The largest security breach in the history of Microsoft Azure has occurred. The vulnerability would have affected hundreds of executive accounts.
A security breach that exposed sensitive customer data would have affected hundreds of Azure accounts, Microsoft’s cloud service. The cyberattack targeted senior leaders of major corporations and had an impact on several environments.
The hacking used the same harmful campaign that Proofpoint, a cybersecurity company, discovered in November 2023. It combines cloud account takeover (CTO) with phishing techniques to steal credentials. Attackers would be able to access OfficeHome and Microsoft 365 apps simultaneously with this help.
To get over geographical limitations and conceal their actual location, the hackers are said to have employed proxy services. The attackers used links in the papers that led visitors to phishing websites to execute the assault. The anchor text for several of these links was “View document,” which did not arouse suspicions.
The well-planned attack went for both mid-level and senior staff, though more of the former’s accounts were hacked. The most popular targets, according to Proofpoint, were CEOs, presidents, account managers, financial directors, vice presidents of operations, and sales directors. The attackers were able to obtain information from all levels and domains of the business as a result.
Cybercriminals utilize their own MFA (multifactor authentication) in these kinds of assaults to extend access once the account has been compromised. Some methods include adding a second mobile number or setting up an authentication app to prevent the user from regaining access. To cover their traces, attackers also destroy any proof of questionable behavior.
The theft of data and the commission of financial fraud are the goals of these cyberattacks. Based on the use of local fixed-line ISPs in these regions, it is thought that the attacks originated in Nigeria and Russia, albeit there is currently insufficient evidence to confirm this.
