Unpatched SharePoint servers opened the door to multiple attackers, Microsoft finds

Microsoft's Detection and Response Team (DART) uncovered two separate, unrelated threat actors simultaneously operating inside the same victim network after unpatched on-premises SharePoint servers were exploited. Storm-2603 deployed ransomware using tools like Cloudflare Tunnel and Velociraptor, while a second actor used DLL sideloading, custom backdoors, and attempted Active Directory credential theft. The overlapping intrusions obscured each other, complicating detection and response. DART resolved the case by correlating identity, endpoint, and cloud telemetry. The investigation expanded to a second compromised organization. Key takeaways include prioritizing patching of internet-facing systems, centralizing telemetry, and maintaining tested incident response playbooks.

Nguồn: https://www.csoonline.com/article/4188359/unpatched-sharepoint-servers-opened-the-door-to-multiple-attackers-microsoft-finds.html. 8sync News chỉ tóm tắt và dẫn link; bản quyền nội dung thuộc tác giả và nguồn gốc.

Đề xuất cho bạn

The Next Web03 phút3 giờ trước

Klue says the hackers who stole its customer data are deleting it, but a second group has emerged with extortion demands

Klue, the market intelligence firm whose breach exposed customer data at LastPass, HackerOne, and others, says the original hacking group Icarus is now deleting the stolen data. However, a second unnamed hacker group claims to have obtained the data from Icarus and is extorting affected companies directly, demanding payment or threatening to leak everything. Icarus reportedly told Klue the second group only has data samples for a subset of customers, not the full dataset, and instructed Klue to tell customers not to pay the second group. The breach stemmed from a compromised third-party credential from 2022 that was never revoked, granting OAuth access to customers' Salesforce environments. Over a dozen companies including Gong, Jamf, HackerOne, and LastPass have confirmed they were affected.

#cyber