Tag: Recent News

Cybersecurity continues to be a significant threat for governments, businesses and individuals around the world. From supply chain disruptions to ransomware attacks, cybercriminals have become increasingly sophisticated and the threat landscape more diverse. These cybersecurity challenges are compounded by a workforce shortage; there simply aren’t enough people with the cybersecurity skills needed to fill open jobs.

This is a global problem. By 2025, there will be 3.5 million cybersecurity jobs open globally, representing a 350% increase over an eight-year period. We recently announced a national skilling campaign in the United States, where for every two jobs in cybersecurity today, a third goes unfilled. We’re working with community colleges to help close the gap and increase diversity in the profession. Today, Microsoft is announcing the expansion of our cybersecurity skills campaign to an additional 23 countries.

The expansion will see new targeted investments in the following countries: Australia, Belgium, Brazil, Canada, Colombia, Denmark, France, Germany, India, Ireland, Israel, Italy, Japan, Korea, Mexico, New Zealand, Norway, Poland, Romania, South Africa, Sweden, Switzerland, and the United Kingdom. These countries have an elevated cyberthreat risk, coupled with a significant gap in their cybersecurity workforces both in terms of the number of professionals employed in cybersecurity vs. the demand, as well as a lack of diversity.

Based on our research, we’ve created a Power BI to shed light on the cybersecurity skills gap in these countries:

As with our U.S. program, one of our goals is to ensure traditionally excluded populations have opportunities to enter the cybersecurity workforce, including women. The global cybersecurity workforce is woefully lacking in diversity: in the countries where we are expanding our campaign, on average, only 17% of the cybersecurity workforce are female. Leaving women out of the cybersecurity workforce leaves talent on the table and will only hurt our ability to close the skills gap. This isn’t just about equality, there’s a business case too: gender-diverse businesses perform better.

Global scale, meeting local needs
To address the cybersecurity skills gap, there are a few baseline elements that are needed around the world:

First, we need to better understand the skills gap and share best practices. As a broader community, we can’t solve a problem we don’t fully understand, which is why Microsoft is launching a new partnership with the Organization for Economic Cooperation and Development (OECD) to not only develop a detailed study on the skills gap in selected countries but also improve the ability to grow cybersecurity workforces through postsecondary education and training. Together with the OECD, we will make this data publicly available to allow both policymakers and businesses to make more informed decisions, and we will convene member countries to share learnings and best practices.

Second, anyone interested in pursuing cybersecurity as a career – whether students, people changing careers or current IT professionals – need access to industry-aligned skilling content so that they can train for these critical roles. That is why, as part of this expansion, we are offering free training for cybersecurity pathways through our LinkedIn Learning platform, including courses like “The Cybersecurity Threat Landscape” and “Cybersecurity Foundations.” Additionally, learners seeking more technical skilling opportunities can access free security courses through our Microsoft Learn platform with 47 Learning Paths and hundreds of hours of content.

Third, educational institutions need more teachers able and equipped to teach cybersecurity students, which is why we are partnering with educational institutions to provide curriculum. Through our Microsoft Learn for Educators program, we are providing all higher education institutions with access to free curriculum, educator training and tools for teaching, including coursework like Microsoft Security, Compliance and Identity Fundamentals, Microsoft Azure Security Technologies certification and more. We also provide faculty at all these institutions with access to additional resources including free practice and certification exams, curriculum integration support and more. To date, more than 1,000 institutions of higher education around the world have joined the program.

Fourth, we need to provide support to diverse and underserved job seekers. That’s why we are partnering with Ecole 42, a tuition-free global computer science training program with a mission to educate the next generation of software engineers, to make Microsoft cybersecurity content available to its 15,000 learners globally, using peer-to-peer learning and gamification. We’re also launching a partnership with Women in Cybersecurity, a nonprofit with the mission of recruiting, retaining and advancing women in cybersecurity, to expand their student chapters in these 23 countries, helping promote the retention and advancement of women in cybersecurity.

Finally, the cybersecurity skills gap will not be solved with a one-size-fits-all solution. In each of the countries where we are expanding our campaign, Microsoft will work with local education institutions, nonprofits, governments and businesses to develop a cybersecurity skills program that fits the unique needs of their own market – anchored in data about the cybersecurity skills gap in each country. That said, we are building the framework based on a common set of needs, and ensuring we expand access to tools we have available today.

Global expansion
Work is already underway. Here are just a few examples, and we’ll share more details about countries’ plans in the coming weeks and months:

In Colombia, the government has embarked on an initiative to increase its national cybersecurity capacity, including the implementation of professional training programs in areas such as digital security, information security, cybersecurity and critical infrastructure. Our cybersecurity skills work in Colombia will support this effort, helping people acquire cybersecurity and digital skills needed for in-demand jobs. That’s why we’re working with Servicio Nacional de Aprendizaje (SENA), a Colombian public institution that provides free vocational training to millions of Colombians, the Universidad de los Andes, a major private university in Colombia, and local nongovernmental organizations, to offer a “train the trainers” program to equip more than 68,000 Colombians, including 20,000 women, with the skills needed to help fill the many open cybersecurity jobs.

In India, we’re building off our existing CyberShikshaa program, which is helping break down the gender divide in the cybersecurity field. Since 2018, we have helped young women with technical training in cybersecurity with mentoring from industry experts, especially from women leaders in the field, followed by job placement assistance with leading companies. By 2025, the cybersecurity sector in India will have an estimated 1.5 million job vacancies. This represents a 42% talent shortage even as cybersecurity job growth is projected to grow by 32% by 2028, according to India’s Labor Bureau. The demand is there, but more must be done to meet it; most higher-education and technical institutes do not offer cybersecurity courses.

That’s why we have also partnered with ICT Academy, a nonprofit partner in India, to develop cybersecurity training programs for educators and higher-education students at 100 institutions in five states, with an emphasis on rural colleges. Through this initiative, CyberShikshaa for Educators, we’ll help more faculty become cybersecurity trainers, and then provide students cybersecurity training and job placement assistance to help them find new careers. In the first phase, we aim to train about 6,000 students and will then work with our partner network to connect students to job opportunities and internships.

A look at our U.S. progress – and a look to the future
In the five months since we announced our U.S. cybersecurity skills for jobs campaign, we are making progress. Today, we are working with 135 U.S. community colleges, providing access to free curriculum, educator training and tools for teaching. We’re sharing cybersecurity best practices with schools through the American Association of Community Colleges, the first of three cohorts we are providing grants for funding technical assistance to accelerate their cybersecurity programs. Finally, we’re granting scholarships to students seeking a degree or certification in a cybersecurity field. We are learning a lot and will share more in the months to come.

The number of cybersecurity attacks around the world is increasing every day, and increasing in complexity as cybercriminals continue to escalate their activity. People will be impacted no matter where they live. It’s critical that we invest in the cybersecurity workforce to ensure there are enough people with the skills needed to thwart these attacks and protect the digital ecosystem to keep organizations secure and people safe.

Tags: cybersecurity, diversity, education

In recent weeks, Microsoft Security teams have been actively tracking a large-scale social engineering and extortion campaign against multiple organizations with some seeing evidence of destructive elements. As this campaign has accelerated, our teams have been focused on detection, customer notifications, threat intelligence briefings, and sharing with our industry collaboration partners to understand the actor’s tactics and targets. Over time, we have improved our ability to track this actor and helped customers minimize the impact of active intrusions and in some cases worked with impacted organizations to stop attacks prior to data theft or destructive actions. Microsoft is committed to providing visibility into the malicious activity we’ve observed and sharing insights and knowledge of actor tactics that might be useful for other organizations to protect themselves. While our investigation into the most recent attacks is still in progress, we will continue to update this blog when we have more to share.

The activity we have observed has been attributed to a threat group that Microsoft tracks as DEV-0537, also known as LAPSUS$. DEV-0537 is known for using a pure extortion and destruction model without deploying ransomware payloads. DEV-0537 started targeting organizations in the United Kingdom and South America but expanded to global targets, including organizations in government, technology, telecom, media, retail, and healthcare sectors. DEV-0537 is also known to take over individual user accounts at cryptocurrency exchanges to drain cryptocurrency holdings.

Unlike most activity groups that stay under the radar, DEV-0537 doesn’t seem to cover its tracks. They go as far as announcing their attacks on social media or advertising their intent to buy credentials from employees of target organizations. DEV-0537 also uses several tactics that are less frequently used by other threat actors tracked by Microsoft. Their tactics include phone-based social engineering; SIM-swapping to facilitate account takeover; accessing personal email accounts of employees at target organizations; paying employees, suppliers, or business partners of target organizations for access to credentials and multifactor authentication (MFA) approval; and intruding in the ongoing crisis-communication calls of their targets.

The social engineering and identity-centric tactics leveraged by DEV-0537 require detection and response processes that are similar to insider risk programs–but also involve short response timeframes needed to deal with malicious external threats. In this blog, we compile the tactics, techniques, and procedures (TTPs) we’ve observed across multiple attacks and compromises. We also provide baseline risk mitigation strategies and recommendations to help organizations harden their organization’s security against this unique blend of tradecraft.

Analysis

The actors behind DEV-0537 focused their social engineering efforts to gather knowledge about their target’s business operations. Such information includes intimate knowledge about employees, team structures, help desks, crisis response workflows, and supply chain relationships. Examples of these social engineering tactics include spamming a target user with multifactor authentication (MFA) prompts and calling the organization’s help desk to reset a target’s credentials.

Microsoft Threat Intelligence Center (MSTIC) assesses that the objective of DEV-0537 is to gain elevated access through stolen credentials that enable data theft and destructive attacks against a targeted organization, often resulting in extortion. Tactics and objectives indicate this is a cybercriminal actor motivated by theft and destruction.

While this actor’s TTPs and infrastructure are constantly changing and evolving, the following sections provide additional details on the very diverse set of TTPs we have observed that DEV-0537 is using.

Initial access

DEV-0537 uses a variety of methods that are typically focused on compromising user identities to gain initial access to an organization including:

• Deploying the malicious Redline password stealer to obtain passwords and session tokens
• Purchasing credentials and session tokens from criminal underground forums
• Paying employees at targeted organizations (or suppliers/business partners) for access to credentials and MFA approval
• Searching public code repositories for exposed credentials

Using the compromised credentials and/or session tokens, DEV-0537 accesses internet-facing systems and applications. These systems most commonly include virtual private network (VPN), remote desktop protocol (RDP), virtual desktop infrastructure (VDI) including Citrix, or Identity providers (including Azure Active Directory, Okta). For organizations using MFA security, DEV-0537 used two main techniques to satisfy MFA requirements–session token replay and using stolen passwords to trigger simple-approval MFA prompts hoping that the legitimate user of the compromised account eventually consents to the prompts and grants the necessary approval.

In some cases, DEV-0537 first targeted and compromised an individual’s personal or private (non-work-related) accounts giving them access to then look for additional credentials that could be used to gain access to corporate systems. Given that employees typically use these personal accounts or mobile phone numbers as their second-factor authentication or password recovery, the group would often use this access to reset passwords and complete account recovery actions.

Microsoft also found instances where the group successfully gained access to target organizations through recruited employees (or employees of their suppliers or business partners). DEV-0537 advertised that they wanted to buy credentials for their targets to entice employees or contractors to take part in its operation. For a fee, the willing accomplice must provide their credentials and approve the MFA prompt or have the user install AnyDesk or other remote management software on a corporate workstation allowing the actor to take control of an authenticated system. Such a tactic was just one of the ways DEV-0537 took advantage of the security access and business relationships their target organizations have with their service providers and supply chains. 

In other observed activity, DEV-0537 actors performed a SIM-swapping attack to access a user’s phone number before signing into the corporate network. This method allows the actors to handle phone-based authentication prompts they need to gain access to a target.  

Once standard user credentials or access was obtained, DEV-0537 typically connected a system to an organization’s VPN. In some cases, to meet conditional access requirements, DEV-0537 registered or joined the system to the organization’s Azure Active Directory (Azure AD).

Reconnaissance and privilege escalation

Once DEV-0537 obtained access to the target network using the compromised account, they used multiple tactics to discover additional credentials or intrusion points to extend their access including:

• Exploiting unpatched vulnerabilities on internally accessible servers including JIRA, Gitlab, and Confluence
• Searching code repositories and collaboration platforms for exposed credentials and secrets

They have been consistently observed to use AD Explorer, a publicly available tool, to enumerate all users and groups in the said network. This allows them to understand which accounts might have higher privileges. They then proceeded to search collaboration platforms like SharePoint or Confluence, issue-tracking solutions like JIRA, code repositories like GitLab and GitHub, and organization collaboration channels like Teams or Slack to discover further high-privilege account credentials to access other sensitive information.

DEV-0537 is also known to exploit vulnerabilities in Confluence, JIRA, and GitLab for privilege escalation. The group compromised the servers running these applications to get the credentials of a privileged account or run in the context of the said account and dump credentials from there. The group used DCSync attacks and Mimikatz to perform privilege escalation routines. Once domain administrator access or its equivalent has been obtained, the group used the built-in ntdsutil utility to extract the AD database.

In some cases, DEV-0537 even called the organization’s help desk and attempted to convince the support personnel to reset a privileged account’s credentials. The group used the previously gathered information (for example, profile pictures) and had a native-English-sounding caller speak with the help desk personnel to enhance their social engineering lure. Observed actions have included DEV-0537 answering common recovery prompts such as “first street you lived on” or “mother’s maiden name” to convince help desk personnel of authenticity. Since many organizations outsource their help desk support, this tactic attempts to exploit those supply chain relationships, especially where organizations give their help desk personnel the ability to elevate privileges.

Exfiltration, destruction, and extortion

Based on our observation, DEV-0537 has dedicated infrastructure they operate in known virtual private server (VPS) providers and leverage NordVPN for its egress points. DEV-0537 is aware of detections such as impossible travel and thus picked VPN egress points that were geographically like their targets. DEV-0537 then downloaded sensitive data from the targeted organization for future extortion or public release to the system joined to the organization’s VPN and/or Azure AD-joined system.

DEV-0537 has been observed leveraging access to cloud assets to create new virtual machines within the target’s cloud environment, which they use as actor-controlled infrastructure to perform further attacks across the target organization.

If they successfully gain privileged access to an organization’s cloud tenant (either AWS or Azure), DEV-0537 creates global admin accounts in the organization’s cloud instances, sets an Office 365 tenant level mail transport rule to send all mail in and out of the organization to the newly created account, and then removes all other global admin accounts, so only the actor has sole control of the cloud resources, effectively locking the organization out of all access. After exfiltration, DEV-0537 often deletes the target’s systems and resources. We’ve observed deletion of resources both on-premises (for example, VMware vSphere/ESXi) and in the cloud to trigger the organization’s incident and crisis response process.

The actor has been observed then joining the organization’s crisis communication calls and internal discussion boards (Slack, Teams, conference calls, and others) to understand the incident response workflow and their corresponding response. It is assessed this provides DEV-0537 insight into the victim’s state of mind, their knowledge of the intrusion, and a venue to initiate extortion demands. Notably, DEV-0537 has been observed joining incident response bridges within targeted organizations responding to destructive actions. In some cases, DEV-0537 has extorted victims to prevent the release of stolen data, and in others, no extortion attempt was made and DEV-0537 publicly leaked the data they stole.

Impact

Early observed attacks by DEV-0537 targeted cryptocurrency accounts resulting in compromise and theft of wallets and funds. As they expanded their attacks, the actors began targeting telecommunication, higher education, and government organizations in South America. More recent campaigns have expanded to include organizations globally spanning a variety of sectors. Based on observed activity, this group understands the interconnected nature of identities and trust relationships in modern technology ecosystems and targets telecommunications, technology, IT services and support companies–to leverage their access from one organization to access the partner or supplier organizations. They have also been observed targeting government entities, manufacturing, higher education, energy, retailers, and healthcare.

Microsoft will continue to monitor DEV-0537 activity and implement protections for our customers. The current detections and advanced detections in place across our security products are detailed in the following sections.

Actor actions targeting Microsoft

This week, the actor made public claims that they had gained access to Microsoft and exfiltrated portions of source code. No customer code or data was involved in the observed activities. Our investigation has found a single account had been compromised, granting limited access. Our cybersecurity response teams quickly engaged to remediate the compromised account and prevent further activity. Microsoft does not rely on the secrecy of code as a security measure and viewing source code does not lead to elevation of risk. The tactics DEV-0537 used in this intrusion reflect the tactics and techniques discussed in this blog. Our team was already investigating the compromised account based on threat intelligence when the actor publicly disclosed their intrusion. This public disclosure escalated our action allowing our team to intervene and interrupt the actor mid-operation, limiting broader impact.

Recommendations

Strengthen MFA implementation

Multifactor authentication (MFA) is one of the primary lines of defense against DEV-0537. While this group attempts to identify gaps in MFA, it remains a critical pillar in identity security for employees, vendors, and other personnel alike. See the following recommendations to implement MFA more securely:

Do:

• Require Multifactor Authenticator for all users coming from all locations including perceived trusted environments, and all internet-facing infrastructure–even those coming from on-premises systems.
• Leverage more secure implementations such as FIDO Tokens, or the Microsoft Authenticator with number matching. Avoid telephony-based MFA methods to avoid risks associated with SIM-jacking.
• Use Azure AD Password Protection to ensure that users aren’t using easily-guessed passwords. Our blog about password spray attacks outlines additional recommendations.
• Leverage passwordless authentication methods such as Windows Hello for Business, Microsoft Authenticator, or FIDO tokens to reduce risks and user experience issues associated with passwords.

Do NOT:

• Use weak MFA factors such as text messages (susceptible to SIM swapping), simple voice approvals, simple push (instead, use number matching), or secondary email addresses.
• Include location-based exclusions. MFA exclusions allow an actor with only one factor for a set of identities to bypass the MFA requirements if they can fully compromise a single identity.
• Allow credential or MFA factor sharing between users.

Require healthy and trusted endpoints

• Require trusted, compliant, and healthy devices for access to resources to prevent data theft.
• Turn on cloud-delivered protection in Microsoft Defender Antivirus to cover rapidly evolving attacker tools and techniques, block new and unknown malware variants, and enhance attack surface reduction rules and tamper protection.

Leverage modern authentication options for VPNs

VPN authentication should leverage modern authentication options such as OAuth or SAML connected to Azure AD to enable risk-based sign-in detection. Modern authentication enables blocking authentication attempts based on sign-in risk, requiring compliant devices for sign in, and tighter integration with your authentication stack to provide more accurate risk detections. Implementation of modern authentication and tight conditional access policies on VPN has been shown to be effective against DEV-0537’s access tactics.

Strengthen and monitor your cloud security posture

DEV-0537 leverages legitimate credentials to perform malicious actions against customers. Since these credentials are legitimate, some activity performed might seem consistent with standard user behavior. Use the following recommendations to improve your cloud security posture:

Improve awareness of social engineering attacks

Microsoft recommends raising and improving awareness of social engineering tactics to protect your organization. Educate members of your technical team to watch out for and report any unusual contacts with colleagues. IT help desks should be hypervigilant about suspicious users and ensure that they are tracked and reported immediately. We recommend reviewing help desk policies for password resets for highly privileged users and executives to take social engineering into consideration.

Embed a culture of security awareness in your organization by educating employees about help desk verification practices. Encourage them to report suspicious or unusual contacts from the help desk. Education is the number one defense against social engineering attacks such as this one and it is important to make sure that all employees are aware of the risks and known tactics.

Establish operational security processes in response to DEV-0537 intrusions

DEV-0537 is known to monitor and intrude in incident response communications. As such, these communication channels should be closely monitored for unauthorized attendees and verification of attendees should be performed visually or audibly.

We advise organizations to follow very tight operational security practices when responding to an intrusion believed to be DEV-0537. Organizations should develop an out-of-band communication plan for incident responders that is usable for multiple days while an investigation occurs. Documentation of this response plan should be closely held and not easily accessible.

Microsoft continues to track DEV-0537’s activities, tactics, malware, and tools. We will communicate any additional insights and recommendations as we investigate their actions against our customers.