Microsoft said today that it removed 18 Azure Active Directory applications from its Azure portal that were created and abused by a Chinese state-sponsored hacker group.
The 18 Azure AD apps were taken down from the Azure portal earlier this year in April, the Microsoft threat intelligence team said in a report published today.
The report described the recent tactics used by a Chinese hacker group known as Gadolinium (aka APT40, or Leviathan).
The Azure apps were part of the group’s 2020 attack routine, which Microsoft described as “particularly challenging” to detect due to its multi-stage infection process and the broad use of PowerShell payloads.
These attacks began with spear-phishing emails aimed at the target organizations, carrying malicious documents, usually PowerPoint files with a COVID-19 theme.
Victims who opened one of these documents would be infected with PowerShell-based malware payloads. Here is where the malicious Azure AD apps would also come into play.
On infected computers, Microsoft said the Gadolinium hackers used the PowerShell malware to install one of the 18 Azure AD apps. The role of these apps was to automatically configure the victim’s endpoint “with the permissions needed to exfiltrate data to the attacker’s own Microsoft OneDrive storage.”
Image: Microsoft
By removing the 18 Azure AD apps, Microsoft crippled the Chinese hacker group’s attacks, at least for a short while, but it also forced the hackers to re-think and re-tool their attack infrastructure.
In addition, Microsoft said it also worked to take down a GitHub account that the same Gadolinium group had used as part of its 2018 attacks. This action may not have had an impact on new operations, but it did prevent the hackers from reusing the same account for other attacks in the future.
Microsoft’s actions against this Chinese hacker group aren’t an isolated case. Over the past few years, Microsoft has consistently intervened to take down malware infrastructure, may it have been used by low-level cybercrime operators or by high-end state-sponsored hacker groups.
In previous interventions, Microsoft also targeted the infrastructure used by other nation-state groups, tied to Iranian, North Korean, and Russian cyber-operations.
