Cyber Threats Loom Large: Multi-Stage Attacks Target Energy Firms

Microsoft Warns of Sophisticated Phishing and BEC Campaign

In a recent alert, Microsoft's Defender Security Research Team has revealed a complex cyberattack campaign targeting multiple energy sector organizations. The attack, involving multi-stage adversary in the middle (AitM) phishing and business email compromise (BEC), exploits the trust placed in SharePoint file sharing services to deliver phishing payloads.

• The attackers leverage inbox rule creation to maintain persistence and evade user awareness.
• The campaign spans multiple organizations, with the attackers transitioning from AitM attacks to follow-on BEC activity.
• The attackers use compromised internal identities from the victim to carry out large-scale phishing, both intra-organizationally and externally.

North East India and Cybersecurity Implications

The energy sector in North East India is rapidly growing, making it an attractive target for cybercriminals. The tactics used in this campaign, such as living-off-trusted-sites (LOTS), can be effective against any organization that relies on popular services like SharePoint and OneDrive.

The use of AitM and BEC attacks underscores the need for robust cybersecurity measures, especially in sectors handling sensitive data. The incident serves as a reminder for organizations across India to strengthen their defenses and stay vigilant against evolving threats.

The Operational Complexity of AitM and Remediation

Microsoft noted that the operational complexity of AitM makes password resets insufficient for remediation. Impacted organizations must ensure that they have revoked active session cookies and removed attacker-created inbox rules used to evade detection.

The company worked with customers to revoke multi-factor authentication (MFA) changes made by the attacker on the compromised user's accounts and delete suspicious rules created on those accounts.

Future Threats and Mitigation Strategies

The attack outlined by Microsoft highlights the ongoing trend among threat actors to abuse trusted services to redirect to credential harvesting sites and stage malware. Organizations are advised to work with their identity provider to ensure security controls like phishing-resistant MFA are in place.

Other recommended measures include enabling conditional access policies, implementing continuous access evaluation, and using anti-phishing solutions that monitor and scan incoming emails and visited websites.

Conclusion

As cyber threats continue to evolve, it is crucial for organizations to stay informed and adapt their defenses accordingly. The recent Microsoft alert serves as a reminder of the need for robust cybersecurity measures and vigilance against evolving threats. By staying informed and implementing best practices, organizations can better protect themselves and their stakeholders.