Microsoft has confirmed that recent outages to Azure, Outlook, and OneDrive web portals resulted from Layer 7 DDoS attacks against the company’s services.

The attacks are being attributed to a threat actor tracked by Microsoft as Storm-1359, who calls themselves Anonymous Sudan.

The outages occurred at the beginning of June, with Outlook.com’s web portal targeted on June 7th, OneDrive on June 8th, and the Microsoft Azure Portal on June 9th.

Microsoft did not share at the time that they were suffering DDoS attacks but hinted that they were the cause, stating for some incidents that they were “applying load balancing processes in order to mitigate the issue.”

In a preliminary root cause report released last week, Microsoft further hinted at DDoS attacks, stating that a spike in network traffic caused the Azure outage.

“We identified a spike in network traffic which impacted the ability to manage traffic to these sites and resulted in the issues for customers to access these sites,” explained Microsoft.

In a Microsoft Security Response Center post released on Friday, Microsoft now confirms that these outages were caused by a Layer 7 DDoS attack against their services by a threat actor they track as Storm-1359.

“Beginning in early June 2023, Microsoft identified surges in traffic against some services that temporarily impacted availability. Microsoft promptly opened an investigation and subsequently began tracking ongoing DDoS activity by the threat actor that Microsoft tracks as Storm-1359,” confirmed Microsoft.

“These attacks likely rely on access to multiple virtual private servers (VPS) in conjunction with rented cloud infrastructure, open proxies, and DDoS tools.”

“We have seen no evidence that customer data has been accessed or compromised.”

A Layer 7 DDoS attack is when the threat actors target the application level by overwhelming services with a massive volume of requests, causing the services to hang as they cannot process them all.

Microsoft says Anonymous Sudan uses three types of Layer 7 DDoS attacks: HTTP (S) flood attacks, Cache bypass, and Slowloris.

Each DDoS method overwhelms a web service, using up all available connections so they can no longer accept new requests.

Microsoft said that a recent connectivity issue affecting its Azure cloud platform was caused by an abnormal increase in HTTP requests, shortly after a hacking group claimed to launch a distributed denial-of-service (DDoS) attack against the service.

In a preliminary review of the incident published on Tuesday, the tech giant said the flood in requests led to Azure displaying a “service unavailable” message in several countries on Friday. Microsoft resolved the issue within two hours, it added.

Microsoft said it would release a full investigation with more details about the Azure outage within the next two weeks.

Shortly after the outage started on Friday, the hacking group Anonymous Sudan wrote on Telegram that it launched a DDoS attack against Azure to show how “untrustworthy” its services are. Such attacks generally work by flooding targeted websites and services with junk traffic, making them unreachable.

Earlier last week, Microsoft’s email service, Outlook, also suffered a series of brief worldwide outages, which Anonymous Sudan also claimed to have caused.

“We will continue the attack until we get tired and go to sleep, we are currently enjoying the mood with cola and music, while Microsoft suffers,” the hacking group wrote on Telegram.

The group also made a demand to Microsoft, requesting a ransom of $1 million. They threatened to continue the attacks and sell data on 30 million customers they claim to have accessed. DDoS attacks are relatively simple to launch, and generally don’t involve data theft.

Microsoft would not confirm whether Anonymous Sudan was involved in the recent incidents or if any data was leaked, as its investigation is still ongoing.

Anonymous Sudan also claimed to attack other U.S. companies this month, including ride-hailing service Lyft, as well as U.S. healthcare services and hospitals.

Earlier in May, the group made an unexpected demand of $3 million from Scandinavian Airlines in order to halt DDoS attacks that targeted the airline’s websites since February.

Cybersecurity researchers believe the group isn’t an authentic part of the larger Anonymous hacktivist movement, but “most likely created as part of a Russian information operation to harm and complicate Sweden’s NATO application,” according to a report published by Swedish cybersecurity company Truesec.

Chicago-based cybersecurity firm Trustwave said that there is evidence the group is financially motivated, and is a sub-group of the pro-Russia hacking group known as Killnet.

Microsoft is investigating an ongoing outage blocking customers worldwide from accessing and using web apps like Excel Online and online services.

The list of affected services includes Microsoft 365 suite, Exchange Online, SharePoint Online, Yammer Enterprise, Planner, Microsoft Teams, Microsoft 365 for the web, and Project for the web.

According to reports, customers are experiencing problems when trying to sign into their accounts and will see that no web apps are available once in.

“We’re investigating access issues with Microsoft 365 Online apps and the Teams admin center. Further information can be found under OO544150 within the Microsoft 365 admin center,” the company tweeted earlier today.

“Users may be intermittently unable to view or access web apps in Microsoft 365. We’re reviewing service monitoring telemetry to isolate the root cause and develop a remediation plan,” the admin center incident report says.

In some cases, a banner displayed at the top of the screen asks “new” users to reach out to their IT department to help with the issue.

“New to Microsoft 365? This is your Microsoft 365 home page where you can see and access all of your apps. If it’s empty, it could be that your user license was very recently assigned to you,” the notification reads.

“Wait 10 minutes and refresh this page. If you still don’t see any apps, contact your IT department. They can help you get up and running.”

We're investigating access issues with Microsoft 365 Online apps and the Teams admin center. Further information can be found under OO544150 within the Microsoft 365 admin center.

— Microsoft 365 Status (@MSFT365Status) April 20, 2023

According to the latest updates provided by Microsoft in the admin center, the out was caused by caching infrastructure performing below acceptable performance thresholds and leading to timeout exceptions.

“Analysis of diagnostic data has identified an unusually high number of timeout exceptions within our caching and Azure Active Directory (AAD) infrastructure. We’re working to isolate the cause of these exceptions whilst identifying steps to remediate impact,” Microsoft said.

Until this Microsoft 365 outage is addressed, users can access applications through direct URLs. Microsoft provides the following examples:

Microsoft Teams went down this morning for nearly three hours after Microsoft forgot to renew a critical security certificate. Users of Microsoft’s Slack competitor were met with error messages attempting to sign into the service on Monday morning, with the app noting it had failed to establish an HTTPS connection to Microsoft’s servers.

Microsoft confirmed the Teams service was down just after 9AM ET today, and then later revealed the source of the issue. “We’ve determined that an authentication certificate has expired causing users to have issues using the service,” explains Microsoft’s outage notification. Microsoft then started rolling the fix out at 11:20AM ET, and by 12PM ET the service was restored for most affected users. Microsoft confirmed the fix was successfully deployed at 4:27PM ET.

This was an embarrassing mistake for Microsoft to make for its flagship “Office hub” software, especially as the company started its own TV commercials for Teams recently. It’s also surprising to see Microsoft forget to renew a key certificate for Teams, especially when the company develops software like System Center Operations Manager to monitor for things like certificate expiration.

Update, February 3rd 4:40PM: Added confirmation from Microsoft that the fix was successfully deployed.