Security News > 2024 > February > Russian hackers shift to cloud attacks, US and allies warn

Members of the Five Eyes intelligence alliance warned today that APT29 Russian Foreign Intelligence Service hackers are now switching to attacks targeting their victims' cloud services.

The Russian cyberspies also compromised Microsoft 365 accounts belonging to various entities within NATO nations to obtain foreign policy-related data and targeted governments, embassies, and senior officials throughout Europe associated in a string of phishing attacks.

Today, a joint advisory issued by the U.K.'s National Cyber Security Centre, the NSA, CISA, the FBI, and cybersecurity agencies from Australia, Canada, and New Zealand warned that the Russian threat group is gradually moving to attacks against cloud infrastructure.

As the Five Eyes agencies found, APT29 hackers are now gaining access to their targets' cloud environments using access service account credentials compromised in brute forcing or password spraying attacks.

APT29's initial cloud breach vectors also include the use of stolen access tokens that enable them to hijack accounts without using credentials, compromised residential routers to proxy their malicious activity, MFA fatigue to bypass multi-factor authentication, and registering their own devices as new devices on the victims' cloud tenants.

HPE: Russian hackers breached its security team's email accounts.

News URL

https://www.bleepingcomputer.com/news/security/russian-hackers-shift-to-cloud-attacks-us-and-allies-warn/