Microsoft has confirmed that recent outages to Azure, Outlook, and OneDrive web portals resulted from Layer 7 DDoS attacks against the company’s services.

The attacks are being attributed to a threat actor tracked by Microsoft as Storm-1359, who calls themselves Anonymous Sudan.

The outages occurred at the beginning of June, with Outlook.com’s web portal targeted on June 7th, OneDrive on June 8th, and the Microsoft Azure Portal on June 9th.

Microsoft did not share at the time that they were suffering DDoS attacks but hinted that they were the cause, stating for some incidents that they were “applying load balancing processes in order to mitigate the issue.”

In a preliminary root cause report released last week, Microsoft further hinted at DDoS attacks, stating that a spike in network traffic caused the Azure outage.

“We identified a spike in network traffic which impacted the ability to manage traffic to these sites and resulted in the issues for customers to access these sites,” explained Microsoft.

In a Microsoft Security Response Center post released on Friday, Microsoft now confirms that these outages were caused by a Layer 7 DDoS attack against their services by a threat actor they track as Storm-1359.

“Beginning in early June 2023, Microsoft identified surges in traffic against some services that temporarily impacted availability. Microsoft promptly opened an investigation and subsequently began tracking ongoing DDoS activity by the threat actor that Microsoft tracks as Storm-1359,” confirmed Microsoft.

“These attacks likely rely on access to multiple virtual private servers (VPS) in conjunction with rented cloud infrastructure, open proxies, and DDoS tools.”

“We have seen no evidence that customer data has been accessed or compromised.”

A Layer 7 DDoS attack is when the threat actors target the application level by overwhelming services with a massive volume of requests, causing the services to hang as they cannot process them all.

Microsoft says Anonymous Sudan uses three types of Layer 7 DDoS attacks: HTTP (S) flood attacks, Cache bypass, and Slowloris.

Each DDoS method overwhelms a web service, using up all available connections so they can no longer accept new requests.

A Chinese cyberespionage group tracked as UNC3886 has been observed exploiting a VMware ESXi zero-day vulnerability to escalate privileges on guest virtual machines, Mandiant warns.

Initially detailed in September 2022, UNC3886 has been using malicious vSphere Installation Bundles (VIBs) – packages that are typically used to maintain systems and deploy updates – to install backdoors on ESXi hypervisors and gain command execution, file manipulation, and reverse shell capabilities.

The group’s malicious actions would impact VMware ESXi hosts, vCenter servers, and Windows virtual machines (VM).

In recent attacks, the cyberspies were seen harvesting credentials from vCenter Server for all connected ESXi hosts, deploying backdoors using VMCI sockets for lateral movement and persistence, and modifying and disabling logging services on compromised systems.

Additionally, the group has been exploiting a zero-day vulnerability in VMware Tools to bypass authentication and execute privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs.

Tracked as CVE-2023-20867, the vulnerability has a ‘low severity’ rating, because its exploitation requires that the attacker has root access to the ESXi server.

“A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine,” VMware explains in an advisory. VMware Tools version 12.2.5 resolves the flaw.

According to Mandiant, UNC3886 was seen using scripts to harvest credentials from compromised vCenter servers through the connected vPostgreSQL database, enumerating all ESXi hosts and their guest VMs, and modifying lists of allowed IPs across all connected ESXi hosts.

The cyberspies also used installation scripts to deploy malicious VIBs to hosts, and exploited CVE-2023-20867 to execute commands and transfer files from the compromised ESXi host to and from guest VMs, without authentication and without a trace.

“Additionally, the use of CVE-2023-20867 does not generate an authentication log event on the guest VM when commands are executed from the ESXi host,” Mandiant explains.

The cybersecurity firm also observed the group deploying two backdoors (VirtualPita and VirtualGate) using VMCI sockets for lateral movement and continued persistence.

The malware provides the attackers with a new level of persistence (access to the infected ESXi host is regained by accessing a VM) that also allows for network segmentation bypass and evasion of security reviews for open listening ports.

In conjunction with CVE-2023-20867, the regained access to the ESXi host allows the attackers to perform “unauthenticated actions with the highest privileged accounts across any virtual machine running underneath that ESXi host,” Mandiant notes.

“If a vCenter exists as a virtual machine underneath the ESXi host, the attacker can proceed to harvest all connected vpxuser credentials for all ESXi hosts connected to the vCenter and continue to laterally pivot across the environment,” Mandiant adds.

UNC3886 is known for exploiting zero-day bugs in firewall and virtualization solutions in attacks targeting defense, technology, and telecommunication organizations in the US and in the Asia-Pacific region.

Microsoft said that a recent connectivity issue affecting its Azure cloud platform was caused by an abnormal increase in HTTP requests, shortly after a hacking group claimed to launch a distributed denial-of-service (DDoS) attack against the service.

In a preliminary review of the incident published on Tuesday, the tech giant said the flood in requests led to Azure displaying a “service unavailable” message in several countries on Friday. Microsoft resolved the issue within two hours, it added.

Microsoft said it would release a full investigation with more details about the Azure outage within the next two weeks.

Shortly after the outage started on Friday, the hacking group Anonymous Sudan wrote on Telegram that it launched a DDoS attack against Azure to show how “untrustworthy” its services are. Such attacks generally work by flooding targeted websites and services with junk traffic, making them unreachable.

Earlier last week, Microsoft’s email service, Outlook, also suffered a series of brief worldwide outages, which Anonymous Sudan also claimed to have caused.

“We will continue the attack until we get tired and go to sleep, we are currently enjoying the mood with cola and music, while Microsoft suffers,” the hacking group wrote on Telegram.

The group also made a demand to Microsoft, requesting a ransom of $1 million. They threatened to continue the attacks and sell data on 30 million customers they claim to have accessed. DDoS attacks are relatively simple to launch, and generally don’t involve data theft.

Microsoft would not confirm whether Anonymous Sudan was involved in the recent incidents or if any data was leaked, as its investigation is still ongoing.

Anonymous Sudan also claimed to attack other U.S. companies this month, including ride-hailing service Lyft, as well as U.S. healthcare services and hospitals.

Earlier in May, the group made an unexpected demand of $3 million from Scandinavian Airlines in order to halt DDoS attacks that targeted the airline’s websites since February.

Cybersecurity researchers believe the group isn’t an authentic part of the larger Anonymous hacktivist movement, but “most likely created as part of a Russian information operation to harm and complicate Sweden’s NATO application,” according to a report published by Swedish cybersecurity company Truesec.

Chicago-based cybersecurity firm Trustwave said that there is evidence the group is financially motivated, and is a sub-group of the pro-Russia hacking group known as Killnet.

Endpoint security specialist CrowdStrike is warning VMware users that the virtualization all-star’s popular ESXi hypervisor has proven to be a major target for cybercriminals this year and it expects that trend to continue.

“This trend is especially noteworthy given that ESXi, by design, does not support third-party agents or antivirus software and VMware states in its documentation that antivirus software is not required,” CrowdStrike wrote in a blog published Monday. “This, combined with the popularity of ESXi as a widespread and popular virtualization and management system, makes the hypervisor a highly attractive target for modern adversaries.”

VMware responded to the blog in a statement to CRN saying the exploits CrowdStrike mentioned were fixed two to three years ago.

The company said recent exploits that have been used by cybercriminals to control its hypervisor resulted from old instances, and bad “security hygiene.” In a statement, VMware said it was already widely reported that ransomware operators were targeting “End of General Support (EOGS) and/or out-of-date products with vulnerabilities that were addressed and disclosed at least 2-3 years ago” in VMware Security Advisories.

“As the Crowdstrike report mentions, ransomware operators gain initial access by exploiting known vulnerabilities in unpatched software and other security hygiene gaps, and customers should understand that EDR and antivirus solutions are not a substitution for core security practices such as patching known vulnerabilitie,” a VMware spokesperson wrote to CRN.

In the blog, which was writen by an unnamed author, CrowdStrike said VMware’s virtual infrastructure products are highly attractive targets for attackers due to the product’s popularity, and its use as the building-block of most modern IT environments.

“More and more threat actors are recognizing that the lack of security tools, lack of adequate network segmentation of ESXi interfaces, and ITW vulnerabilities for ESXi create a target-rich environment,” the CrowdStrike blog stated. “In April 2023, for example, CrowdStrike Intelligence identified a new RaaS program named MichaelKors, which provides affiliates with ransomware binaries targeting Windows and ESXi/Linux systems. Other RaaS platforms capable of targeting ESXi environments, such as Nevada ransomware, have also been launched.”

The blog also cited attacks in September 2022 which were documented by Mandiant researchers who discovered a novel malware ecosystem targeting VMware ESXi and VMware vCenter servers.

Near the same time, CrowdStrike said it found ESXi servers used for post-exploit activities “to maintain persistence in networks via compromised vCenter servers. Moreover, SCATTERED SPIDER leveraged the open-source proxy tool rsocx to maintain access to victim ESXi servers.”

According to VMware documentation, the ESXi hypervisor architecture has numerous built-in security features such as: CPU isolation, memory isolation, and device isolation. Users can also configure additional security such as lockdown mode, certificate replacement, and smart card authentication for enhanced security.

VMware goes on to state that an ESXi host is also protected with a firewall. Users can open ports for incoming and outgoing traffic as needed, but should restrict access to services and ports. Using the ESXi lockdown mode and limiting access to the ESXi Shell can further contribute to a more secure environment. ESXi hosts participate in the certificate infrastructure. Hosts are provisioned with certificates that are signed by the VMware Certificate Authority (VMCA) by default.

Microsoft will end support for the Windows 7 operating system on Jan. 14, 2020. This may seem like only a minor inconvenience to some. After all, Windows 7 will continue to run on Jan. 14 as it did on Jan. 13. So why is it so important to upgrade to Windows 10?

The answer: cybercrime.

End of support means that Windows 7 no longer will receive the OS patches or security updates that keep your IT systems safe. Whether it’s your personal home computer or the central conduit for your e-commerce business, using an unpatched out-of-date system is equivalent to leaving the door wide open for anyone to enter. If you wouldn’t do it at home, don’t do it to your computer either.

UK businesses are dealing with a higher number of cyber attacks than ever before according to a new report from the National Cyber Security Centre(NCSC).

In the recently published report, Cyber Threat to UK Business Industry 2017-2018, the NCSC has revealed that the scale and number of data breaches increased significantly in 2017. The organisation also highlighted some of the cyber security trends that businesses should be aware of in 2018.

By the end of 2017, the NCSC recorded 36 significant cyber attacks and 762 incidents that were less serious.

One of the biggest attacks of last year was the WannaCry ransomware attack which affected the NHS and many UK businesses. The report also delved into the largest data breaches of last year including the Equifax, Verizon and Uber hacks.

Chief executive of the NCSC, Ciaran Martin offered more details on the findings of the report and shed light on how the NCSC is working to combat cyber threats, saying:

“The last year has seen no deceleration in the tempo and volume of cyber incidents, as attackers device new ways to harm businesses and citizens around the globe. The NCSC’s aim is to make the UK an unattractive target to cyber criminals and certain nation states by increasing their risk, and reducing their return on investment.”
The NCSC highlighted the Internet of Things as a possible future threat for businesses and individuals to be weary of since consumers have begun to link numerous connected devices to their home networks including household appliances.

Cloud security was also identified as a potential future target of cyber attackers as businesses tend to put too much faith in their cloud providers without being aware of how and where their data is stored. This could inevitably lead to high profile data breaches where the information of UK citizens is exposed.

Despite these warnings from the NCSC, a Fujitsu survey found that only one in 10 UK businesses believe cyber crime is the biggest challenge to their future economic success.

British consumers lost billions of pounds to online scams and attacks during 2017 as criminals widened their assault across the world.

A new report from Symantec has revealed that 17 million customers were affected by cybercrime in the UK during 2017, equivalent to around a third of the total adult population.

Losses from cybercrime were estimated at totalling £4.6 billion across the UK, with the average victim also losing an average of 14.8 hours (nearly two working days) dealing with the aftermath of cybercrime.

The most common attacks included phishing emails, experienced by 37 per cent of the victims, fraudulent online purchases (20 per cent) and fake technical support scams (over 25 per cent).

In total, the 2017 Norton Cyber Security Insights Report found that £130 billion was stolen from 978 million customers across 20 countries during 2017, showing the true global scale of cyber crime.

The report added that victims of cybercrime appeared to share a similar profile and usage habits, often just being everyday people who own several connected devices. However they often lack complete cyber security awareness, with bad habits such as re-using the same password across all their online accounts (20 per cent of cybercrime victims versus 12 per cent of non-victims).

Interestingly, one in five also said that they believed stealing information online was not as bad as stealing property in ‘real life.’

“Consumers’ actions revealed a dangerous disconnect: Despite a steady stream of cybercrime sprees reported by media, too many people appear to feel invincible and skip taking even basic precautions to protect themselves,” said Nick Shaw, vice president and general manager of Norton, EMEA.

“This disconnect highlights the need for consumer digital safety and the urgency for consumers to get back to basics when it comes to doing their part to prevent cybercrime.”

A major new cyber-attack named as KnockKnock has been detected currently taking place against Office 365 Exchange Online email accounts, according to Skyhigh Networks.

The cloud security firm is reporting that more than half of its customers are being attacked from 16 different countries. The interesting thing about this attack is that it’s not targeting humans or their ‘human’ accounts, but rather machines. Under attack are corporate accounts, not tied to any human identity, which thus lack the usual advanced security measures such as two-factor authentication or recurring password reset.

The attacks started in May and are still ongoing, although Skyhigh says the bulk of attack happened in the summer months between June and August. So far, 63 different networks and 83 IP addresses have been used for the attacks.

Skyhigh has notified the affected parties and said that no data loss has been spotted.

“Normally, login attacks follow the ‘brute force’ template with widespread attempts made simultaneously across hundreds of corporate accounts, but KnockKnock reveals that more precise tactics are being deployed,“ commented Nigel Hawthorn, chief European spokesperson at Skyhigh Networks.

“By intelligently targeting accounts not linked to users, the attempts are far less likely to be red flagged or noticed by security, particularly if only one or two attempts are made at any one time; three failed login attempts often sets of alarm bells – just think about what happens to your phone if you forget your pin.”

“Businesses rely on a variety of tools that work together to produce a holistic cloud infrastructure but these connections require the creation of accounts that aren’t linked to a specific user. If companies don’t fully understand how their infrastructure works, hacker entry into one system could have a domino effect. For example, if actors manage to force entry into email accounts which, in turn, are linked to CRM or accounting solutions, suddenly an even bigger pool of corporate and customer data is at risk.”

“To ensure such accounts are awarded the same attention as other network vulnerabilities, firms must not only be aware of which and how systems are linked, but have the ability to monitor long-term login and user activity, so that attacks like KnockKnock are flagged.”

The world’s largest container shipping biz has revealed the losses it suffered after getting hit by the NotPetya ransomware outbreak, and the results aren’t pretty.

The malware surfaced in Ukraine in June after being spread by a malicious update to MeDoc, the country’s most popular accounting software. Maersk picked up an infection that hooked into its global network and shut down the shipping company, forcing it to halt operations at 76 port terminals around the world.

“In the last week of the quarter we were hit by a cyber-attack, which mainly impacted Maersk Line, APM Terminals and Damco,” CEO Soren Skou said in a statement today.

“Business volumes were negatively affected for a couple of weeks in July and as a consequence, our Q3 results will be impacted. We expect that the cyber-attack will impact results negatively by USD 200-300m.”

Admittedly Maersk is massive – it’s responsible for around 15 per cent of the world’s entire shipping network – but that kind of financial damage is close to a record for such an attack. Then again, the company’s entire network was down for days, Skou told the Financial Times.

“It was frankly quite a shocking experience,” said Skou. “Your email goes down, all your address system. We ended up having to use WhatsApp on our private phones. Most business problems, you will have an intuitive idea on what to do. But with this and my skills, I had no intuitive idea on how to move forward.”

Skou said that he decided to take personal charge of the situation, sitting in on IT meetings and getting daily updates on the malware’s progress. He says he learned that there was nothing that could have been done to stop the attack, but he wants to strengthen the company’s systems against further attacks.

Maersk wasn’t the only multinational to be hit by NotPetya. WPP, the world’s largest advertising agency, also took a major hit, as did deliveries firm TNT. While the latter biz hasn’t responded to requests for comment it’s understood to have taken weeks to sort out its infection with a permanent loss of data.

The Barts Health NHS Trust is a system of three district general hospitals staffing over 15,000 employees serving 2.5 million patients in east London.

The Health Service Journal reports that the attack affected thousands of files hosted on the hospital group’s Windows XP operating system, and the file sharing system between departments has been turned off, according to the Telegraph.

Last year, ransomware attacks against Northern Lincolnshire and Goole Hospitals forced them to shut down systems and cancel operations for four days.

They were infected with a variant known as Globe2, which commonly infects users via phishing emails containing malicious links, according to ZDNet.