is now the highest-value fraud category in India, and this is exactly how it starts: not from a stranger, but from someone you trust.
Techieism recognised the BEC pattern immediately and began investigation. Using Microsoft 365's Unified Audit Log (UAL), we built a complete forensic timeline — exactly when the account was compromised, what IP addresses were used, which emails were read, and what the attacker changed. We found attacker-planted inbox rules designed to silently forward copies of future emails and hide replies from the legitimate owner. All active sessions were immediately revoked across all devices. Credentials were reset and MFA re-enrolment was enforced on the next login. The malicious inbox rules were removed. All affected parties identified through the audit log were notified. The M365 tenant was then hardened with Conditional Access policies that block sign-ins from unrecognised devices and suspicious locations — closing the exact gap the attacker exploited. The attacker was fully evicted, with zero data loss confirmed.
~2TB of SharePoint Data. Two Companies. Zero Data Loss. Zero Paid Migration Tools.
When a company is acquired or merged, moving its SharePoint data to the new parent organisation's Microsoft 365 tenant is among the most complex tasks in corporate IT. Migration vendors quote lakhs for tools like ShareGate or Metalogix — and even then, data loss, broken permissions, and version history gaps are common risks.
Techieism was engaged to migrate nearly 2TB of SharePoint data across a full tenant-to-tenant transfer triggered by a corporate restructuring. We built the entire migration using PowerShell scripting alone — no third-party tool licences required. Custom scripts handled document library traversal, folder hierarchy mapping, metadata preservation, permission mapping across tenants, conflict resolution, and incremental sync so the migration could be safely paused and resumed. Every file, every folder, every document arrived in the destination tenant intact. The result: zero data loss confirmed across the full ~2TB — and lakhs saved on tool licensing that would have been charged before migrating a single file.
One Server. Four VMs. One Windows Licence Instead of Four. No RAID Controller. Zero Data Risk.
A Chartered Accountancy firm needed a complete office server setup — file server, Active Directory, Tally ERP, and Winman tax software. The conventional approach meant multiple Windows Server licences, CAL costs per user, a hardware RAID controller, and enterprise NAS hardware — several lakhs before a cable was connected.
Techieism built the entire solution on a single well-specified machine: an Intel Core i9 desktop with an NVMe SSD for the OS and Seagate IronWolf NAS-grade drives for data. We deployed Proxmox VE — enterprise open-source virtualisation — and created four isolated VMs. Active Directory and the file server run on Linux VMs at zero licence cost (Samba AD + Linux Samba file server). Tally and Winman share a single Windows Server VM — one licence covering both applications. For data protection, ZFS RAID configured natively in Proxmox replaces a hardware RAID controller entirely: automatic integrity checking, silent error correction, drive-failure redundancy, and instant point-in-time snapshots — all in software, on standard drives.
Four Offices. One Domain. Zero Extra Windows Server Licences.
A multi-office organisation needed centralised identity management — one login for every employee at every location, uniform Group Policy, and central IT control. The conventional path: buy Windows Server for every site, pay per-user CALs, manage separate AD instances, and deal with replication complexity at Microsoft's price.
Techieism deployed four Samba Active Directory Domain Controllers — one at each office — running on Linux servers. Samba AD is fully compatible with Microsoft's AD protocol: Windows PCs, printers, and business applications join the domain exactly as they would with Windows Server. All four DCs are automatically replicated and interconnected — user accounts, group policies, and authentication data stay in sync across every office. If one DC goes offline, the others continue serving login requests without interruption. Result: full enterprise AD infrastructure at zero Windows Server licence cost.
All Offices Connected — No MPLS. No VPN Servers. No Costly Routers.
A multi-office organisation was spending heavily on MPLS leased lines (₹40,000–₹2,00,000 per link per month), dedicated VPN servers, and enterprise routers at every site. The connectivity was expensive, inflexible, and entirely dependent on a single vendor. Adding a new office meant weeks of lead time and more recurring cost.
Techieism replaced the entire stack with an open-source mesh network. We deployed OPNsense open-source firewalls at every office location — giving each site enterprise-grade security, traffic control, and firewall rules. We then set up a self-hosted Headscale coordination server (the private, self-controlled equivalent of Tailscale) as the network's central brain. Every OPNsense firewall registered with Headscale, and WireGuard encrypted tunnels were automatically established between all sites. The result: a fully meshed private network where every office reaches every other office directly — servers, printers, internal apps — as if on one LAN. Remote employees connect to the same mesh. New offices are added in minutes. Every rupee previously spent on MPLS and VPN hardware is now permanently saved.
Have a Similar Challenge?
Every solution above was built to solve a real problem — cost, complexity, reliability, or vendor lock-in. Tell us your challenge and we'll engineer the right fix.