Open Nav
Sign Up

Azure Cloud and Microsoft 365 Targeted Attacks

Bar Refael

February 13, 2024

An ongoing sophisticated cyber campaign has been identified, targeting Microsoft Azure corporate clouds and Microsoft 365 applications. This campaign has compromised dozens of environments and hundreds of individual user accounts, targeting senior executives and other strategic positions within organizations globally. The attackers employ tailor-made phishing techniques to exfiltrate data, commit financial fraud, and perform other malicious activities, indicating a high level of adaptability and sophistication.

Incident Overview

  • Affected Platforms: Microsoft Azure, Microsoft 365
  • Attack Vector: Phishing emails with shared documents containing malicious links aimed at stealing Microsoft 365 login credentials.
  • Target Demographics: Senior executives (e.g., VPs, CFOs, CEOs) and mid-level management with access to valuable resources or sensitive information.
  • Tactics, Techniques, and Procedures (TTPs): The attackers utilize a range of TTPs including data theft, financial fraud, impersonation, manipulation of multifactor authentication (MFA) settings, lateral movement within organizations, and the creation of inbox rules to hide their tracks.

Key Findings

  • The campaign leverages individualized phishing lures to gain initial access.
  • Post-compromise activities are diverse, ranging from financial fraud to sensitive data exfiltration.
  • Attackers show a preference for accounts that can serve as a pivot for further infiltration or have direct access to financial and sensitive corporate information.
  • A specific Linux user-agent has been identified as an indicator of compromise (IoC).

Recommendations for Mitigation

  • Vigilance Against Phishing: Organizations must educate their employees on recognizing phishing attempts and secure email gateways to filter out malicious emails.
  • Enhanced MFA Security: Review and secure MFA settings to prevent unauthorized changes by attackers. Consider employing additional authentication layers where feasible.
  • Password Hygiene: Enforce strong, unique passwords and regular password changes for all users, especially those with access to critical information.
  • Auto-remediation Policies: Implement policies that can automatically respond to and mitigate the effects of a compromise, limiting the potential damage.
  • Monitoring for IoCs: Continuously monitor network and cloud activity for indicators of compromise, especially the specific Linux user-agent associated with this campaign.

Conclusion

The sophistication and breadth of this campaign highlight the evolving threat landscape within cloud environments. Organizations must adopt a multi-faceted defense strategy that includes employee education, robust authentication measures, and proactive monitoring to defend against these advanced threats. The adaptability of threat actors necessitates an equally dynamic and comprehensive approach to cybersecurity.

Stay safe and informed,

OP Innovate.

Resources highlights

Our Red Team’s Favorite Penetration Testing Tools in 2025 (And How We Use Them)

When it comes to red team operations, the tools you choose can make or break the engagement. From initial reconnaissance to post-exploitation, having a streamlined,…

Read more >

pentesting tools - op

New Linux Vulnerabilities (CVE-2025-6018 & CVE-2025-6019) Enable Full Root Access in Seconds

Security researchers have uncovered a critical privilege escalation chain in major Linux distributions that allows any local user with a session (SSH or GUI) to…

Read more >

CVE-2025-6018, CVE-2025-6019

Zero to Hero: How Our Red Team Turned a Sticky Note Into Full Cloud Compromise

“The weakest link in your security chain might be sitting right on your desk.” At OP Innovate, our CREST-certified red team is trained to think…

Read more >

OP Innovate Red Team

One-Third of All Grafana Instances Vulnerable to XSS (CVE-2025-4123)

Over 46,000 internet-facing Grafana servers (≈36 % of those online) are still running versions susceptible to CVE-2025-4123, a high-severity open-redirect that chains into stored cross-site…

Read more >

CVE-2025-4123

New Microsoft Outlook Vulnerability Enables Local Code Execution (CVE-2025-47176)

Published: June 11, 2025 Threat Level: High Affected Product: Microsoft Outlook (Microsoft 365 Apps for Enterprise, Office LTSC 2024) CVSS Score: 7.8 (High) A newly…

Read more >

CVE-2025-47176

How MSSPs Are Turning Penetration Testing Into Recurring Revenue with WASP

When OP Innovate first launched WASP in 2022, we weren’t chasing unicorn status or massive VC rounds. We were focused on fixing a real problem:…

Read more >

Under Cyber Attack?

Fill out the form and we will contact you immediately.