Today's IT world is more complex than it was a few years ago. The cloud has become an integral part of most companies' operations, bringing with it new security challenges. There is an ongoing battle between security experts and cybercriminals, who exploit the resulting complexity, vulnerabilities or negligence of administrators to gain information, money or achieve their other goals.
Recently, one of our clients became the target of an advanced attack. In his case, it was so-called Crypto Jacking. An attack that involves using computing power to mine cryptocurrencies. This leads to financial losses for organizations that incur costs related to the misuse of resources.
In our case it was, in a dozen hours, an amount of about 10,000 Euros. We also know of cases, customers who lost tens of thousands of euros before they realized that something was wrong.
How did we notice the incident?
Our support team noticed a sharp increase in costs, using Azure logs and analyzing alerts from the system. The cost limits had not yet been reached, but the increase was very dynamic. After a quick response, we identified administrative accounts and login attempts from different locations.
After identifying the problem, we took immediate action: we blocked the account of the selected admin and removed the Global Admin privileges. Despite the working MFA mechanism (multi-factor authentication), the suspected global admin account was not covered by it. We forced the re-registration of multi-component authentication. Then our administration team started logging into the suspicious resources in Azure, we removed all the resources that had been created in order to stop generating additional costs. This wasn't easy, as the script executed very quickly and ran across several Azure data centers. We had to remove the entire compromised machine at one point to stop this attack.
User account - access blocked
Once we identified the problem, we immediately blocked, including the ability to log into the account and reset all active sessions to cut off the attacker.
We noticed that the user logged into the Azure portal from Europe and the US. These four attempts allowed the hacker to run a deployment script that created resources in Azure. The attackers may have used phishing techniques or other social engineering methods to gain credentials.
Login attempts - address identification
We identified various login attempts, both successful and unsuccessful, to various services such as Azure Portal and Microsoft Azure CLI. In particular, we highlighted login attempts from a selection of suspicious IP addresses. We found no logins to accounts other than the administrator who was vacationing at the time. Perhaps this administrator left his login credentials somewhere, including his disclosed password.
Despite stating that the organization has multi-factor authentication implemented, the attackers managed to bypass this login and use the gained credentials to log in correctly. Perhaps a script was running afterwards, or the target was just cryptojacking, as our team did not notice other logins and other activity.
Steps of the incident - what did the attacker's script do?
The identified account had global administrator privileges. This posed a very high risk. We confirmed that the user-administrator from whose account the actions were performed was on vacation for the last day. He was traveling at the time of the attack, and it is worth emphasizing here that the attack was premeditated, and it is likely that the person who attacked knew that the user would not be able to take action. He will have very limited access to information about his actions, including, for example, popping up a login alert from another location, requesting authorization in the app, etc.
After successfully logging in, the hacker used a script to create resources across all Azure data centers. The script was programmed to operate unobtrusively and avoid detection by standard monitoring mechanisms. It created four resources at each location: Application Insights, Key Vault, Storage Account and Machine Learning workspace. These resources generated costs of €20000 per 24 hours.
Changes made by ISCG.
Additional inspections carried out by ISCG
We have conducted a number of additional checks to ensure that the environment is secure. We also identified risky user accounts in the organization that require further analysis.
After detecting and making sure we had the evidence secured, we removed the created resources from the subscription. We forced every global administrator and every MFA privileged role.
Current administrator roles
We conducted a review of all administrator roles in the client environment to ensure that only trusted accounts have the appropriate permissions.
Actions taken by the customer
The client took a number of actions, including reporting the attack to the local police, informing the CFO and legal department.
Security recommendations
Based on our analysis, we made a number of recommendations to the client to improve the security of their cloud environment. In particular, we recommended implementing multi-factor authentication for all privileged accounts and conducting a detailed security assessment. According to the 2022 report, attacks on cloud environments have increased by 300% over the past two years, highlighting the importance of regular security reviews and updates.
Although we did not find traces of operations on other accounts or operations in local AD, scenarios of multiple accounts being compromised and local AD being compromised are likely. As part of our cooperation with Microsoft, we requested cancellation of the generated account. In this case, we were able to undo 100% of costs. Microsoft publishes an article here that describes the path and conditions for cancelling the costs described: Nonpayment, fraud, and misuse - Partner Center | Microsoft Learn
Help improve company security
If you feel you need additional security support, contact our team. We perform both periodic security reviews, as well as cover our customers' environments with full 24-hour support on both the management and security side. We have a dedicated service for this, which we often extend to Microsoft Sentinel, which allows us to generate a faster response if your infrastructure is under attack.
- Support and development of Microsoft and Nintex based applications
- Application design and development including digital processes
- Invoice management
- Requisition management
- Contract management
- Modern Intranet
ISCG sp. z o.o.
Al. Jerozolimskie 178, 02-486 Warsaw
NIP: 5262798378
KRS: 0000220621
Phone