Recently, it has been reported that an APT group has attacked the client’s Office 365 environment, also they have discovered a way to bypass authentication controls so that they can fully access the environment of the directory server.
According to the investigation, the experts claimed that most of the clients either have a hybrid authentication model set-up or are completely in the cloud.
However, compromising the AD FS server token-signing certificate might appear in access to the Azure/Office365 environment by the threat actors.
Not only this they also pronounced that this certificate is valid for a year by default, and will enable the threat actors to log into Azure/Office365 as any user within AD despite any password resets and MFA.
After detecting this attack, the security analysts have initiated a significant investigation, and they came to know that this attack operates by a threat actor hijacking, or obtaining access to the AD FS server.
Once they obtain the access they start extorting the secret (SAML token) and later they use this to access the Office365 Azure AD environment.
Here are the steps followed by the attackers:-
Here, are the list of things that are accessed by the threat actors by abusing the SAML token:-
However, cybersecurity researchers are trying their best to know all the details of this attack. But, the indication of this attack is that the threat actors maintain persistence and they have a strong motive to re-enter the environment, avoiding all kinds of detection.
Apart from all these things, this is quite a complicated attack, and it has the goal to achieve the token-signing certificate as well as the private key that AD FS uses to signify SAML tokens which were being published by AD FS for authentication.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.
The first instance of Redline using such a method is in a new variant of Redline Stealer malware that McAfee…
A threat actor reportedly sells a database containing 49 million user records from Dell, one of the world's leading technology…
A safe and trusted Google Play experience is our top priority. We leverage our SAFE (see below) principles to provide…
BlackBerry reported a new iOS LightSpy malware, but Huntress researchers found it to be a macOS variant targeting Intel or…
A new RAT malware has been discovered to be targeting Android devices. This malware is capable of executing additional commands…
A serious concern has arisen for iPhone users in the European Union as a newly discovered flaw in Apple's Safari…