Microsoft Warns of Widening APT29 Espionage Attacks Targeting Global Orgs

Microsoft on Thursday explained the Russian state-sponsored menace actors accountable for a cyber attack on its devices in late November 2023 have been targeting other organizations and that it’s at this time beginning to notify them.

The enhancement will come a working day soon after Hewlett Packard Organization (HPE) discovered that it had been the victim of an attack perpetrated by a hacking crew tracked as APT29, which is also known as BlueBravo, Cloaked Ursa, Cozy Bear, Midnight Blizzard (formerly Nobelium), and The Dukes.

“This menace actor is known to largely focus on governments, diplomatic entities, non-governmental organizations (NGOs) and IT provider vendors, largely in the U.S. and Europe,” the Microsoft Risk Intelligence team explained in a new advisory.

The main purpose of these espionage missions is to acquire delicate facts that is of strategic fascination to Russia by protecting footholds for prolonged periods of time without the need of attracting any interest.

The most up-to-date disclosure suggests that the scale of the campaign may have been bigger than beforehand imagined. The tech large, on the other hand, did not expose which other entities have been singled out.

APT29’s operations entail the use of respectable but compromised accounts to get and grow access inside a concentrate on setting and fly underneath the radar. It can be also recognized to determine and abuse OAuth programs to transfer laterally throughout cloud infrastructures and for article-compromise action, this kind of as email collection.

“They benefit from diverse initial entry strategies ranging from stolen credentials to provide chain attacks, exploitation of on-premises environments to laterally go to the cloud, and exploitation of support providers’ trust chain to get accessibility to downstream prospects,” Microsoft noted.

Yet another notable tactic entails the use of breached user accounts to generate, modify, and grant superior permissions to OAuth purposes that they can misuse to conceal malicious action. This permits risk actors to retain obtain to applications, even if they shed accessibility to the at first compromised account, the business pointed out.

These malicious OAuth applications are in the end utilized to authenticate to Microsoft Trade On the web and target Microsoft company email accounts to exfiltrate details of curiosity.

In the incident concentrating on Microsoft in November 2023, the risk actor used a password spray attack to effectively infiltrate a legacy, non-manufacturing test tenant account that did not have multi-factor authentication (MFA) enabled.

Such attacks are launched from a dispersed household proxy infrastructure to conceal their origins, letting the risk actor to interact with the compromised tenant and with Exchange On the net by way of a huge network of IP addresses that are also applied by respectable customers.

“Midnight Blizzard’s use of residential proxies to obfuscate connections tends to make conventional indicators of compromise (IoC)-dependent detection infeasible because of to the substantial changeover amount of IP addresses,” Redmond said, necessitating that corporations acquire steps to protect towards rogue OAuth programs and password spraying.

Observed this posting attention-grabbing? Abide by us on Twitter  and LinkedIn to read through a lot more unique written content we put up.

Some parts of this post are sourced from:
thehackernews.com