Saturday, December 2, 2023

Golden SAML Attack – APT Hackers Hijacking & Gaining Access To The Active Directory Server

Recently, it has been reported that an APT group has attacked the client’s Office 365 environment, also they have discovered a way to bypass authentication controls so that they can fully access the environment of the directory server.

According to the investigation, the experts claimed that most of the clients either have a hybrid authentication model set-up or are completely in the cloud. 

However, compromising the AD FS server token-signing certificate might appear in access to the Azure/Office365 environment by the threat actors. 

Not only this they also pronounced that this certificate is valid for a year by default, and will enable the threat actors to log into Azure/Office365 as any user within AD despite any password resets and MFA.

Attack Flow

After detecting this attack, the security analysts have initiated a significant investigation, and they came to know that this attack operates by a threat actor hijacking, or obtaining access to the AD FS server

Once they obtain the access they start extorting the secret (SAML token) and later they use this to access the Office365 Azure AD environment.

Here are the steps followed by the attackers:-

  • Step 1: Attacker compromises the on-premise domain
  • Step 2: Enumeration
  • Step 3: Gather the credentials for the AD FS process owner account
  • Step 4: Laterally move to AD FS server
  • Step 5: Attain the token-signing certificate from the AD FS server
  • Step 6: Attain the DKM 
  • Step 7: Decrypt the token-signing certificate
  • Step 8: Generate a SAML token

Access Gained by Abusing SAML Token

Here, are the list of things that are accessed by the threat actors by abusing the SAML token:-

  • Azure / Azure AD
  • Office 365
  • Azure Applications (which they can further backdoor)
  • Defender Security Center

Apprehension Mechanisms


However, cybersecurity researchers are trying their best to know all the details of this attack. But, the indication of this attack is that the threat actors maintain persistence and they have a strong motive to re-enter the environment, avoiding all kinds of detection.

Apart from all these things, this is quite a complicated attack, and it has the goal to achieve the token-signing certificate as well as the private key that AD FS uses to signify SAML tokens which were being published by AD FS for authentication.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

CISA Warns Hackers Exploiting Wastewater Systems Logic Controllers

In a disconcerting turn of events, cyber threat actors have set their sights on...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles