“This latest series of attacks marks the second time since January 2025 that Russian threat actors have utilized little-known techniques to obtain access to M365 resources,” researchers concluded. In some instances, attackers use the stolen OAuth authorization code to permanently register new devices to the victim’s Microsoft Entra ID (formerly Azure AD), establishing persistent access to the compromised accounts. Volexity attributes these campaigns to Russian threat actors with “medium confidence,” noting that all messages were themed around Ukraine and targeted individuals historically of interest to Russian intelligence operations. The attackers, tracked as UTA0352 and UTA0355, have demonstrated a concerning ability to conduct highly targeted social engineering operations aimed at gaining unauthorized access to Microsoft 365 accounts. “If the victim shares the OAuth code, the attacker is then able to generate an access token that ultimately allows access the victim’s M365 account,” Volexity explains. “These recent campaigns benefit from all user interactions taking place on Microsoft’s official infrastructure; there is no attacker-hosted infrastructure used in these attacks,” Volexity researchers noted in their analysis published Tuesday. These actors are exploiting legitimate Microsoft OAuth 2.0 authentication workflows to compromise targeted organizations. Security experts recommend organizations train users to be wary of unsolicited contacts via secure messaging apps, especially those requesting code sharing or URL information. Since early March 2025, these sophisticated attacks have primarily focused on individuals and organizations with ties to Ukraine and human rights initiatives. Unlike previous phishing attempts, these attacks utilize legitimate Microsoft infrastructure, making detection significantly more challenging. Security experts believe these groups are being targeted due to their reduced staffing and budget constraints, making them more vulnerable to sophisticated social engineering tactics. The attackers initiate contact through secure messaging applications like Signal and WhatsApp, impersonating officials from various European nations, including Ukraine, Bulgaria, Romania, and Poland. Volexity researchers observed attackers downloading victims’ emails and accessing other sensitive account data after successfully compromising accounts.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 23 Apr 2025 11:31:41 +0000