A Russian government-linked hacking group took aim at dozens of global organizations with a campaign to steal login credentials by engaging users in Microsoft Teams chats pretending to be from technical support, Microsoft researchers said on Wednesday.<\/p>\n
These \u201chighly targeted\u201d social engineering attacks have affected \u201cfewer than 40 unique global organizations\u201d since late May, Microsoft researchers said in a blog, adding that the company was investigating, reports AlArabiya news.<\/p>\n
The Russian embassy in Washington didn\u2019t immediately respond to a request for comment.<\/p>\n
The hackers set up domains and accounts that looked like technical support and tried to engage Teams users in chats and get them to approve multifactor authentication (MFA) prompts, the researchers said.<\/p>\n
\u201cMicrosoft has mitigated the actor from using the domains and continues to investigate this activity and work to remediate the impact of the attack,\u201d they added.<\/p>\n
MFAs are a widely recommended security measure aimed at preventing hacking or stealing of credentials. The Teams targeting suggests hackers are finding new ways to get past it.<\/p>\n
The hacking group behind this activity, known in the industry as Midnight Blizzard or APT29, is based in Russia and the UK and US governments have linked it to the country\u2019s foreign intelligence service, the researchers said.<\/p>\n
\u201cThe organizations targeted in this activity likely indicate specific espionage objectives by Midnight Blizzard directed at government, non-government organizations (NGOs), IT services, technology, discrete manufacturing, and media sectors,\u201d they said, without naming any of the targets.<\/p>\n
\u201cThis latest attack, combined with past activity, further demonstrates Midnight Blizzard\u2019s ongoing execution of their objectives using both new and common techniques,\u201d the researchers wrote.<\/p>\n
Midnight Blizzard has been known to target such organizations, mainly in the US and Europe, going back to 2018, they added.<\/p>\n
The hackers used already-compromised Microsoft 365 accounts owned by small businesses to make new domains that appeared to be technical support entities and had the word \u201cMicrosoft\u201d in them, according to details in the Microsoft blog. Accounts tied to these domains then sent phishing messages to bait people via Teams, the researchers said.<\/p>\n","protected":false},"excerpt":{"rendered":"
A Russian government-linked hacking group took aim at dozens of global organizations with a campaign to steal login credentials by engaging users in Microsoft Teams chats pretending to be from technical support, Microsoft researchers said on Wednesday. These \u201chighly targeted\u201d social engineering attacks have affected \u201cfewer than 40 unique global organizations\u201d since late May, Microsoft […]<\/p>\n","protected":false},"author":16,"featured_media":135223,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2,39],"tags":[],"class_list":["post-135222","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-featured","category-technology"],"yoast_head":"\n