Thursday, November 21, 2024
HomeCyber Security NewsMicrosoft Confirms Hacking of Outlook & OneDrive - Layer 7 DDoS Attacks

Microsoft Confirms Hacking of Outlook & OneDrive – Layer 7 DDoS Attacks

Published on

Recently, it’s been confirmed by Microsoft that the current outage problems experienced by the following services of Microsoft were due to intentional Layer 7 DDoS attacks:-

  • Azure
  • Outlook
  • OneDrive

The credit for the attacks goes to a threat actor called Storm-1359 (aka Anonymous Sudan), as per Microsoft’s findings.

Microsoft observed a rise in web traffic targeting specific services starting in early June 2023, resulting in temporary availability issues.

- Advertisement - SIEM as a Service

Without any delay, Microsoft instantly started monitoring the ongoing DDoS attacks thoroughly by launching a quick investigation.

Layer 7 DDoS Attacks

Rather than targeting layer 3 or layer 4, the recent DDoS attacks have primarily targeted layer 7.

OSI Layers

To enhance customer protection against similar DDoS attacks, Microsoft strengthened layer 7 defenses by optimizing Azure Web Application Firewall (WAF).

Microsoft discovered that Storm-1359 could use different cloud services and open proxies to launch DDoS attacks using several botnets and tools.

Moreover, here below, we have mentioned the main focuses of Storm-1359:-

  • Causing disruptions
  • Attracting public attention

In a report published recently, Microsoft provided an introductory analysis of the root cause, suggesting DDoS attacks as the potential reason behind the Azure outage, highlighting a noticeable surge in network traffic.

In a Layer 7 DDoS attack, threat actors specifically direct their efforts towards the application level, aiming to overload services by flooding them with excessive requests.

This huge flood of requests overwhelms the services, causing them to become unresponsive since they cannot handle the load.

The threat actors employ multiple DDoS methods to overpower a web service, exhausting its connection pool and causing it to accept new requests.

Types of DDoS Attack Traffic

Here below, we have mentioned all the types of layer 7 DDoS attack traffic:-

  • HTTP(S) flood attack
  • Cache bypass
  • Slowloris

Recommendations

Here below, we have mentioned all the recommendations offered by Microsoft:-

  • To protect web apps, make sure to use layer 7 protection services like Azure Web Application Firewall (WAF).
  • Stay protected against known bad bots by implementing the bot protection managed rule set.
  • Make sure to block the IP addresses and ranges that you identify as malicious.
  • Unknown and suspicious traffic should be blocked.
  • To block and limit the HTTP or HTTPS attacks automatically that have known signatures, create custom WAF rules.

Looking For an All-in-One Multi-OS Patch Management Platform – 

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Halo Security Launches Slack Integration for Real-Time Alerts on New Assets and Vulnerabilities

Halo Security, a leader in external attack surface management and penetration testing, has announced...

Researchers Detailed FrostyGoop Malware Attacking ICS Devices

FrostyGoop, a newly discovered OT-centric malware that exploited Modbus TCP to disrupt critical infrastructure...

5 Hackers Charged for Attacking Companies via Phishing Text Messages

Federal authorities have unsealed charges against five individuals accused of orchestrating sophisticated phishing schemes...

Two PyPi Malicious Package Mimic ChatGPT & Claude Steals Developers Data

Two malicious Python packages masquerading as tools for interacting with popular AI models ChatGPT...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Researchers Detailed FrostyGoop Malware Attacking ICS Devices

FrostyGoop, a newly discovered OT-centric malware that exploited Modbus TCP to disrupt critical infrastructure...

5 Hackers Charged for Attacking Companies via Phishing Text Messages

Federal authorities have unsealed charges against five individuals accused of orchestrating sophisticated phishing schemes...

Two PyPi Malicious Package Mimic ChatGPT & Claude Steals Developers Data

Two malicious Python packages masquerading as tools for interacting with popular AI models ChatGPT...