Hackers target email accounts because they contain valuable personal and financial information.
Successful email breaches enable threat actors to:-.
Cybersecurity researchers at Microsoft Threat Intelligence team recently unveiled that the Russian state-sponsored actor, Star Blizzard, has increased its sophistication and developed new evasion techniques to utilize in ongoing attacks.
Star Blizzard enhanced evasion techniques since 2022, focusing on email credential theft, and they target the following entities aligning with Russian interests:-.
Microsoft improves defenses against spear-phishing and is grateful for the collaboration with the following global cybersecurity partners:-.
Here below, we have mentioned all the new TTPs identified by the cybersecurity analysts at the Microsoft Threat Intelligence team:-.
Star Blizzard focuses on email credential theft, favoring cloud-based providers.
They persist with the Evilginx framework, relying on spear-phishing via email and custom PDF lures.
Connected users and organizations in these areas are potential Star Blizzard targets:-.
Emails mimic known contacts via Proton email accounts, and the initial message requests a document review, but it does not provide any attachment or link to the document.
A follow-up includes a PDF file or link to a cloud-hosted PDF that will be unreadable with a misleading content-enable button.
Pressing the PDF button opens a link, starting a redirection chain.
The host domain is actor-controlled, not the expected server domain.
If approved, the account is compromised, and then the threat actor gains full access with successfully compromised credentials.
Here below, we have mentioned all the recommendations provided by the cybersecurity researchers:-.
On Microsoft Defender Antivirus, make sure to turn on cloud-delivered protection and automatic sample submission.
All suspicious or anomalous activities must be monitored continuously.
To recheck links on click, ensure proper configuration of Microsoft Defender for Office 365.
In Microsoft Defender for Office 365, make sure to use the Attack Simulator.
Always encourage users to use web browsers that support Microsoft Defender SmartScreen.
This Cyber News was published on gbhackers.com. Publication date: Sat, 09 Dec 2023 06:43:06 +0000