Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Nobelium APT. Show all posts
Russian Hackers
APT-29 Corporate emails Data Breach Microsoft Microsoft Emails Microsoft Security Response Midnight Blizzard Nobelium APT Password spray attacks Russian Hackers

Midnight Blizzard: Russian Threat Actors Behind Microsoft Corporate Emails’ Breach


On Friday, Microsoft informed that some of its corporate accounts suffered a breach in which some of its data was compromised. The attack was conducted by a Russian state-sponsored hackers group named “Midnight Blizzard.”

The attack was first detected on January 12th, and Microsoft in its initial investigation attributed the attack to the Russian threat actors, known famously as Nobelium or APT-29.

Microsoft informs that the threat actors launched the attacks in November 2023, in which they carried out a password spray attack in order to access a legacy non-production test tenant account. 

Password Spray Attack

A password spray attack is a type of brute force attack where threat actors collect a list of potential login names and then attempt to log in to all of them using a particular password. If that password fails, they repeat this process with other passwords until they run out or successfully breach the account.

Since the hackers were able to access accounts using a brute force attack, it is clear that it lacked two-factor authentication or multi-factor authentication.

Microsoft claims that after taking control of the "test" account, the Nobelium hackers utilized it to access a "small percentage" of the company's email accounts for more than a month.

It is still unclear why a non-production test account would have the ability to access other accounts in Microsoft's corporate email system unless the threat actors utilized this test account to infiltrate networks and move to accounts with higher permissions.

Apparently, these breached accounts include members of Microsoft’s leadership team and employees assigned to the cybersecurity and legal departments, targeted by hackers to steal emails and attachments. 

"The investigation indicates they were initially targeting email accounts for information related to Midnight Blizzard itself," the Microsoft Security Response Center shared in a report on the incident.

"We are in the process of notifying employees whose email was accessed."

Microsoft reaffirms that the incident was caused by the brute force password attack, rather than a vulnerability in their product services.

However, it seems that Microsoft’s poorly managed security configuration played a major role in the success of the breach.

While this investigation is underway, Microsoft stated that they will release more information when it is appropriate.  

Read more »
Window Domains
Backdoor Custom Malware malware Nobelium APT Window Domains

Nobelium APT Group Uses Custom Backdoor to Target Windows Domains

 

Researchers from Microsoft Threat Intelligence Center (MSTIC) identified FoggyWeb, a new custom malware utilized by the Nobelium APT group to distribute further payloads and steal critical information from Active Directory Federation Services (AD FS) servers. 

FoggyWeb is a post-exploitation backdoor utilized by the APT group to remotely exfiltrate the setup databases of affected Active Directory Federation Services (AD FS) servers, as well as the decrypted token-signing and token-decryption certificates. It also enables threat actors to download and execute additional elements. 

The analysis published by Microsoft stated, “Once NOBELIUM obtains credentials and successfully compromises a server, the actor relies on that access to maintain persistence and deepen its infiltration using sophisticated malware and tools. NOBELIUM uses FoggyWeb to remotely exfiltrate the configuration database of compromised AD FS servers, decrypted token-signing certificate, and token-decryption certificate, as well as to download and execute additional components.” 

“Use of FoggyWeb has been observed in the wild as early as April 2021.” 

The hackers load FoggyWeb from the encrypted file Windows.Data.TimeZones.zh-PH.pri using the version.dll DLL. The version.dll is loaded by the AD FS service executable 'Microsoft.IdentityServer.ServiceHost.exe' via the DLL search order hijacking approach, which involves the core Common Language Runtime (CLR) DLL files. 

To decrypt the backdoor directly in memory, the loader employs a proprietary Lightweight Encryption Algorithm (LEA) function. The backdoor sets up HTTP listeners for actor-defined URIs in order to intercept GET/POST requests to the AD FS server that match the custom URI patterns. 

Microsoft researchers offered the following advice to companies that have been affected or are suspected of being under attack by the group: 
  • Examine your on-premises and cloud infrastructure, including configuration, per-user and per-app settings, forwarding rules, and any other modifications made by the actor to retain their access. 
  • Remove user and app access, evaluate each's settings, and re-issue fresh, strong credentials in accordance with established industry best practices. 
  • To prevent the exfiltration of secrets via FoggyWeb, use a hardware security module (HSM), as explained in Securing AD FS servers. 
The NOBELIUM APT is the threat actor behind the SolarWinds supply chain assault, which included various implant families such as the SUNBURST backdoor, TEARDROP malware, GoldMax malware, Sibot, and GoldFinder backdoors. 

NOBELIUM focuses on government agencies, non-governmental organizations (NGOs), think tanks, military, information technology service providers, health technologies and research, and telecommunications providers.
Read more »
Subscribe to: Posts (Atom)