Saturday, December 2, 2023

Iranian Hackers Attack the US & Israeli Defense Technology – Microsoft Warns

Iranian hackers have recently attacked Microsoft in which more than 250 Microsft Office 365 accounts that are linked to the United States, the European Union, and the Israeli government were being compromised through comprehensive password spraying.

Despite having strong protection, the Iranian threat actors have managed to classify the vulnerabilities of their company’s protection and infiltrate them. 

After knowing about the attack, Microsoft asserts that organizations that have been attacked by Iranian groups are currently working with the EU, the United States, and Israel in the production of defense technologies.

Behaviors noted

A series of behaviors and tactics are being used by the attackers, and that’s why here we have mentioned some of them below:-

  • Comprehensive inbound traffic from Tor IP addresses for password spray campaigns
  • Emulation of Firefox or Chrome browsers in password spray campaigns
  • Enumeration of Exchange ActiveSync (most common) or Autodiscover endpoints
  • Use of enumeration/password spray tool comparable to the ‘o365spray’ tool hosted at https://github.com/0xZDH/o365spray
  • Use of Autodiscover to verify accounts and passwords
  • Found password spray activity commonly topping between 04:00:00 and 11:00:00 UTC

Recommended Precautions

Here are some of the defenses that are to be followed by the organizations to keep themself safe from this kind of attack:-

  • Always allow multifactor authentication.
  • Microsoft fully assists customers to download and use passwordless resolutions such as Microsoft Authenticator to keep the accounts safe.
  • Examine and implement approved Exchange Online access policies.
  • Remember to block all incoming traffic from anonymizing services.

The main motive of the DEV-0343 operators is to gain access to commercial satellite description and their own plans and shipping records, which would be utilized to increase Iran’s developing satellite program.

That’s why Microsoft affirmed that each and every customer should stay aware of this kind of attack, as they are quite harmful in nature and can put a lot of impact on different organizations.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Booking.com Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles