Microsoft has confirmed that recent outages to Azure, Outlook, and OneDrive web portals resulted from Layer 7 DDoS attacks against the company’s services.

The attacks are being attributed to a threat actor tracked by Microsoft as Storm-1359, who calls themselves Anonymous Sudan.

The outages occurred at the beginning of June, with Outlook.com’s web portal targeted on June 7th, OneDrive on June 8th, and the Microsoft Azure Portal on June 9th.

Microsoft did not share at the time that they were suffering DDoS attacks but hinted that they were the cause, stating for some incidents that they were “applying load balancing processes in order to mitigate the issue.”

In a preliminary root cause report released last week, Microsoft further hinted at DDoS attacks, stating that a spike in network traffic caused the Azure outage.

“We identified a spike in network traffic which impacted the ability to manage traffic to these sites and resulted in the issues for customers to access these sites,” explained Microsoft.

In a Microsoft Security Response Center post released on Friday, Microsoft now confirms that these outages were caused by a Layer 7 DDoS attack against their services by a threat actor they track as Storm-1359.

“Beginning in early June 2023, Microsoft identified surges in traffic against some services that temporarily impacted availability. Microsoft promptly opened an investigation and subsequently began tracking ongoing DDoS activity by the threat actor that Microsoft tracks as Storm-1359,” confirmed Microsoft.

“These attacks likely rely on access to multiple virtual private servers (VPS) in conjunction with rented cloud infrastructure, open proxies, and DDoS tools.”

“We have seen no evidence that customer data has been accessed or compromised.”

A Layer 7 DDoS attack is when the threat actors target the application level by overwhelming services with a massive volume of requests, causing the services to hang as they cannot process them all.

Microsoft says Anonymous Sudan uses three types of Layer 7 DDoS attacks: HTTP (S) flood attacks, Cache bypass, and Slowloris.

Each DDoS method overwhelms a web service, using up all available connections so they can no longer accept new requests.

Microsoft said that a recent connectivity issue affecting its Azure cloud platform was caused by an abnormal increase in HTTP requests, shortly after a hacking group claimed to launch a distributed denial-of-service (DDoS) attack against the service.

In a preliminary review of the incident published on Tuesday, the tech giant said the flood in requests led to Azure displaying a “service unavailable” message in several countries on Friday. Microsoft resolved the issue within two hours, it added.

Microsoft said it would release a full investigation with more details about the Azure outage within the next two weeks.

Shortly after the outage started on Friday, the hacking group Anonymous Sudan wrote on Telegram that it launched a DDoS attack against Azure to show how “untrustworthy” its services are. Such attacks generally work by flooding targeted websites and services with junk traffic, making them unreachable.

Earlier last week, Microsoft’s email service, Outlook, also suffered a series of brief worldwide outages, which Anonymous Sudan also claimed to have caused.

“We will continue the attack until we get tired and go to sleep, we are currently enjoying the mood with cola and music, while Microsoft suffers,” the hacking group wrote on Telegram.

The group also made a demand to Microsoft, requesting a ransom of $1 million. They threatened to continue the attacks and sell data on 30 million customers they claim to have accessed. DDoS attacks are relatively simple to launch, and generally don’t involve data theft.

Microsoft would not confirm whether Anonymous Sudan was involved in the recent incidents or if any data was leaked, as its investigation is still ongoing.

Anonymous Sudan also claimed to attack other U.S. companies this month, including ride-hailing service Lyft, as well as U.S. healthcare services and hospitals.

Earlier in May, the group made an unexpected demand of $3 million from Scandinavian Airlines in order to halt DDoS attacks that targeted the airline’s websites since February.

Cybersecurity researchers believe the group isn’t an authentic part of the larger Anonymous hacktivist movement, but “most likely created as part of a Russian information operation to harm and complicate Sweden’s NATO application,” according to a report published by Swedish cybersecurity company Truesec.

Chicago-based cybersecurity firm Trustwave said that there is evidence the group is financially motivated, and is a sub-group of the pro-Russia hacking group known as Killnet.

Microsoft has reportedly agreed to change its cloud computing practices in order to avoid an antitrust probe from the European Commission, the EU’s antitrust authority.

The potential probe relates to complaints made by European cloud companies including Aruba, OVHcloud, Danish Cloud Community and the Association of Cloud Infrastructure Service Providers (CISPE) about changes Microsoft first made to the terms of its outsourcing license agreement in 2019, and then modified again in 2022.

The cloud vendors raised concerns after their customers were asked to pay more to run Microsoft software in non-Microsoft cloud environments, under what they saw as restrictive cloud licensing policies.

As a result of these licensing changes, on November 9, 2022, CISPE filed a formal complaint with the European Commission’s Directorate-General for Competition (DG Comp) stating: “Microsoft uses its dominance in productivity software to direct European customers to its own Azure cloud infrastructure to the detriment of European cloud infrastructure providers and users of IT services.”

Now, in order to avoid another antitrust probe by the EU Commission, Microsoft has offered to change its cloud computing practices to settle antitrust complaints filed by smaller rivals, a person with direct knowledge of the matter told Reuters.

The European Commission refused to comment on the news, while Aruba, CISPE, the Danish Cloud Community, and OVHcloud did not respond to requests for comment.

CISPE plans to pursue its complaint. A spokesperson for CISPE told Reuters, “We’ve had an initial discussion with Microsoft, but have not seen anything that suggests changes that will ensure that all European customers have the chance to run the software they want in the cloud of their choice free of unfair licence terms or discriminatory pricing.”

A Microsoft spokesperson would not discuss with Computerworld whether a deal had been reached with any of the complainants. “In October 2022, we introduced changes to our licensing practices that address the feedback that we heard from European cloud providers. We are grateful for the productive conversations that led us there and appreciate the feedback that we have received since. We are committed to the European Cloud Community and their success,” the Microsoft spokesperson said.

Microsoft is no stranger to the EU Commission’s antitrust rulings. In 2004 the company paid a $611 million fine after it was found it guilty of illegally bundling media player software with Windows XP. An additional $731 million fine was levelled against the company in 2013 for bundling its Internet Explorer browser with Windows 7.

Microsoft’s proposed acquisition of games studio Activision Blizzard is also currently under scrutiny by the EU Commission, as well as the Competition Market Authorities (CMA) in the UK and the Federal Trade Commission (FTC) in the US.

Amazon and Microsoft are facing a referral to the UK’s competition regulator over allegedly harming competition in the online cloud services market, amid “significant concerns” that big tech companies are abusing their positions.

The British communications regulator, Ofcom, said it was proposing to refer the whole sector to the Competition and Markets Authority (CMA), adding that it was “particularly concerned about the practices of Amazon and Microsoft because of their market position”.

It said it had “significant concerns” after finding “behaviours by some providers that could raise barriers to switching and use of multiple providers”.

The companies and other interested organisations will have until 17 May to respond to Ofcom’s consultation, and the regulator will make a final decision on whether to refer the sector to the CMA by 5 October.

The cloud services market – providing easy access to remote datacentres for a fee – has grown rapidly in the last decade to become a vital foundation for many of the world’s biggest websites and online services ranging from video streaming to mobile apps and government webpages.

That expansion has been behind the soaring global profits of Amazon and Microsoft in particular. Amazon Web Services (AWS) and Microsoft Azure control between 60% and 70% of the UK market, Ofcom said. Google, owned by Alphabet, was the nearest competitor to the pair, with between 5% and 10% of the UK market.

An investigation of the cloud services sector would represent yet more regulatory scrutiny of big tech companies in the UK. The Financial Conduct Authority is looking into whether companies such as Apple, Google and Amazon could harm competition in Britain’s financial services sector, while the CMA has previously said it would strengthen its ability to investigate big tech companies under its digital markets unit.

The CMA has wide-ranging powers to insist on changes to business models of companies who are found to distort competition and the government plans to publish legislation as soon as this month that would give the watchdog the power to fine a company up to 10% of its global turnover. The digital markets, competition and consumer bill will also allow the CMA to apply to ban people from acting as company directors in the UK.

Fergal Farragher, Ofcom’s director who carried out the study of the sector, said: “We’ve done a deep dive into the digital backbone of our economy, and uncovered some concerning practices, including by some of the biggest tech firms in the world.

“High barriers to switching are already harming competition in what is a fast-growing market.”

Ofcom said it had found “reasonable grounds to suspect that there are features in the public cloud infrastructure services market that may have an adverse effect on competition in the UK”.

Those included exit fees, which charge companies to move their data to another cloud provider, restrictions on the ability of different platforms to work with each other, and discounts that could distort competition.

“These market features can make it difficult for some existing customers to bargain for a good deal with their provider,” Ofcom said in a statement. “There are indications this is already causing harm, with evidence of cloud customers facing significant price increases when they come to renew their contracts.”

The alleged practices make it difficult for customers to switch, to use multiple providers simultaneously, and for smaller providers to compete, Ofcom said.

Amazon and Microsoft said they will work with Ofcom.

An Amazon spokesperson said: “The UK has a thriving and diverse IT industry with customers able to choose between a wide variety of IT providers.”

The spokesperson said AWS gave customers “freedom to build the solution that is right for them, with the technology of their choice”, which had “driven increased competition across a range of sectors in the UK economy by broadening access to innovative, highly secure, and scalable IT services”.

A Microsoft spokesperson said: “We remain committed to ensuring the UK cloud industry stays highly competitive, and to supporting the transformative potential of cloud technologies to help accelerate growth across the UK economy.”