 |
Announcing the release of cloud-powered security for IoT/OT environments.
Defender for IoT team announced the general availability (GA) of its cloud-powered security, which enables businesses to interconnect their OT environment without compromising security while addressing the special needs of mission-critical OT environments and cyber-physical systems.
Powered by Microsoft’s scalable, cost-effective Azure cloud, Defender for IoT helps enterprises manage assets, track emerging threats, and control risks across enterprise and mission-critical networks—both in connected and air-gapped environments. Moreover, Defender for IoT is perfectly suited to the needs of bandwidth constrained, classic production networks in remote locations, making it easy for enterprises to deploy, manage, and monitor even the most resource-limited environments.
|
| Microsoft 365 Defender Threat Analytics Reports (access to the Microsoft 365 Defender portal needed) |
| |
Activity profile: 2022 DDoS attack trends. As organizations strengthen their defenses and take a more proactive approach to protection, attackers are adapting their techniques and increasing the sophistication of their operations.
|
| |
DEV-0450 and DEV-0464: Distributing Qakbot for ransomware deployment. Microsoft tracks DEV-0450 and DEV-0464 as Qakbot distributors that result in observed ransomware attacks. Qakbot is delivered using email, often downloaded by malicious macros in a Microsoft 365 document. |
| |
Actor profile: DEV-1010. The actor Microsoft tracks as DEV-1010 is a cybercriminal group based out of Russia and Belarus. Microsoft identified the group conducting a phishing campaign in late October 2022 involving downloads of malicious Microsoft software installer (MSI) files, interpreters, downloader scripts, a remote access tool named rutserv.exe, and a PowerShell dropper containing a reflectively loaded Cobalt Strike beacon. |
| |
PlugX malware leveraging OEM extended ASCII characters to evade detection. Microsoft 365 Defender detects ImageLoad events where an image is loaded from a directory path that begins with the non-breaking space (NBSP) character “0xA0”. The use of NBSP is a novel technique employed by PlugX malware to hide its presence on an infected removable media. |
| |
Activity profile: Identity focus on Qakbot attacks. For many distributors of initial access malware like Qakbot, getting the first-stage payload onto a device is often just the first step in what ends up being a larger attack, including the delivery of additional malware payloads or selling access to other threat actors with their own objectives. As a result, Qakbot infections might vary in terms of objectives. |
| |
Activity profile: Remcos payload delivery through tax document lures. Since February 20, 2022, Microsoft has observed phishing attacks targeting accounting and tax return preparation firms to deliver the Remcos remote access trojan (RAT) and compromise targeted networks. The campaign uses lures masquerading as tax documentation sent by a client, while the link in the email uses a legitimate click tracking service to evade detection. |
| |
Threat Insights: Exchange vulnerability CVE-2023-21707. On March 14, 2023, Microsoft re-released patches for CVE-2023-21707, a remote code execution vulnerability in Exchange, to address stability issues experienced by a small subset of customers. Although this vulnerability has not been observed exploited in the wild, customers are urged to re-apply the patches as soon as possible for their organization’s security. |
| |
Tool profile: Caffeine phishing as a service platform. The Caffeine phishing as a service (PhaaS) platform provides ready-to-use phishing emails, website templates, how-to documentation, phishing infrastructure (domains and IP addresses), and user support systems to its customers, lowering the barrier to entry for less skilled phishing actors. |
| |
Activity profile: Emotet uses new defense evasion technique, March 2023. Emotet email activity resumed on March 7, 2023, following a period of inactivity in late 2022. This threat, which has frequently paused operations before resuming, is developed and deployed by an activity group Microsoft tracks as DEV-0201. |
| |
CVE-2023-23397: Microsoft Outlook elevation of privilege vulnerability leads to NTLM credential thef.... Microsoft Threat Intelligence discovered limited, targeted abuse of a zero-day in Microsoft Outlook that allows for NT LAN Manager (NTLM) credential theft being used by a likely Russian state-sponsored actor tracked by Microsoft as STRONTIUM. |
| |
Activity profile: PHOSPHORUS exploits Aspera Faspex vulnerability (CVE-2022-47986). Since early February 2023, the actor Microsoft tracks as PHOSPHORUS has been observed exploiting CVE-2022-47986, a pre-authentication remote code execution vulnerability in Aspera Faspex, a file transfer application commonly used with Ruby on Rails. |
| |
Actor profile: DEV-0506. The actor Microsoft tracks as DEV-0506 is a cybercriminal group known to deploy Black Basta ransomware. |
| |
Tool profile: WinDealer. WinDealer is a modular backdoor that can perform file actions, execute arbitrary commands, and conduct discovery. Since 2020, WinDealer infections occur via the automatic update feature of benign applications popular in China. |
| |
Tool profile: Information stealers. Information stealers (infostealers) are malicious software designed to steal data stored in browsers. Information stealers steal data like session tokens and cookies—which can include multifactor authentication (MFA) claims—saved passwords and input form data, credit card information, user files, cryptocurrency wallets, and credentials for internet-facing systems and applications, including virtual private network (VPN), remote desktop protocol (RDP), virtual desktop infrastructure (VDI) including Citrix, or identity providers (including Azure Active Directory, Okta). In some instances, infostealers can also load other malware to the affected environment. |
| |
Activity profile: DEV-0501 shifts to BlackCat ransomware after Hive shut-down. DEV-0501 is a ransomware threat group that has switched ransomware payloads multiple times since 2021. Following the law enforcement shutdown of the Hive ransomware-as-a-service (RaaS) program in January 2023, DEV-0501 began to deploy BlackCat in February 2023. |
| |
Activity profile: 3CXDesktopApp possible supply chain compromise. Microsoft is aware of third-party reports of hands-on-keyboard compromises originating from 3CXDesktopApp installs. |
|
| Blogs on Microsoft Security |
|
|
|
