Iranian cyberspies goal hundreds of organizations with password spray assaults

For a subset of compromised accounts, the attackers used AzureHound and ROADtools, two open-source frameworks that can be utilized to conduct reconnaissance in Microsoft Entra ID (previously Azure Energetic Listing) environments by interacting with the Microsoft Graph and REST APIs with the purpose of exfiltrating knowledge of curiosity from a sufferer’s cloud account.

“AzureHound and Roadtools have performance that’s utilized by defenders, crimson groups, and adversaries,” Microsoft mentioned in its report. “The identical options that make these instruments helpful to reliable customers, like pre-built capabilities to discover and seamlessly dump knowledge in a single database, additionally make these instruments enticing choices for adversaries in search of details about or from a goal’s setting.”

To attain persistence, the attackers arrange new Azure subscriptions on victims’ tenants, which have been used to determine command-and-control communication with infrastructure operated by the group. Additionally they put in the Azure Arc consumer on units in compromised environments and linked it to an Azure subscription they managed, giving them distant management capabilities over these units. Azure Arc is a functionality that enables the distant administration of Home windows and Linux techniques in an Azure AD setting.

Different post-compromise instruments and strategies

After reaching persistence, the Peach Sandstorm attackers deployed quite a lot of publicly out there and customized instruments, together with AnyDesk, a business distant monitoring and administration (RMM) device, and EagleRelay, a customized visitors tunneling device that the attackers deployed on newly created digital machines in sufferer environments.

Different strategies employed by the group embrace abuse of the distant desktop protocol (RDP), executing malicious code by performing DLL hijacking with a reliable VMWare executable and launching a Golden SAML assault.

“In a Golden SAML assault, an adversary steals personal keys from a goal’s on-premises Energetic Listing Federated Providers (AD FS) server and makes use of the stolen keys to mint a SAML token trusted by a goal’s Microsoft 365 setting,” Microsoft mentioned. “If profitable, a risk actor might bypass AD FS authentication and entry federated providers as any person.”