{"id":58158,"date":"2025-02-14T01:00:00","date_gmt":"2025-02-14T01:00:00","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/storm-2372-conducts-device-code-phishing-campaign\/"},"modified":"2025-02-14T01:00:00","modified_gmt":"2025-02-14T01:00:00","slug":"storm-2372-conducts-device-code-phishing-campaign","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/storm-2372-conducts-device-code-phishing-campaign\/","title":{"rendered":"Storm-2372 conducts device code phishing campaign"},"content":{"rendered":"
\n

Executive summary<\/strong><\/p>\n

Today we\u2019re sharing that Microsoft discovered cyberattacks being launched by a group we call Storm-2372, who we assess with medium confidence aligns with Russia\u2019s interests and tradecraft. The attacks appear to have been ongoing since August 2024 and have targeted governments, NGOs, and a wide range of industries in multiple regions. The attacks use a specific phishing technique called \u201cdevice code phishing\u201d that tricks users to log into productivity apps while Storm-2372 actors capture the information from the log in (tokens) that they can use to then access compromised accounts. These tokens are part of an industry standard and, while these phishing lures used Microsoft and other apps to trick users, they do not reflect a vulnerability unique to Microsoft nor have we found any vulnerabilities in our code base enabling this activity.<\/p>\n<\/blockquote>\n

Microsoft Threat Intelligence Center discovered an active and successful device code phishing campaign by a threat actor we track as Storm-2372. Our ongoing investigation indicates that this campaign has been active since August 2024 with the actor creating lures that resemble messaging app experiences including WhatsApp, Signal, and Microsoft Teams. Storm-2372\u2019s targets during this time have included government, non-governmental organizations (NGOs), information technology (IT) services and technology, defense, telecommunications, health, higher education, and energy\/oil and gas in Europe, North America, Africa, and the Middle East. Microsoft assesses with medium confidence that Storm-2372 aligns with Russian interests, victimology, and tradecraft.  <\/p>\n

In device code phishing, threat actors exploit the device code authentication flow to capture authentication tokens, which they then use to access target accounts, and further gain access to data and other services that the compromised account has access to. This technique could enable persistent access as long as the tokens remain valid, making this attack technique attractive to threat actors.<\/p>\n

The phishing attack identified in this blog masquerades as Microsoft Teams meeting invitations delivered through email. When targets click the meeting invitation, they are prompted to authenticate using a threat actor-generated device code. The actor then receives the valid access token from the user interaction, stealing the authenticated session.<\/p>\n

Because of the active threat represented by Storm-2372 and other threat actors exploiting device code phishing techniques, we are sharing our latest research, detections, and mitigation guidance on this campaign to raise awareness of the observed tactics, techniques, and procedures (TTPs), educate organizations on how to harden their attack surfaces, and disrupt future operations by this threat actor. Microsoft uses Storm designations as a temporary name given to an unknown, emerging, or developing cluster of threat activity, allowing Microsoft to track it as a unique set of information until we reach high confidence about the origin or identity of the threat actor behind the activity.<\/p>\n

Microsoft Threat Intelligence Center continues to track campaigns launched by Storm-2372, and, when able, directly notifies customers who have been targeted or compromised, providing them with the necessary information to help secure their environments. Microsoft is also tracking other groups using similar techniques, including those documented by Volexity in their recent publication<\/a>.<\/p>\n

How does device code phishing work?<\/h2>\n

A device code authentication flow is a numeric or alphanumeric code used to authenticate an account from an input-constrained device that does not have the ability to perform an interactive authentication using a web flow and thus must perform this authentication on another device to sign-in. In device code phishing, threat actors exploit the device code authentication flow.<\/p>\n

During the attack, the threat actor generates a legitimate device code request and tricks the target into entering it into a legitimate sign-in page. This grants the actor access and enables them to capture the authentication\u2014access and refresh\u2014tokens that are generated, then use those tokens to access the target\u2019s accounts and data. The actor can also use these phished authentication tokens to gain access to other services where the user has permissions, such as email or cloud storage, without needing a password. The threat actor continues to have access so long as the tokens remain valid. The attacker can then use the valid access token to move laterally within the environment.<\/p>\n

\"Diagram
Figure 1. Device code phishing attack cycle<\/figcaption><\/figure>\n

Storm-2372 phishing lure and access<\/h2>\n

Storm-2372\u2019s device code phishing campaign has been active since August 2024. Observed early activity indicates that Storm-2372 likely targeted potential victims using third-party messaging services including WhatsApp, Signal, and Microsoft Teams, falsely posing as a prominent person relevant to the target to develop rapport before sending subsequent invitations to online events or meetings via phishing emails.<\/p>\n

\"Screenshots
Figure 2. Sample messages from the threat actor posing as a prominent person and building rapport on Signal<\/figcaption><\/figure>\n

The invitations lure the user into completing a device code authentication request emulating the experience of the messaging service, which provides Storm-2372 initial access to victim accounts and enables Graph API data collection activities, such as email harvesting.<\/p>\n

\"Screenshot
Figure 3. Example of lure used in phishing campaign<\/figcaption><\/figure>\n

On the device code authentication page, the user is tricked into entering the code that the threat actor included as the ID for the fake Teams meeting invitation.<\/p>\n

Post-compromise activity<\/h2>\n

Once the victim uses the device code to authenticate, the threat actor receives the valid access token. The threat actor then uses this valid session to move laterally within the newly compromised network by sending additional phishing messages containing links for device code authentication to other users through intra-organizational emails originating from the victim\u2019s account.<\/p>\n

\"Screenshot
Figure 4. Legitimate device code authentication page<\/figcaption><\/figure>\n

Additionally, Microsoft observed Storm-2372 using Microsoft Graph to search through messages of the account they\u2019ve compromised. The threat actor was using keyword searching to view messages containing words such as username, password, admin, teamviewer, anydesk, credentials, secret, ministry, and gov. Microsoft then observed email exfiltration via Microsoft Graph of the emails found from these searches.<\/p>\n

Attribution<\/h2>\n

The actor that Microsoft tracks as Storm-2372 is a suspected nation-state actor working toward Russian state interests. It notably has used device code phishing to compromise targets of interest. Storm-2372 likely initially approaches targets through third-party messaging services, posing as a prominent individual relevant to the target to develop rapport before sending invites to online events or meetings. These invites lure the user into device code authentication that grants initial access to Storm-2372 and enables Graph API data collection activities such as email harvesting.<\/p>\n

Storm-2372 targets include government, NGOs, IT services and technology, defense, telecommunications, health, higher education, and energy\/oil and gas in Europe, North America, Africa, and the Middle East.<\/p>\n

Mitigation and protection guidance<\/h2>\n

To harden networks against the Storm-2372 activity described above, defenders can implement the following:<\/p>\n