# data[].attributes.headline
What are some of the most common ways social engineering affects cybersecurity?

# data[].attributes.subject
What are some of the most common ways social engineering affects cybersecurity?

# data[].attributes.body
Social engineering works by manipulating people into a sense of trust where they then reveal confidential or private information. There are several ways attackers use social engineering to gain information.

Phishing attacks: Emails and texts can appear to be sent from a trusted source, however, by clicking on links or opening attachments, malware or spyware can be introduced into a system where attackers can then collect sensitive information.

Vishing attacks: Phone calls and video calls where an attacker appears to be someone familiar or someone representing someone familiar is a type of attack known as vishing. Call and video chats like this make a user feel safe and trusting, and consequently more likely to share personal information. Attackers of this type will often ask for money transfers or access to accounts.

Pretexting: Pretexting is similar to vishing, but in this scenario attackers gain trust by impersonating authority figures or tech support workers and then persuading users to download files and attachments that contain malware or grant access to systems and accounts.

# data[].attributes.headline
What can we do to help prevent attackers from leveraging social engineering for their own benefit?

# data[].attributes.subject
What can we do to help prevent attackers from leveraging social engineering for their own benefit?

# data[].attributes.body
It is difficult to teach people how to spot social engineering attacks, but there are a few approaches that can help. By training employees to be aware, social engineering threats can be less likely.

Be skeptical: If an employee receives an email, phone call, message, or voice mail, even if it appears legitimate, be wary and consider what exactly is being asked. If a message seems urgent or pressuring, take a step back and consider the message.

Verify information: Never click on links or attachments, and never grant access or give out information until the sender has been verified and the information is correct. Contact the individual directly, if possible.

Protect private information: Do not give out information that is private or confidential to someone who does not need to have it. Ask yourself, is this necessary? Why is this exchange important?

# data[].attributes.headline
How do cyber attackers leverage social engineering to go after a target?

# data[].attributes.subject
How do cyber attackers leverage social engineering to go after a target?

# data[].attributes.body
Attackers can use many steps and processes in layers to develop a social engineering attack.

To build trust and seem legitimate, attackers will research a victim to gather information. By collecting publicly available data, attackers can learn names and relationships and work place details easily. Social media is a large collection of information that can be used for this type of reconnaissance. Phishing attempts and malware can also be used for collecting information to build personal profiles on victims.

Attackers then use the data that has been collected to build rapport and trust with a victim. They personalize their approach to involve family members, coworkers, or groups that are associated with the victims.

By feeling a sense of trust with the attacker, a victim will often give personal information and details, assuming they are interacting with a friend or someone they know.

# data[].attributes.headline
video/article: Social Engineering Attack on North Dakota University

# data[].attributes.subject
video/article: Social Engineering Attack on North Dakota University

# data[].attributes.attachment_link.readable_text
BISMARCK, N.D. (KFYR) - A lot of financial transfers are made online and this can leave humans and organizations susceptible to phishing schemes.

The North Dakota University System was attacked by a social engineering scheme last month and it had the potential to cost NDSU and BSC $5.1 million.

Social engineering is when someone is tricked into releasing information to be used for fraudulent purposes. Fortunately, this transaction was caught and stopped before it was processed.

"No money's been lost, no taxpayer money, no student money's been lost. This is the world we live in, and that's, it's called human hacking, or social engineering," said Mark R. Hagerott, chancellor for the North Dakota University System.

The university system has training in place to catch these schemes, but a campus employee made an error.

"All of us should be alert that there are attempts made for you to give out your checking account numbers, your credit card numbers. So they do the same thing to the employees of the university system, which is a literally multibillion-dollar system, billions of dollars and infrastructure," said Hagerott.

He says now the state board will be reviewing the incident. They will also look at the training protocol for employees within the State University System, and see what changes need to be made.

Roughly $3.8 million could have been taken from NDSU and $1.3 million could have been taken from BSC.

# data[].attributes.attachment_link.title
Social engineering attack on the North Dakota University System

# data[].attributes.attachment_link.description
Social engineering is when someone is tricked into releasing information to be used for fraudulent purposes.

# data[].attributes.headline
article: European retailer Pepco loses €15.5 million in phishing attack

# data[].attributes.subject
article: European retailer Pepco loses €15.5 million in phishing attack

# data[].attributes.attachment_link.title
European retailer Pepco loses €15.5 million in phishing (possibly BEC?) attack - Help Net Security

# data[].attributes.attachment_link.description
Pepco Group has confirmed that its Hungarian business has been hit by a “sophisticated fraudulent phishing attack.”

# data[].attributes.headline
article: Midnight Blizzard conducts targeted social engineering over Microsoft Teams

# data[].attributes.subject
article: Midnight Blizzard conducts targeted social engineering over Microsoft Teams

# data[].attributes.attachment_link.readable_text
Microsoft Threat Intelligence has identified highly targeted social engineering attacks using credential theft phishing lures sent as Microsoft Teams chats by the threat actor that Microsoft tracks as Midnight Blizzard (previously tracked as NOBELIUM). This latest attack, combined with past activity, further demonstrates Midnight Blizzard's ongoing execution of their objectives using both new and common techniques. In this latest activity, the threat actor uses previously compromised Microsoft 365 tenants owned by small businesses to create new domains that appear as technical support entities. Using these domains from compromised tenants, Midnight Blizzard leverages Teams messages to send lures that attempt to steal credentials from a targeted organization by engaging a user and eliciting approval of multifactor authentication (MFA) prompts. As with any social engineering lures, we encourage organizations to reinforce security best practices to all users and reinforce that any authentication requests not initiated by the user should be treated as malicious.

Our current investigation indicates this campaign has affected fewer than 40 unique global organizations. The organizations targeted in this activity likely indicate specific espionage objectives by Midnight Blizzard directed at government, non-government organizations (NGOs), IT services, technology, discrete manufacturing, and media sectors. Microsoft has mitigated the actor from using the domains and continues to investigate this activity and work to remediate the impact of the attack. As with any observed nation-state actor activity, Microsoft has directly notified targeted or compromised customers, providing them with important information needed to secure their environments.

Midnight Blizzard ( NOBELIUM) is a Russia-based threat actor attributed by the US and UK governments as the Foreign Intelligence Service of the Russian Federation, also known as the SVR. This threat actor is known to primarily target governments, diplomatic entities, non-government organizations (NGOs), and IT service providers primarily in the US and Europe. Their focus is to collect intelligence through longstanding and dedicated espionage of foreign interests that can be traced to early 2018. Their operations often involve compromise of valid accounts and, in some highly targeted cases, advanced techniques to compromise authentication mechanisms within an organization to expand access and evade detection.

Midnight Blizzard is consistent and persistent in their operational targeting, and their objectives rarely change. They utilize diverse initial access methods ranging from stolen credentials to supply chain attacks, exploitation of on-premises environments to laterally move to the cloud, exploitation of service providers' trust chain to gain access to downstream customers, as well as the Active Directory Federation Service (AD FS) malware known as FOGGYWEB and MAGICWEB. Midnight Blizzard (NOBELIUM) is tracked by partner security vendors as APT29, UNC2452, and Cozy Bear.

Midnight Blizzard's latest credential phishing attack

Midnight Blizzard regularly utilizes token theft techniques for initial access into targeted environments, in addition to authentication spear-phishing, password spray, brute force, and other credential attacks. The attack pattern observed in malicious activity since at least late May 2023 has been identified as a subset of broader credential attack campaigns that we attribute to Midnight Blizzard.

Use of security-themed domain names in lures

To facilitate their attack, the actor uses Microsoft 365 tenants owned by small businesses they have compromised in previous attacks to host and launch their social engineering attack. The actor renames the compromised tenant, adds a new onmicrosoft.com subdomain, then adds a new user associated with that domain from which to send the outbound message to the target tenant. The actor uses security-themed or product name-themed keywords to create a new subdomain and new tenant name to lend legitimacy to the messages. These precursory attacks to compromise legitimate Azure tenants and the use of homoglyph domain names in social engineering lures are part of our ongoing investigation. Microsoft has mitigated the actor from using the domains.

Social engineering attack chain

In this activity, Midnight Blizzard either has obtained valid account credentials for the users they are targeting, or they are targeting users with passwordless authentication configured on their account - both of which require the user to enter a code that is displayed during the authentication flow into the prompt on the Microsoft Authenticator app on their mobile device.

After attempting to authenticate to an account where this form of MFA is required, the actor is presented with a code that the user would need to enter in their authenticator app. The user receives the prompt for code entry on their device. The actor then sends a message to the targeted user over Microsoft Teams eliciting the user to enter the code into the prompt on their device.
Step 1: Teams request to chat
The target user may receive a Microsoft Teams message request from an external user masquerading as a technical support or security team.

Step 2: Request authentication app action
If the target user accepts the message request, the user then receives a Microsoft Teams message from the attacker attempting to convince them to enter a code into the Microsoft Authenticator app on their mobile device.

Step 3: Successful MFA authentication
If the targeted user accepts the message request and enters the code into the Microsoft Authenticator app, the threat actor is granted a token to authenticate as the targeted user. The actor gains access to the user's Microsoft 365 account, having completed the authentication flow.

The actor then proceeds to conduct post-compromise activity, which typically involves information theft from the compromised Microsoft 365 tenant. In some cases, the actor attempts to add a device to the organization as a managed device via Microsoft Entra ID (formerly Azure Active Directory), likely an attempt to circumvent conditional access policies configured to restrict access to specific resources to managed devices only.

Recommendations

Microsoft recommends the following mitigations to reduce the risk of this threat.

Indicators of compromise

Hunting guidance

Microsoft Purview

Customers hunting for related activity in their environment can identify users that were targeted with the phishing lure using content search in Microsoft Purview. A content search can be created for selected Exchange mailboxes (which include Teams messages) using the following keywords (remove the [] around the "." before use):

mlcrosoftaccounts.onmicrosoft[.]com

msftonlineservices.onmicrosoft[.]com

msonlineteam.onmicrosoft[.]com

msftservice.onmicrosoft[.]com

noreplyteam.onmicrosoft[.]com

accounteam.onmicrosoft[.]com

teamsprotection.onmicrosoft[.]com

identityverification.onmicrosoft[.]com

msftprotection.onmicrosoft[.]com

accountsverification.onmicrosoft[.]com

azuresecuritycenter.onmicrosoft[.]com

We detected a recent change to your preferred Multi-Factor Authentication (MFA)

The search results will include the messages that match the criteria. The first result will appear to be from <threadid>@unq.gbl.spaces addressed to the target user and the threat actor (i.e., the request to chat as described in Step 1), followed by the message sent by the threat actor, as shown in the Microsoft Purview image below:

Microsoft Sentinel

Microsoft Sentinel customers can use the TI Mapping analytics (a series of analytics all prefixed with "TI map") to automatically match indicators associated with Midnight Blizzard in Microsoft Defender Threat Intelligence with data in their workspace. If the TI Map analytics are not currently deployed, customers can install the Threat Intelligence solution from the Microsoft Sentinel Content Hub to have the Defender Threat Intelligence connector and analytics rule deployed in their Sentinel workspace. Learn more about the Content Hub.

Microsoft Sentinel also has a range of detection and threat hunting content that customers can use to detect activity related to the activity described in this blog:

Further reading

Read about the threat actor Midnight Blizzard (formerly tracked as NOBELIUM).

For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog: https://aka.ms/threatintelblog.

To get notified about new publications and to join discussions on social media, follow us on Twitter at https://twitter.com/MsftSecIntel.

# data[].attributes.attachment_link.title
Midnight Blizzard conducts targeted social engineering over Microsoft Teams | Microsoft Security Blog

# data[].attributes.attachment_link.description
Microsoft Threat Intelligence has identified highly targeted social engineering attacks using credential theft phishing lures sent as Microsoft Teams chats by the threat actor that Microsoft tracks as Midnight Blizzard (previously tracked as NOBELIUM).

# data[].attributes.headline
article: MGM and Caesars Attacks Highlight Social Engineering Risks

# data[].attributes.subject
article: MGM and Caesars Attacks Highlight Social Engineering Risks

# data[].attributes.attachment_link.readable_text
The cyberattacks on MGM Resorts International and Caesars Entertainment exposed the widespread effects data breaches can have on an organization - operationally, reputationally, and financially. Although many questions around the specific attack remain, that hackers found enough of an MGM's employee's data on LinkedIn to arm themselves with the right knowledge to call the help desk and impersonate the employee, convincing MGM's IT help desk to obtain that employee's sign-in credentials. reports say

What is the root cause of this breach? This attack, as well as so many other high-profile breaches over the past few years, happened because of our continued reliance on legacy sign-in credentials like passwords and SMS one-time passcodes that can be easily given away and reused.

Phishing Attacks Aren't New, but More Successful

Phishing and social engineering attacks to obtain users' passwords are, of course, nothing new. But now in the age of multifactor authentication (MFA) bypass toolkits and generative AI, these types of attacks have risen in success and popularity with cybercriminals. Attacks can be automated and emails and text messages can appear much more legitimate, which mean more tricked victims. This is what happened with MGM - it takes just a matter of minutes for a hacker to dupe an organization's help desk into handing over credentials by establishing trust.

In the past, many organizations depended on training to defend against phishing and other social-engineering attacks. These efforts are certainly well-intended, but the fact is that measures like coaching employees to identify poor grammar, misspelled words, and strange spacing as indicators of a phishing email are just not effective in today's landscape.

The rise of generative AI combined with easily bypassable legacy forms of MFA have created a cybersecurity threat that cannot be trained away. The threat cannot be overcome unless we make the sign-in credentials these cybercriminals so desperately want much harder - if not impossible - to give away.

Authentication Needs More Than Just Passwords

The Cyber Safety Review Board (CSRB) came to a similar conclusion in its recently released with findings from the , another string of social engineering attacks that hit large organizations. In its recommendations to protect against similar attacks, the CSRB suggests organizations move to phishing-resistant authentication, namely Fast Identity Online (FIDO) passwordless authentication. Lapsus$ attacks

Phishing-resistant authentication uses cryptography techniques that require possession of a device for sign-in or account recovery. This approach ensures that a help desk or other employee (or a family member or friend in consumer settings) cannot give away sign-in credentials even if they fall for a social-engineering attack. Organizations can combine phishing-resistant authentication with more advanced identity verification methods to arm IT departments and help desk employees to truly tell what is a legitimate account lockout and what is an attack.

Considering the high-profile nature of Lapsu$ and these recent ransomware attacks (along with the clear CSRB guidance), any organization that continues to widely rely on passwords and other knowledge-based credentials for user authentication is at best making a questionable choice, and at worst is opening itself up to accusations of corporate negligence.

Organizations must recognize that the cybersecurity landscape has changed dramatically over the past few years and is continuing to rapidly evolve in the age of generative AI. As the MGM breach demonstrates, companies that fail to implement a sound security strategy, starting with eliminating their dependence on passwords and knowledge-based credentials, are taking an unnecessary gamble that they will eventually lose.

# data[].attributes.attachment_link.title
MGM and Caesars Attacks Highlight Social Engineering Risks

# data[].attributes.attachment_link.description
Relying on passwords to secure user accounts is a gamble that never pays off.

# data[].attributes.headline
video: How teenagers hacked into Vegas casinos using 'social engineering'

# data[].attributes.subject
video: How teenagers hacked into Vegas casinos using 'social engineering'

# data[].attributes.attachment_link.title
How teenagers hacked into Vegas casinos using 'social engineering'

# data[].attributes.headline
video: We asked a hacker to try and steal a CNN tech reporter's data

# data[].attributes.subject
video: We asked a hacker to try and steal a CNN tech reporter's data