arstechnica.com Open in urlscan Pro
3.136.4.82  Public Scan

Form analysis
1 forms found in the DOM

GET /search/

<form action="/search/" method="GET" id="search_form">
  <input type="hidden" name="ie" value="UTF-8">
  <input type="text" name="q" id="hdr_search_input" value="" aria-label="Search..." placeholder="Search...">
</form>

Text Content

Skip to main content
 * Biz & IT
 * Tech
 * Science
 * Policy
 * Cars
 * Gaming & Culture
 * Store
 * Forums

Subscribe

Close


NAVIGATE

 * Store
 * Subscribe
 * Videos
 * Features
 * Reviews

 * RSS Feeds
 * Mobile Site

 * About Ars
 * Staff Directory
 * Contact Us

 * Advertise with Ars
 * Reprints


FILTER BY TOPIC

 * Biz & IT
 * Tech
 * Science
 * Policy
 * Cars
 * Gaming & Culture
 * Store
 * Forums


SETTINGS

Front page layout


Grid


List


Site theme

light

dark

Sign in

PSA: CHECK YOUR INSTANCE FOR COMPROMISE —


ONGOING CAMPAIGN COMPROMISES SENIOR EXECS’ AZURE ACCOUNTS, LOCKS THEM USING MFA


THE WIDE RANGE OF EMPLOYEE ROLES TARGETED INDICATES ATTACKER'S MULTIFACETED
APPROACH.

Dan Goodin - 2/13/2024, 12:41 AM

Enlarge
Getty Images

READER COMMENTS

32

Hundreds of Microsoft Azure accounts, some belonging to senior executives, are
being targeted by unknown attackers in an ongoing campaign that's aiming to
steal sensitive data and financial assets from dozens of organizations,
researchers with security firm Proofpoint said Monday.

The campaign attempts to compromise targeted Azure environments by sending
account owners emails that integrate techniques for credential phishing and
account takeovers. The threat actors are doing so by combining individualized
phishing lures with shared documents. Some of the documents embed links that,
when clicked, redirect users to a phishing webpage. The wide breadth of roles
targeted indicates the threat actors’ strategy of compromising accounts with
access to various resources and responsibilities across affected organizations.

“Threat actors seemingly direct their focus toward a wide range of individuals
holding diverse titles across different organizations, impacting hundreds of
users globally,” a Proofpoint advisory stated. “The affected user base
encompasses a wide spectrum of positions, with frequent targets including Sales
Directors, Account Managers, and Finance Managers. Individuals holding executive
positions such as “Vice President, Operations,” "Chief Financial Officer &
Treasurer," and "President & CEO" were also among those targeted.”

Once accounts are compromised, the threat actors secure them by enrolling them
in various forms of multifactor authentication. This can make it harder for
victims to change passwords or access dashboards to examine recent logins. In
some cases, the MFA used relies on one-time passwords sent by text messages or
phone calls. In most instances, however, the attackers employ an authenticator
app with notifications and code.

Enlarge / Examples of MFA manipulation events, executed by attackers in a
compromised cloud tenant.
Proofpoint

Proofpoint observed other post-compromise actions including:

 * Data exfiltration. Attackers access and download sensitive files, including
   financial assets, internal security protocols, and user credentials.
 * Internal and external phishing. Mailbox access is leveraged to conduct
   lateral movement within impacted organizations and to target specific user
   accounts with personalized phishing threats.
 * Financial fraud. In an effort to perpetrate financial fraud, internal email
   messages are dispatched to target Human Resources and Financial departments
   within affected organizations.
 * Mailbox rules. Attackers create dedicated obfuscation rules intended to cover
   their tracks and erase all evidence of malicious activity from victims’
   mailboxes.

Advertisement

Enlarge / Examples of obfuscation mailbox rules created by attackers following
successful account takeover.
Proofpoint

The compromises are coming from several proxies that act as intermediaries
between the attackers’ originating infrastructure and the accounts being
targeted. The proxies help the attackers align the geographical location
assigned to the connecting IP address with the region of the target. This helps
to bypass various geofencing policies that restrict the number and location of
IP addresses that can access the targeted system. The proxy services often
change mid-campaign, a strategy that makes it harder for those defending against
the attacks to block the IPs where the malicious activities originate.

Other techniques designed to obfuscate the attackers' operational infrastructure
include data hosting services and compromised domains.

“Beyond the use of proxy services, we have seen attackers utilize certain local
fixed-line ISPs, potentially exposing their geographical locations,” Monday’s
post stated. “Notable among these non-proxy sources are the Russia-based 'Selena
Telecom LLC', and Nigerian providers 'Airtel Networks Limited' and 'MTN Nigeria
Communication Limited.' While Proofpoint has not currently attributed this
campaign to any known threat actor, there is a possibility that Russian and
Nigerian attackers may be involved, drawing parallels to previous cloud
attacks.”


HOW TO CHECK IF YOU’RE A TARGET

There are several telltale signs of targeting. The most helpful one is a
specific user agent used during the access phase of the attack: Mozilla/5.0
(X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0
Safari/537.36

Attackers predominantly utilize this user-agent to access the 'OfficeHome'
sign-in application along with unauthorized access to additional native
Microsoft365 apps, such as:

 * Office365 Shell WCSS-Client (indicative of browser access to Office365
   applications)
 * Office 365 Exchange Online (indicative of post-compromise mailbox abuse, data
   exfiltration, and email threats proliferation)
 * My Signins (used by attackers for MFA manipulation)
 * My Apps
 * My Profile

Proofpoint included the following Indicators of compromise:

Indicator  Type  Description  Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 User Agent User Agent
involved in attack’s access phase Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 User Agent
User Agent involved in attack’s access and post-access phases Mozilla/5.0
(Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/119.0.0.0 Safari/537.36 User Agent User Agent involved in attack’s access
and post-access phases sachacel[.]ru Domain Domain used for targeted phishing
threats lobnya[.]com Domain Source domain used as malicious infrastructure
makeapp[.]today Domain Source domain used as malicious infrastructure
alexhost[.]com Domain Source domain used as malicious infrastructure mol[.]ru
Domain Source domain used as malicious infrastructure smartape[.]net Domain
Source domain used as malicious infrastructure airtel[.]com Domain Source domain
used as malicious infrastructure mtnonline[.]com Domain Source domain used as
malicious infrastructure acedatacenter[.]com Domain Source domain used as
malicious infrastructure Sokolov Dmitry Nikolaevich ISP Source ISP used as
malicious infrastructure Dom Tehniki Ltd ISP Source ISP used as malicious
infrastructure Selena Telecom LLC ISP Source ISP used as malicious
infrastructure

As the campaign is ongoing, Proofpoint may update the indicators as more become
available. The company advised companies to pay close attention to the user
agent and source domains of incoming connections to employee accounts. Other
helpful defenses are employing security defenses that look for signs of both
initial account compromise and post-compromise activities, identifying initial
vectors of compromise such as phishing, malware, or impersonation, and putting
in place auto-remediation policies to drive out attackers quickly in the event
they get in.



READER COMMENTS

32
Dan Goodin Dan Goodin is Senior Security Editor at Ars Technica, where he
oversees coverage of malware, computer espionage, botnets, hardware hacking,
encryption, and passwords. In his spare time, he enjoys gardening, cooking, and
following the independent music scene.

Advertisement




CHANNEL ARS TECHNICA

UNSOLVED MYSTERIES OF QUANTUM LEAP WITH DONALD P. BELLISARIO

Today "Quantum Leap" series creator Donald P. Bellisario joins Ars Technica to
answer once and for all the lingering questions we have about his enduringly
popular show. Was Dr. Sam Beckett really leaping between all those time periods
and people or did he simply imagine it all? What do people in the waiting room
do while Sam is in their bodies? What happens to Sam's loyal ally Al? 30 years
following the series finale, answers to these mysteries and more await.

 * UNSOLVED MYSTERIES OF QUANTUM LEAP WITH DONALD P. BELLISARIO

 * UNSOLVED MYSTERIES OF WARHAMMER 40K WITH AUTHOR DAN ABNETT

 * SITREP: F-16 REPLACEMENT SEARCH A SIGNAL OF F-35 FAIL?

 * SITREP: BOEING 707

 * STEVE BURKE OF GAMERSNEXUS REACTS TO THEIR TOP 1000 COMMENTS ON YOUTUBE

 * MODERN VINTAGE GAMER REACTS TO HIS TOP 1000 COMMENTS ON YOUTUBE

 * HOW THE NES CONQUERED A SKEPTICAL AMERICA IN 1985

 * SCOTT MANLEY REACTS TO HIS TOP 1000 YOUTUBE COMMENTS

 * HOW HORROR WORKS IN AMNESIA: REBIRTH, SOMA AND AMNESIA: THE DARK DESCENT

 * LGR'S CLINT BASINGER REACTS TO HIS TOP 1000 YOUTUBE COMMENTS

 * THE F-35'S NEXT TECH UPGRADE

 * HOW ONE GAMEPLAY DECISION CHANGED DIABLO FOREVER

 * UNSOLVED MORTAL KOMBAT MYSTERIES WITH DOMINIC CIANCIOLO FROM NETHERREALM
   STUDIOS

 * US NAVY GETS AN ITALIAN ACCENT

 * HOW AMAZON’S “UNDONE” ANIMATES DREAMS WITH ROTOSCOPING AND OIL PAINTS

 * FIGHTER PILOT BREAKS DOWN EVERY BUTTON IN AN F-15 COCKPIT

 * HOW NBA JAM BECAME A BILLION-DOLLAR SLAM DUNK

 * LINUS "TECH TIPS" SEBASTIAN REACTS TO HIS TOP 1000 YOUTUBE COMMENTS

 * HOW ALAN WAKE WAS REBUILT 3 YEARS INTO DEVELOPMENT

 * HOW PRINCE OF PERSIA DEFEATED APPLE II'S MEMORY LIMITATIONS

 * HOW CRASH BANDICOOT HACKED THE ORIGINAL PLAYSTATION

 * MYST: THE CHALLENGES OF CD-ROM | WAR STORIES

 * MARKIPLIER REACTS TO HIS TOP 1000 YOUTUBE COMMENTS

 * HOW MIND CONTROL SAVED ODDWORLD: ABE'S ODDYSEE

 * BIOWARE ANSWERS UNSOLVED MYSTERIES OF THE MASS EFFECT UNIVERSE

 * CIVILIZATION: IT'S GOOD TO TAKE TURNS | WAR STORIES

 * SITREP: DOD RESETS BALLISTIC MISSILE INTERCEPTOR PROGRAM

 * WARFRAME'S REBECCA FORD REVIEWS YOUR CHARACTERS

 * SUBNAUTICA: A WORLD WITHOUT GUNS | WAR STORIES

 * HOW SLAY THE SPIRE’S ORIGINAL INTERFACE ALMOST KILLED THE GAME | WAR STORIES

 * AMNESIA: THE DARK DESCENT - THE HORROR FACADE | WAR STORIES

 * COMMAND & CONQUER: TIBERIAN SUN | WAR STORIES

 * BLADE RUNNER: SKINJOBS, VOXELS, AND FUTURE NOIR | WAR STORIES

 * DEAD SPACE: THE DRAG TENTACLE | WAR STORIES

 * TEACH THE CONTROVERSY: FLAT EARTHERS

 * DELTA V: THE BURGEONING WORLD OF SMALL ROCKETS, PAUL ALLEN'S HUGE PLANE, AND
   SPACEX GETS A CRUCIAL GREEN-LIGHT

 * CHRIS HADFIELD EXPLAINS HIS 'SPACE ODDITY' VIDEO

 * THE GREATEST LEAP, EPISODE 1: RISK

 * ULTIMA ONLINE: THE VIRTUAL ECOLOGY | WAR STORIES

More videos
← Previous story Next story →


RELATED STORIES

by Taboolaby Taboola
Sponsored LinksSponsored Links

Bad vervangen voor een veilige inloopdouche?Vergelijk Portaal
Ontvang bod


Undo

Hero Wars: Speel vandaag nog in je browser!Hero Wars
Nu afspelen


Undo

Rotterdam: Discover Whisky Barrel InvestmentWhisky Partners
Learn More


Undo

Beleef een ideale vakantie op Center Parcs Het HeijderbosCenter Parcs
Meer informatie


Undo

Nieuwe draagbare trapliften voor ouderen vereisen geen installatie.Mobiele
Traplift


Undo

Hoofd Chirurgie: "Kalkoenhals? U kunt verslapte huid thuis
verstevigen."goldentree.nl


Undo




TODAY ON ARS

 * Store
 * Subscribe
 * About Us
 * RSS Feeds
 * View Mobile Site

 * Contact Us
 * Staff
 * Advertise with us
 * Reprints


NEWSLETTER SIGNUP

Join the Ars Orbital Transmission mailing list to get weekly updates delivered
to your inbox. Sign me up →



CNMN Collection
WIRED Media Group
© 2024 Condé Nast. All rights reserved. Use of and/or registration on any
portion of this site constitutes acceptance of our User Agreement (updated
1/1/20) and Privacy Policy and Cookie Statement (updated 1/1/20) and Ars
Technica Addendum (effective 8/21/2018). Ars may earn compensation on sales from
links on this site. Read our affiliate link policy.
Your California Privacy Rights | Manage Preferences
The material on this site may not be reproduced, distributed, transmitted,
cached or otherwise used, except with the prior written permission of Condé
Nast.
Ad Choices





WE CARE ABOUT YOUR PRIVACY

We and our 166 partners store and/or access information on a device, such as
unique IDs in cookies to process personal data. You may accept or manage your
choices by clicking below or at any time in the privacy policy page. These
choices will be signaled to our partners and will not affect browsing data.More
information about your privacy


WE AND OUR PARTNERS PROCESS DATA TO PROVIDE:

Use precise geolocation data. Actively scan device characteristics for
identification. Store and/or access information on a device. Personalised
advertising and content, advertising and content measurement, audience research
and services development. List of Partners (vendors)

I Accept
Show Purposes