Microsoft Threat Intelligence

Attacks against OT systems that control critical processes across different sectors target internet-exposed devices with poor security posture, weak passwords, and known vulnerabilities. In this blog, Microsoft researchers analyze an attack methodology used by threat actors in a high-profile OT attack and share details on how such methodology could be used by attackers in multiple other attacks. Learn how to improve the security posture of OT devices: https://msft.it/6046YioeK

Organizations must prioritize comprehensive backup and restore strategies within their Active Directory Certificate Services (ADCS) infrastructure to ensure swift recovery and restoration of essential certificate services following a cyberattack or data breach. This strategy is part of an "assume breach" approach that Microsoft advocates platform owners to adopt as a proactive measure for ensuring and preserving confidentiality, integrity, and availability of identity and access management (IAM) based services. Microsoft Incident Response (Microsoft IR) provides guidance for organizations to set up ADCS backups and recover an ADCS platform from compromise: https://msft.it/6045Y9ob9

I spoke at #BluehatIndia on Defending with the Graph of Graphs. 📊Slides: https://lnkd.in/gwQYQ2gQ • I talked about how offense and defense have different worldviews but that the methods of attack and defense can be modeled using graphs. My thesis is that the attack graph is the unifying paradigm between attack and defense. • To build a graph you need three things: o   Assets o   Activity o   Attack Paths • You don't have to start from scratch. There is a ton of prior art in opensource projects and commercial products that incorporate graphs and attack paths • To operationalize the graph, because of the breadth of data one needs, you're actually building a graph of graphs. • I used April C. Wright and @proxyblue's infosec color wheel model to show how every discipline of infosec and engineering has something to contribute to the graph. For example, green team work on how to identify unwanted graph traversals and eliminate their risk • I concluded with opportunities in generative AI. For infosec to fully benefit from large language models we must expose to them the structure of infosec data, which is heavily relational even though analysts often work with it in rowset form. • I am heavily indebted to the amazing researchers who have worked for years to democratize graph concepts in their work. Andy Robbins, @harmj0y, @CptJesus, Bernardo Quintero, @invisig0th, @Graphistry, Ami Luttwak, Vincent Y., Leo Meyerovich , Lyft cartography, Stormspotter, duo-labs cloudmapper, Netflix security monkey, @41thexplorer, @shirtamari, Alice Zheng, John Dunagan, Daniel Simon, Lucas Bouillot, Emmanuel Gras, and many Microsoft researchers working for years on attack paths and attack graphs. Sorry to all the researchers I did not mention🙏💪🕸️

Microsoft has identified a new North Korean threat actor, now tracked as Moonstone Sleet (formerly Storm-1789), that combines many tried-and-true techniques used by other North Korean threat actors with unique attack methodologies to target organizations for its financial and cyberespionage objectives. Moonstone Sleet is observed to set up fake companies and job opportunities to engage with potential targets, employ trojanized versions of legitimate tools, create a malicious game called DeTankWar, and deliver a new custom ransomware that Microsoft has named FakePenny. Read our latest blog to get our analysis of several notable TTPs used by Moonstone Sleet in various campaigns and to get recommendations for defending against this threat actor: https://msft.it/6042Ygs3o

The financially motivated threat actor that Microsoft tracks as Storm-0539 pursues financial gain via payment card theft and gift card fraud. They gain access to target organizations to enumerate resources and target employees with access to gift cards or have permissions to issue them. In a single instance, Storm-0539 can extract tens of thousands of dollars by issuing new gift cards and sending them to dozens of email addresses. Today at #SLEUTHCON 2024, Microsoft Threat Intelligence experts delivered a talk on Storm-0539. Also known as Atlas Lion and active since late 2021, Storm-0539 operates out of Morocco and primarily targets the retail sector but have also affected other industries like telecommunication and technology. Storm-0539 carries out extensive reconnaissance of target organizations to craft convincing phishing lures and steal credentials and tokens for initial access. They make their social engineering operations particularly persuasive by using compromised legitimate emails, or by mimicking legitimate platforms used by target organizations. The actors register attacker-controlled devices for secondary authentication prompts and use compromised identities to phish more users in an affected organization. They also leverage their access to phish additional target organizations. Notably, the threat actor is well-versed in cloud technologies and leverages resources from target organizations’ cloud services for post-compromise activities. In addition to gift card fraud, Storm-0539 gathers significant information with each compromise, including legitimate emails, contact lists, and network configurations, and uses that information for future operations against the same organization. Storm-0539 has been observed to target the same organizations for multiple years, with notable surges in activity during holiday seasons. Storm-0539 demonstrates that payment-card focused attacks are a significant and evolving threat that organizations, especially retail, need to defend against. Security best practices like using multifactor authentication (MFA), disabling legacy authentication, following the principles of least privilege, and deploying identity protection solutions can help slow down actors like Storm-0539. Microsoft customers can use the threat intelligence reports in Microsoft Defender to get the latest information and protection and investigation guidance related to Storm-0539. Organizations can also refer to the FBI’s private industry notification on gift card fraud and Storm-0539. Learn more: https://msft.it/6042Yd1us

🥁 Join us LIVE on Friday 5/24 at 5:30 pm ET for #SLEUTHCON After Dark, hosted by Sherrod DeGrippo & sponsored by Microsoft Security! 🌎 Team APT (left): - Judy Ng, Team Captain - Greg Lesnewich - John Hultquist - Steve Stone - visi stark 💰Team Cybercrime (right): - Christopher Glyer, Team Captain - Selena Larson - Waymon H. - Lauren P. - Andrew Morris Register at https://www.sleuthcon.com!

“Conversations about ransomware should be conversations about back-ups and disaster recovery.” We can expect ransomware attacks in the next one to three years to be more of the same, with attackers continuing to bank on tried-and-tested techniques. Attackers will continue to launch double or triple extortion schemes to pressure organizations and target embedded systems within networks. In this episode of The Microsoft Threat Intelligence podcast, Andrew Morris, Founder & Chief Architect at GreyNoise and Lauren P., Director of Global Cyber Defense at Marsh McLennan discuss with Sherrod DeGrippo the importance of focusing on backup and disaster recovery strategies and the necessity of investing in basic security measures like endpoint detection and response, multi-factor authentication, and log storage to deal with prevalent threats such as ransomware. Learn more here: https://msft.it/6041YjMjT

Alongside the announcement of Copilot+ PCs, Microsoft is introducing important security features and updates that make Windows 11 more secure for users and organizations and give developers the tools to prioritize security: https://msft.it/6040YZvHO

The Microsoft Threat Intelligence Podcast, hosted by Sherrod DeGrippo is recording live during SLEUTHCON After Dark, a special networking reception at SLEUTHCON 2024. This event will bring together industry experts to discuss the cybersecurity landscape and culminate with a “debate” featuring Microsoft experts Judy N. and Christopher Glyer. Register for #SLEUTHCON 2024, happening on May 24, 2024, here: https://msft.it/6044Ykr5k