SolarWinds hackers are targeting Microsoft AD servers
The “passive and highly targeted" FoggyWeb backdoor has been around since at least April 2021
The Russian state-backed hacking group was found to be using a post-exploitation backdoor dubbed FoggyWeb in order to remotely exfiltrate sensitive data as well as maintain persistence on victims’ networks, warned MSTIC researcher Ramin Nafisi.
In order to steal the data, Nobelium hackers first gain admin privileges to AD FS servers by employing “multiple tactics to pursue credential theft”. Once they manage to compromise the server, they then deploy FoggyWeb “to remotely exfiltrate the configuration database of compromised AD FS servers, decrypted token-signing certificates and token-decryption certificates”, wrote Nafisi.
The “passive and highly targeted” FoggyWeb backdoor “has been observed in the wild as early as April 2021”, he added.
Microsoft stated that it had notified all customers believed to be targeted by Nobelium. However, it didn’t rule out that some organisations might still be at risk. It recommends that potential victims audit their on-premises and cloud infrastructure, “remove user and app access”, strengthen their passwords, as well as “use a hardware security module (HSM) in securing AD FS servers to prevent the exfiltration of secrets by FoggyWeb”.
Eight steps to fight ransomware
Insights into how you can protect yourself from this ever increasing threatFree Download
The tech giant also advised organisations to “harden and secure AD FS deployments” by taking additional measures, including limiting on-network access via host firewall and requiring all cloud admins to use multi-factor authentication.
The hackers implanted “information-stealing malware” on a device belonging to a Microsoft customer support agent, through which they obtained “basic account information for a small number of [Microsoft’s] customers”, according to the tech giant.
Prior to this, Nobelium launched a wave of attacks on more than 150 government agencies, think tanks, consultants, and NGOs from 24 countries, targeting an estimated 3,000 email accounts.
2022 State of the multi-cloud report
What are the biggest multi-cloud motivations for decision-makers, and what are the leading challengesFree Download
The Total Economic Impact™ of IBM robotic process automation
Cost savings and business benefits enabled by robotic process automationFree Download
Multi-cloud data integration for data leaders
A holistic data-fabric approach to multi-cloud integrationFree Download
MLOps and trustworthy AI for data leaders
A data fabric approach to MLOps and trustworthy AIFree Download