Microsoft observed Iranian state-sponsored threat actor Peach Sandstorm deploying a new custom multi-stage backdoor named Tickler in attacks against the satellite, communications equipment, oil and gas, as well as federal and state government sectors in the United States and the United Arab Emirates. Tickler is capable of running various commands and collecting information from target devices. Microsoft assesses that Peach Sandstorm operates on behalf of the Iranian Islamic Revolutionary Guard Corps (IRGC) based on the group’s victimology and operational focus. Peach Sandstorm was also observed to launch password spray attacks against their targets and leverage compromised accounts to procure operational infrastructure. The attacker-controlled infrastructure is then used as command-and-control (C2) for Peach Sandstorm operations. Microsoft also observed intelligence gathering and possible social engineering targeting organizations within the higher education, satellite, and defense sectors via LinkedIn. Our blog presents information on Peach Sandstorm's use of Tickler and the threat actor's evolving tradecraft, as well as guidance for how organizations can harden their attack surfaces against related attacks. https://msft.it/6042lfpyI
Microsoft Threat Intelligence
Computer and Network Security
We are Microsoft's global network of security experts. Follow for security research and threat intelligence.
About us
The Microsoft Threat Intelligence community is made up of more than 10,000 world-class experts, security researchers, analysts, and threat hunters analyzing 78 trillion signals daily to discover threats and deliver timely and hyper-relevant insight to protect customers. Our research covers a broad spectrum of threats, including threat actors and the infrastructure that enables them, as well as the tools and techniques they use in their attacks.
- Website
-
https://aka.ms/threatintelblog
External link for Microsoft Threat Intelligence
- Industry
- Computer and Network Security
- Company size
- 10,001+ employees
- Specialties
- Computer & network security, Information technology & services, Cybersecurity, Threat intelligence, Threat protection, and Security
Updates
-
Microsoft researchers examined anonymized and aggregated security patch level data from millions of Android devices enrolled with Microsoft Intune to gain insights into the availability and adoption of Android security updates across different device models. Mobile devices are targeted by threat actors in part due to their prevalence, access to enterprise networks and resources, and unique attributes like portability, ubiquitous network connectivity, and sensor capabilities. Concerns around the lifecycle for Android security updates frequently appear in mobile security discussions. As with any platform, vulnerabilities are found in Android that require timely patching to mitigate exploitation by threat actors, though Android's extensibility and device diversity from various original equipment manufacturers (OEMs) create security update complexities. We uncovered that the majority (61) of the top 100 (by Intune enrollment) device models had security updates made available during the month of Google's Android security bulletin release or the following month. Additionally, the majority of these Intune-enrolled devices had the updates installed during the same or following month that they became available from the OEM. Though notably, 32 device models had a difference of two months or more since the latest patch level release, and 6 of those 32 models had a difference of 10 months or more. Learn more about the security update lifecycle for Android as well as our findings and recommendations for users and enterprises to ensure Android devices remain updated against discovered vulnerabilities: https://msft.it/6045l4OkS
Research Analysis and Guidance: Ensuring Android Security Update Adoption
techcommunity.microsoft.com
-
Sherrod DeGrippo, Director of Threat Intelligence Strategy at Microsoft, discusses SIM swapping, AI exploits, and defensive strategies in this interview with Information Security Media Group (ISMG).
Microsoft's Sherrod DeGrippo delves into the rise of SIM swapping, the role of social engineering in #cyberattacks, and the emerging use of #AI by threat actors. She emphasizes the need for real multifactor authentication and advanced strategies to counter these evolving threats. Watch the full interview: https://lnkd.in/gJGmHnCP #ISMGNews #cybersecurity Michael Novinson
-
🚨Attention security researchers, responders, and everyone in the security community!🚨 The BlueHat 2024 Call for Papers is now open! We invite everyone to submit proposals for 45-minute Breakout Sessions or 15-minute Lightning Talks. Don’t miss this opportunity to share your findings, new ideas, and best practices at BlueHat 2024, October 29-30, in Redmond, WA. Learn more in our blog post: https://lnkd.in/gETgvsMp #BlueHat #infosec
-
-
Threat actors leverage compromised identities to achieve a significant level of access to target networks. Implementing multi-factor authentication (MFA) remains an essential pillar in identity security and highly effective at stopping a wide variety of threats, and can block more than 99.2% of account compromise attacks. The introduction of mandatory MFA for all Azure sign-ins will help better protect Azure accounts from unauthorized access. Read the Azure blog to learn more about this change:
🔐 Multifactor authentication is one of the most effective ways to protect against cyberattacks, yet most accounts don't use it. Learn why MFA login will be mandatory for Azure sign-in this year: https://msft.it/6044lSNIC
Announcing mandatory multi-factor authentication for Azure sign-in | Microsoft Azure Blog
https://azure.microsoft.com/en-us/blog
-
Microsoft has detected a 111% year-over-year increase in token replay attacks, and incidents are continuing to grow. In token replay attacks, attackers steal tokens – authentication artifacts that grant users access to resources – commonly via malware or adversary-in-the-middle (AiTM) attacks, and then replay the token from somewhere else to impersonate users and access their data. While token theft constitutes fewer than 5% of all identity compromises, Microsoft expects threat actors to continue using this technique, especially since it allows attackers to circumvent protection measures like multi-factor authentication (MFA). In this blog post, Microsoft provides details on the mechanics of tokens, the token theft attack chain, and how Microsoft protects customers against token theft through token binding. We also provide recommendations for a systematic defense-in-depth approach to counter token theft attacks: https://msft.it/6042lSgTq
-
-
In 2023, Microsoft, cybersecurity software company Fortra™, and Health Information Sharing and Analysis Center (Health-ISAC) joined forces to disrupt the criminal use of the cracked versions of the red teaming tool, Cobalt Strike. This action has helped reduce the use of cracked copies of Cobalt Strike by more than 50%, as well as resulted in a dramatic drop in the observed Cobalt Strike command and control servers. Jason Lyons, Microsoft's Digital Crimes Unit Principal Investigator, Bob Erdman, Associate VP Research and Development at Fortra, and Richard Domingues Boscovich, Assistant General Counsel at Microsoft joins Sherrod DeGrippo in this episode of The Microsoft Threat Intelligence podcast to discuss their work behind the disruption of cracked copies of Cobalt Strike. They share their insights on taking a unique approach to take down cybercriminal activity, developing an automated process to tackle the disruption at scale, and using the intelligence gathered from the operation to prevent future abuse. Full podcast episode here: https://msft.it/6047lqde1 Learn more from Microsoft reports on the cracked Cobalt Strike disruption operation: https://msft.it/6048lqdeG https://msft.it/6049lqdeH Learn more about Fortra™ and the Health-ISAC here: https://msft.it/6041lqdeJ https://msft.it/6042lqdeK
Disrupting Cracked Cobalt Strike
-
The August 2024 security updates are available:
Security updates for August 2024 are now available. Details are available here: https://msft.it/60119yPTS #PatchTuesday #SecurityUpdateGuide
-
-
Microsoft Threat Intelligence reposted this
AI Safety at Microsoft means everything from "protect the VM from buffer overruns" to "what happens if the person using this has an abusive partner?" Right now we're hiring for a range of roles, looking for a range of backgrounds. Follow the links to learn the details of each particular role and apply for them. If you don't see something that matches your background and skillset, keep watching! We'll continue to post as other roles come up. *AI Red Team:* Probing the high-risk systems to discover the risks nobody has realized are yet real. All these roles include crossover with operations, to keep you grounded in the real cutting edge. *AIRT Operator:* https://lnkd.in/gctvci3S The core "probe the systems" job. Experience thinking adversarially required. Maniacal cackles optional. *AI Safety Researcher:* https://lnkd.in/gsa-Udru Staff-level, looking for adversarial ML or AI safety experience. Research on the cutting edge of AI havoc. *SWE:* https://lnkd.in/gvwJePge Working on PyRIT (https://lnkd.in/gFdmfaww) *The AI Safety Platform:* Putting as much of AI safety as possible into the codebase so teams don’t have to do it by hand. Domain expertise not required, experience working on software platforms (APIs/SDKs) useful. *Eng Manager*: https://lnkd.in/gfnW_a-b *Staff-level SWE*: https://lnkd.in/g4c7FFE9 *Senior-level SWE*: https://lnkd.in/g7bBy_4S *Empowering Microsoft:* Lots of safety can't be turned into software: how to identify the relevant threats, design an incident response plan, etc. This team needs to understand and distill the practice of safety and turn it into training, tools, and documentation, first for our own teams, then for the world. *AI Safety Program Manager:* https://lnkd.in/gKbfzh6P Staff-level role distilling this knowledge. Deep safety expertise (including technical and human aspects), experience working with product teams, and great communication required. *Technical Writer:* https://lnkd.in/gZ8dv8Eg *TPM, Office of the Deputy CISO:* https://lnkd.in/gQN2k8rb We have so many cats to herd. Senior- to staff-level TPM who can bring order out of chaos.
-
-
In a new report released today, the Microsoft Threat Analysis Center (MTAC) is sharing intelligence about Iranian actors laying the groundwork for influence operations aimed at US audiences and potentially seeking to impact the 2024 US presidential election. Foreign malign influence concerning the 2024 US election started off slowly but has steadily picked up pace over the last six months, initially from Russian operations but more recently from Iranian activity. Microsoft has observed that recent cyber-enabled influence activity arises from a combination of Iranian actors like Sefid Flood, Mint Sandstorm, Peach Sandstorm, and Storm-2035 conducting initial cyber reconnaissance and seeding online personas and websites into the information space. Microsoft also observed three Russian influence actors behind campaigns aimed at the 2024 presidential election: Ruza Flood (aka Doppelganger), Storm-1516, and Storm-1841 (Rybar). The most impactful of these actors as of late June 2024 is Storm-1516, which pivoted in late April from Ukraine-focused operations to targeting the US election with its distinctive video forgeries. Chinese Communist Party (CCP)-linked influence actors also continue to engage US audiences on divisive political issues, expanding to new platforms and evolving their tactics to engage new audience spaces ahead of November. Learn more about these campaigns from the third election report from MTAC: https://msft.it/6040llWQu
Iran Targeting 2024 US Election - Microsoft On the Issues
blogs.microsoft.com