Ransomware Attack on Microsoft 365 - Without Using a Compromised Endpoint | June 11 2023
Channel: Hacking Space Frontier
Date: 2023-06-11

Cybersecurity firm Obsidian recently observed a successful ransomware attack on Sharepoint Online (Microsoft 365) through a compromised Microsoft Global SaaS admin account, rather than the usual method of compromising an endpoint. The attack was carried out by a group called 0mega, who created a new Active Directory user with extensive privileges. The attacker stole files and then uploaded numerous PREVENT-LEAKAGE.txt files as a means of communication and extortion. Obsidian believes this type of attack may become more prevalent due to the lack of strong SaaS security programs in many companies. The attack highlights the importance of implementing multi-factor authentication (MFA) for all accounts, particularly highly privileged ones. Even with MFA, attackers can still find ways to exploit stolen credentials. The report recommends strengthening SaaS controls, minimizing privileges, revoking risky integrations, and analyzing audit logs to detect breaches or insider threats.