Stealthy Attack Could Hit 50 Percent of Large Office 365 Customers: Report

itman · Oct 6, 2017

Slow and Methodical Attack Targets Large Microsoft Office 365 Customers

A widescale, yet stealthy attack against Office 365 (O365) accounts started in May and is still continuing. It is a low-key attack that tries to hide under the radar, and is delivered by a small botnet of 83 IP addresses across 63 networks. The majority of IP addresses are registered in China, but the attack activity also originates from 15 other countries, such as Russia, Brazil, the US and Malaysia.

The attack was detected by Skyhigh Networks -- a cloud access security broker (CASB) -- and described in a blog post Thursday.

The attack is not a traditional brute force attack against O365 accounts, but a slow and methodical attack that tries to avoid highlighting its activity. "First, it targets a very small proportion (typically <2%) of the O365 account base," writes Sandeep Chandana, principal data scientist at Skyhigh. "Second, it is devoid of any bursts in hacking activity, and averages only 3-5 attempts per account in order to try and fly under the radar of traditional defenses."

"This campaign on Office 365 is particularly troubling due to its focus on system accounts that are essential for today's business automation, that typically do not require MFA and that traditionally have weak security oversight," explains Sekhar Sarukkai, chief scientist at Skyhigh. "Detection and protection from attacks on these 'weakest link' accounts require a cloud-native security approach for complete visibility and mitigation."
Click to expand...

http://www.securityweek.com/stealthy-attack-could-hit-50-percent-large-office-365-customers-report

Log in or Sign up

Stealthy Attack Could Hit 50 Percent of Large Office 365 Customers: Report

itman Registered Member

Log in or Sign up

Stealthy Attack Could Hit 50 Percent of Large Office 365 Customers: Report

itman Registered Member

Useful Searches