Cloud Security
,
Security Operations
Financially Motivated Actor Storm-0501 Systematically Probed Victim Environments
As enterprises go with hybrid cloud developments, so follow hackers, even if it means jumping through extra hoops to get to where the data is stored.
See Also: Surge in Identities Drives Need for Dynamic Security
Microsoft on Wednesday said it spotted a financially-motivated hacking group it tracks as Storm-0501 systematically probing a hybrid on-premise Active Directory and Azure Cloud Entra ID until they were able to access an Azure portal with a global admin account. Organizations may prefer hybrid cloud deployments especially when they have legacy applications that resist easy porting to the cloud.
Hackers at one point were stymied when they attempted to sign into the Entra ID environment with an admin user account that had multifactor authentication activated. Their luck continued when they found an Active Directory non-human identity synched with an account that had global admin privileges.
That was their gateway to a local device joined with Azure – which hackers exfiltrated and mass-deleted data, later contacting the unidentified victim with an extortion demand.
Active since 2021, Storm-0501 targets victims opportunistically. It’s deploys multiple ransomware strains including Sabbath and Embargo but now prefers using cloud-native tools to steal data and destroy backups without the additional step of deploying malware.
The attackers began with an on-premises compromise that gave them domain administrator privileges. Hackers had help from the victim network layout, since the victim – a large company with multiple subsidiaries – maintained multiple Active Directory domains and separate Azure tenants. “This fragmented deployment created visibility gaps across the environment,” Microsoft wrote. Hackers also looked for endpoints, not monitored by Microsoft Defender, “suggesting a deliberate effort to avoid detection by targeting non-onboarded system.”
They used a technique to simulate the behavior of a domain controller and obtain password hashes, even for privileged accounts, and deployed AzureHound to map out the users and roles within the Azure tenant. That’s when they made their first attempt to sign in as a privileged user, but ran into the roadblock of condition access and multifactor access policies.
Additional reconnaissance pinpointed the non-human synced identity. They used it to reset the password of the global admin account it was connected to – and the account itself wasn’t protected by multifactor authentication, at least not until the hackers themselves registered a MFA method under their control
After obtaining access, the hackers reverted to traditional attacker behavior. They created a backdoor and used their global admin privileges to register a malicious Entra ID tenant as a trusted federated domain by the targeted tenant.
Microsoft said it has implemented a change in Entra ID policy that will make it harder for attackers to use AzureHound to discover Azure users, roles and resources. It also suggested users use a Trusted Platform Module on Entra Connect Sync servers to store sensitive credentials in order resist credential extraction methods.