Microsoft Threat Intelligence Center (MSTIC) Archives

Breaking down NOBELIUM’s latest early-stage toolset

May 28, 2021 TH Author Cybersecurity, Microsoft security intelligence, Microsoft Threat Intelligence Center (MSTIC), NOBELIUM

In this blog, we highlight four tools representing a unique infection chain utilized by NOBELIUM: EnvyScout, BoomBox, NativeZone, and VaporRage. These tools have been observed being used in the wild as early as February 2021 attempting to gain a foothold on a variety of sensitive diplomatic and government entities.
The post Breaking down NOBELIUM’s latest early-stage toolset appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

New sophisticated email-based attack from NOBELIUM

May 28, 2021 TH Author Cybersecurity, Microsoft security intelligence, Microsoft Threat Intelligence Center (MSTIC), NOBELIUM

Microsoft Threat Intelligence Center (MSTIC) has uncovered a wide-scale malicious email campaign operated by NOBELIUM, the threat actor behind the attacks against SolarWinds, the SUNBURST backdoor, TEARDROP malware, GoldMax malware, and other related components. The campaign, initially observed and tracked by Microsoft since January 2021, evolved over a series of waves demonstrating significant experimentation.
The post New sophisticated email-based attack from NOBELIUM appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence

March 4, 2021 TH Author Azure Sentinel, Cybersecurity, Microsoft 365 Defender, Microsoft Defender for Endpoint, Microsoft security intelligence, Microsoft Threat Intelligence Center (MSTIC), nation-state actor, NOBELIUM

Microsoft has identified three new pieces of malware being used in late-stage activity by NOBELIUM – the actor behind the SolarWinds attacks, SUNBURST, and TEARDROP.
The post GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

HAFNIUM targeting Exchange Servers with 0-day exploits

March 2, 2021 TH Author Cybersecurity, Exchange Server, HAFNIUM, Microsoft security intelligence, Microsoft Threat Intelligence Center (MSTIC), MSRC, Security Intelligence, threat intelligence, Threat protection

Microsoft has detected multiple 0-day exploits being used to attack on-premises versions of Microsoft Exchange Server in limited and targeted attacks. In the attacks observed, threat actors used this vulnerability to access on-premises Exchange servers, which enabled access to email accounts, and install additional malware to facilitate long-term access to victim environments. Microsoft Threat Intelligence Center (MSTIC) attributes this campaign with high confidence to HAFNIUM.
The post HAFNIUM targeting Exchange Servers with 0-day exploits appeared first on Microsoft Security. READ MORE HERE…