Hackers Using Device Registration Trick to Attack Enterprises with Lateral Phishing

Microsoft has disclosed particulars of a big-scale, multi-stage phishing marketing campaign that uses stolen credentials to register devices on a victim’s network to even more propagate spam emails and widen the infection pool.

The tech huge mentioned the attacks manifested by accounts that were being not secured employing multi-factor authentication (MFA), thereby creating it attainable for the adversary to take advantage of the target’s provide-your-personal-device (BYOD) plan and introduce their possess rogue products using the pilfered qualifications.

The attacks took area in two levels. “The initial marketing campaign stage associated stealing credentials in target businesses positioned predominantly in Australia, Singapore, Indonesia, and Thailand,” Microsoft 365 Defender Threat Intelligence Staff said in a technical report printed this week.

“Stolen credentials were being then leveraged in the next period, in which attackers employed compromised accounts to develop their foothold in just the group through lateral phishing as very well as further than the network through outbound spam.”

The marketing campaign begun with people acquiring a DocuSign-branded phishing lure that contains a backlink, which, upon clicking, redirected the receiver to a rogue internet site masquerading as the login web site for Business office 365 to steal the credentials.

The credential theft not only resulted in the compromise of about 100 mailboxes across distinct businesses, but also enabled the attackers to apply an inbox rule to thwart detection. This was then followed by a 2nd attack wave that abused the deficiency of MFA protections to enroll an unmanaged Windows product to the company’s Azure Active Listing (Advertisement) occasion and spread the destructive messages.

By connecting the attacker-controlled gadget to the network, the novel strategy created it viable to grow the attackers’ foothold, covertly proliferate the attack, and move laterally in the course of the targeted network.

“To start the 2nd wave, the attackers leveraged the specific user’s compromised mailbox to ship malicious messages to over 8,500 customers, the two in and outside of the target corporation,” Microsoft claimed. “The emails made use of a SharePoint sharing invitation lure as the information body in an try to convince recipients that the ‘Payment.pdf’ file staying shared was reputable.”

The development will come as email-based social engineering attacks continue to be the most dominant implies for attacking enterprises to attain first entry and fall malware on compromised techniques.

Before this thirty day period, Netskope Risk Labs disclosed a malicious marketing campaign attributed to the OceanLotus team that bypassed signature-centered detections by applying non-common file styles this sort of as web archive file (.MHT) attachments to deploy info-stealing malware.

In addition to turning on MFA, applying very best practices this sort of as fantastic credential cleanliness and network segmentation can “maximize the ‘cost’ to attackers attempting to propagate via the network.”

“These finest practices can limit an attacker’s potential to go laterally and compromise belongings right after initial intrusion and must be complemented with innovative security remedies that present visibility across domains and coordinate danger info across security elements,” Microsoft additional.

Observed this write-up appealing? Observe THN on Facebook, Twitter  and LinkedIn to study more exclusive material we publish.

Some parts of this article are sourced from:
thehackernews.com