Summary Points
- Threat actors use vishing and AitM techniques with fake login URLs to harvest credentials and MFA approvals targeting executives through impersonation of IT personnel.
- The attackers perform session replay attacks using stolen tokens from proxy infrastructure, leading to mass exfiltration of data from SharePoint, OneDrive, Exchange, and Box.
- The threat cluster is highly operational, spreading across diverse industries in the U.S., with a focus on data extortion without deploying endpoint malware or lateral movement tools.
Threat Overview and Techniques
Threat hunters have identified a widespread cyber threat group targeting Microsoft 365 and other SaaS services. This group uses IT help desk vishing to trick victims. They impersonate internal IT staff over the phone and direct targets to fake login pages. These pages have URLs like assignpasskey.com and passkey-mfa.com.
The attackers also use adversary-in-the-middle (AitM) techniques to steal login tokens. They target executives, such as directors and vice presidents. The goal is to access accounts, harvest data, and extort victims. They capture credentials and multi-factor authentication (MFA) approvals. Then, they replay the tokens from proxy servers located in the same region as the victim.
The chain of attack begins with convincing phone calls. Victims are redirected to malicious URLs, which lead to fake login flows. After gaining access, the threat actors explore SharePoint and other cloud services. They gather information and eventually steal data from SharePoint, OneDrive, and email systems.
This threat shares similarities with other known groups, such as UNC6671 and Pink, indicating overlapping infrastructure and tactics. Notably, the attackers do not rely heavily on malware or lateral network movement.
Impact, Security Implications, and Remediation
This threat can cause serious damage. Victims may lose sensitive data, face extortion, and suffer reputational harm. Attackers focus on high-level executives, which increases the risk of corporate data theft. The use of proxy infrastructure and token replay makes detection difficult. It can also lead to broader network compromise if not addressed promptly.
Organizations should take immediate steps to reduce risk. They should implement Conditional Access policies and deploy phishing-resistant MFA methods. Restricting data access in SharePoint can help limit damage. Additionally, training employees and help desk staff about vishing and social engineering is crucial.
To effectively counter this threat, organizations should detect anomalous activities like residential-proxy token reuse, suspicious SharePoint access patterns, and new infrastructure hosting lure domains. For detailed guidance, organizations are advised to consult their security vendors or relevant authorities for tailored remediation steps.
Continue Your Tech Journey
Learn how the Internet of Things (IoT) is transforming everyday life.
Stay inspired by the vast knowledge available on Wikipedia.
ThreatIntel-V1
