InfoSecBulletin Cybersecurity for mankind
Microsoft cybersecurity researchers found that the “Storm-0501” ransomware group is targeting hybrid cloud environments.
Storm-0501 Attacking Cloud Environments:
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
Storm-0501 is a ‘financially motivated’ threat group that has launched a sophisticated ‘multi-stage attack’ targeting “hybrid cloud environments” across various ‘U.S. sectors’ and ‘critical infrastructure.’
The group exploited vulnerabilities in Zoho ManageEngine, Citrix NetScaler, and ColdFusion 2016 to access on-premises systems.
Then for lateral movement and credential access, they used tools such as “Impacket’s SecretsDump” and “Cobalt Strike.”
The attackers pivoted from “on-premises” to “cloud environments” by compromising “Microsoft Entra Connect Sync” accounts, which allows them to manipulate the “Microsoft Entra ID” (formerly Azure AD) identities.
They used ‘Rclone’ disguised as ‘Windows binaries’ to exfiltrate data and deployed various ransomware types, including “Hive,” “BlackCat,” and “LockBit.”
The actions of Storm-0501 emphasize the increasing security risks in hybrid cloud environments, showing the need for strong protections in both on-premises and cloud systems.
This group targets “accounts with disabled MFA and Global Administrator roles.”
The attackers use various techniques to create persistent backdoors and here below:
Password synchronization exploitation
Cloud session hijacking
Leveraging the AADInternals PowerShell module
They can change managed domains to federated ones, alter SAML tokens, and skip MFA.
In some cases, the threat actors deploy “Embargo ransomware,” it’s a Rust-based strain that makes use of advanced encryption and it’s distributed via Group “Policy Objects (GPOs)” and “scheduled tasks.”
The ransomware encrypts files, changes the extensions to “.partial,” “.564ba1,” or “.embargo,” and employs double extortion tactics.
Mitigations:
Here below we have mentioned all the mitigations:-
Use the least privilege and audit privileged accounts.
Enable Conditional Access for device compliance and trusted IPs.
Restrict Entra ID sync accounts from untrusted IPs.
Use phishing-resistant authentication for critical apps.
Follow best practices for Active Directory Federation Services.
Refer to Azure AD security best practices.
Turn on Defender for Cloud Apps alerts.
Prevent bypassing Entra MFA when federated.
Block sign-ins to non-federated domains.
Enable Entra ID protection for risky sign-ins.
Use tamper protection to secure services.
Block unapproved IT tools with AppLocker.
Run EDR in block mode for extra protection.
Enable automated investigation in Defender.
Octo2: European Banks Already Under Attack by New Malware varient
