According to Microsoft researchers, a hacking group with links to the Russian government has been conducting a targeted phishing campaign against numerous global organizations through Microsoft Teams. The campaign, which began in late May, involves social engineering tactics, where the hackers pretend to be from technical support to deceive users and steal their login credentials.
So far, the attacks have affected fewer than 40 unique global organizations. Microsoft is actively investigating the matter and has taken measures to mitigate the threat posed by the hackers’ domains. The group behind the attacks is known as Midnight Blizzard or APT29 and is associated with Russia’s foreign intelligence service. The targets of these attacks include government agencies, non-government organizations (NGOs), IT services, technology companies, discrete manufacturing firms, and media organizations.
The hackers exploited Microsoft 365 accounts belonging to small businesses to create new domains that appeared to be legitimate technical support entities, often using the word “microsoft” in their names. They then used these domains to send phishing messages to users via Microsoft Teams, attempting to trick them into revealing their login credentials.
Despite the use of multifactor authentication (MFA) prompts, the hackers managed to find ways to bypass this security measure, indicating their sophistication and determination in carrying out these attacks. Midnight Blizzard has a history of targeting organizations in the US and Europe since at least 2018, and their recent activity highlights their ongoing efforts to achieve their espionage objectives using both new and established techniques. The specific names of the targeted organizations were not disclosed in the report.
