Incident Responders Explore Microsoft 365 Attacks in the Wild darkreading.com - get the latest breaking news, showbiz & celebrity photos, sport news & rumours, viral videos and top stories from darkreading.com Daily Mail and Mail on Sunday newspapers.
FireEye CEO Kevin Mandia testifies during a Senate Intelligence Committee hearing on Capitol Hill on February 23, 2021 in Washington, DC. FireEye owns Mandiant, founded by Mandia, which released research Tuesday about the need to lock down Active Directory Federation Services. (Photo by Drew Angerer/Getty Images)
Mandiant Tuesday posted a blog detailing a new attack strategy against Microsoft’s Active Directory Federation Services (AD FS). Researchers with the company believe the need to protect AD FS might be the unheralded second lesson from the SolarWinds campaign.
The main lesson organizations drew from the SolarWinds campaign was the need to protect against third-party risk and address supply chain security. Hackers that the United States linked to Russian Intelligence used a gimmicked update to the SolarWinds IT management software and other vectors to take over a variety of government agencies and private organizations.
To revist this article, visit My Profile, then View saved stories.
One of the most chilling aspects of Russia s recent hacking spree which breached numerous United States government agencies among other targets was the successful use of a “supply chain attack” to gain tens of thousands of potential targets from a single compromise at the IT services firm SolarWinds. But this wasn t the only striking feature of the assault. After that initial foothold, the attackers bored deeper into their victims networks with simple and elegant strategies. Now researchers are bracing for a surge in those techniques from other attackers.
The SolarWinds hackers used their access in many cases to infiltrate their victims Microsoft 365 email services and Microsoft Azure Cloud infrastructure both treasure troves of potentially sensitive and valuable data. The challenge of preventing these types of intrusions into Microsoft 365 and Azure is that they don t depend on specific vulnerabilities that