Members of the Five Eyes (FVEY) intelligence alliance warned today that APT29 Russian Foreign Intelligence Service (SVR) hackers are now switching to attacks targeting their victims’ cloud services.
APT29 (also tracked as Cozy Bear, Midnight Blizzard, The Dukes) breached multiple U.S. federal agencies following the SolarWinds supply-chain attack they orchestrated more than three years ago.
The Russian cyberspies also compromised Microsoft 365 accounts belonging to various entities within NATO nations to obtain foreign policy-related data and targeted governments, embassies, and senior officials throughout Europe associated in a string of phishing attacks.
More recently, Microsoft confirmed in January that the Russian Foreign Intelligence Service hacking group breached the Exchange Online accounts of its executives and users from other organizations in November 2023.
Cloud services under attack
Today, a joint advisory issued by the U.K.’s National Cyber Security Centre (NCSC), the NSA, CISA, the FBI, and cybersecurity agencies from Australia, Canada, and New Zealand warned that the Russian threat group is gradually moving to attacks against cloud infrastructure.
“As organizations continue to modernize their systems and move to cloud-based infrastructure, the SVR has adapted to these changes in the operating environment,” the advisory reads.
“They have to move beyond their traditional means of initial access, such as exploiting software vulnerabilities in an on-premises network, and instead target the cloud services themselves.”
As the Five Eyes agencies found, APT29 hackers are now gaining access to their targets’ cloud environments using access service account credentials compromised in brute forcing or password spraying attacks.
Additionally, they’re using dormant accounts that have never been removed after users left the targeted organizations, also enabling them to regain access after systemwide password resets.
APT29’s initial cloud breach vectors also include the use of stolen access tokens that enable them to hijack accounts without using credentials, compromised residential routers to proxy their malicious activity, MFA fatigue to bypass multi-factor authentication (MFA), and registering their own devices as new devices on the victims’ cloud tenants
After gaining initial access, SVR hackers use sophisticated tools like the MagicWeb malware (which allows them to authenticate as any user within a compromised network) to evade detection in…
Click Here to Read the Full Original Article at BleepingComputer…