{"id":42473,"date":"2021-09-29T12:51:37","date_gmt":"2021-09-29T12:51:37","guid":{"rendered":"http:\/\/icloud.pe\/blog\/?guid=b73ba2a921cae6c2045ea0291a9f7708"},"modified":"2021-09-29T12:51:37","modified_gmt":"2021-09-29T12:51:37","slug":"solarwinds-hackers-are-targeting-microsoft-ad-servers","status":"publish","type":"post","link":"https:\/\/icloud.pe\/blog\/solarwinds-hackers-are-targeting-microsoft-ad-servers\/","title":{"rendered":"SolarWinds hackers are targeting Microsoft AD servers"},"content":{"rendered":"


\n Sabina Weston<\/a><\/span>
\n <\/span><\/p>\n

\n
\n
29 Sep, 2021<\/span><\/div>\n<\/p><\/div>\n<\/div>\n

\n<\/a><\/p>\n

\n

Nobelium, the\u00a0hacking<\/a>\u00a0group responsible for last year\u2019s\u00a0cyber attack on SolarWinds<\/a>, is now stealing data from Active Directory Federation Services (AD FS) servers.<\/p>\n

That’s according to\u00a0Microsoft<\/a>\u2019s Threat Intelligence Center (MSTIC), which has issued a\u00a0warning<\/a>\u00a0about Nobelium\u2019s latest actions on its blog.<\/p>\n

<\/p>\n

\nThe\u00a0Russian state-backed<\/a>\u00a0hacking group was found to be using a post-exploitation backdoor dubbed FoggyWeb in order to remotely exfiltrate sensitive data as well as maintain persistence on victims\u2019 networks, warned MSTIC researcher Ramin Nafisi.<\/p>\n

In order to steal the data, Nobelium hackers first gain admin privileges to AD FS servers by employing \u201cmultiple tactics to pursue credential theft\u201d. Once they manage to compromise the server, they then deploy FoggyWeb \u201cto remotely exfiltrate the configuration database of compromised AD FS servers, decrypted token-signing certificates and token-decryption certificates\u201d, wrote Nafisi.<\/p>\n

The \u201cpassive and highly targeted\u201d FoggyWeb backdoor \u201chas been observed in the wild as early as April 2021\u201d, he added.<\/p>\n

Microsoft stated that it had notified all customers believed to be targeted by Nobelium. However, it didn\u2019t rule out that some organisations might still be at risk. It recommends\u00a0that potential victims audit their on-premises and cloud infrastructure, \u201cremove user and app access\u201d, strengthen their\u00a0passwords<\/a>, as well as \u201cuse a hardware security module (HSM) in securing AD FS servers to prevent the exfiltration of secrets by FoggyWeb\u201d.<\/p>\n

The tech giant also advised organisations to \u201charden and secure AD FS deployments\u201d by taking additional measures, including limiting on-network access via host firewall and requiring all\u00a0cloud<\/a>\u00a0admins to use\u00a0multi-factor authentication<\/a>.<\/p>\n

The warning comes\u00a0three months<\/a>\u00a0after Nobelium was found to have engaged in \u201cpassword spray<\/a>\u00a0and brute-force attacks\u201d on Microsoft\u2019s customers, with around 10% of the targets being based in the UK.<\/p>\n

The hackers implanted \u201cinformation-stealing\u00a0malware<\/a>\u201d on a device belonging to a Microsoft customer support agent, through which they obtained \u201cbasic account information for a small number of [Microsoft\u2019s] customers\u201d, according to the tech giant.<\/p>\n

Prior to this, Nobelium\u00a0launched a wave of attacks<\/a>\u00a0on more than 150 government agencies, think tanks, consultants, and NGOs from 24 countries, targeting an estimated 3,000 email accounts. <\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

Sabina Weston<\/p>\n

29 Sep, 2021 <\/p>\n

Nobelium, the\u00a0hacking\u00a0group responsible for last year\u2019s\u00a0cyber attack on SolarWinds, is now stealing data from Active Directory Federation Services (AD FS) servers.
\nThat’s according to\u00a0Microsoft…<\/p>\n","protected":false},"author":627,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-42473","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts\/42473","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/users\/627"}],"replies":[{"embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/comments?post=42473"}],"version-history":[{"count":1,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts\/42473\/revisions"}],"predecessor-version":[{"id":42474,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts\/42473\/revisions\/42474"}],"wp:attachment":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/media?parent=42473"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/categories?post=42473"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/tags?post=42473"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}