Microsoft warns over growing threat from Octo Tempest gang

Technically adept gang

Microsoft said Octo Tempest’s attacks were prolific and well-organised, demonstrating extensive technical expertise and multiple hands-on-keyboard operators doing its dirty work. It leverages a wide and growing number of tactics, techniques and procedures (TTPs).

Of these TTPs, several in particular stand out. The gang is particularly fond of social engineering attacks targeting IT support and helpdesk staffers in order to take advantage of their enhanced privilege levels. They extensively research such victims to identify and tailor attacks to their targets, using personal information to trick them, and even going so far as to mimic idiolect on phone calls to them.

In some instances, they also resort to particularly aggressive fear-mongering tactics. In screenshots shared by Microsoft, a gang member threatened one victim’s family. “If we don’t get your [redacted] login in the next 20 minutes were [sic] sending a shooter to your house,” they said. “Ur wife is gonna get shot if u don’t [sic] fold it [redacted].”

They also often escalate their privileges through traditional SIM swapping and taking over employee’s phone numbers to initiate self-service password resets, or socially engineering the helpdesk to reset admin passwords.

Once inside their victim environments, the gang performs various actions, including bulk-export of users, groups and device information and enumeration of data and resources available to the compromised user’s profile. They also enumerate data related to network architecture, employee onboarding, remote access methods, and credential policies and vaults, and seek to advance their access through multi-cloud environments, code repositories, server and backup management infrastructure among other things.

Additionally, the gang seeks to use its privileges to turn off security products and features and evade detection, and leverages publicly available security tools to establish persistence. On endpoints, to maintain persistence, they use a wide array of remote monitoring and management (RMM) tools.

The ultimate goal of all this is of course data theft, extortion and ransomware deployment using a variant of the ALPHV/BlackCat locker, and in common with most other ransomware gangs, the data it steals generally depends on what it is able to get access to.

Octo Tempest does, however, deploy a technique that has never been seen before, exploiting the Azure Data Factory platform and automated platform to exfiltrate its victims’ data to their own Secure File Transfer Protocol (SFTP) servers, by which method Microsoft believes they aim to blend in with legitimate big data operations. They have also been observed registering legitimate Microsoft 365 backup solutions, including CommVault and Veeam, to export SharePoint document libraries and expedite the exfiltration process.

Hunting Octo Tempest a challenge for defenders

Microsoft said that the gang’s use of techniques such as social engineering, living-off-the-land and its diverse array of toolsets makes hunting them particularly difficult.

However, there are a number of general guidelines that defenders can use to try to surface their activity, when combined with robust deconfliction with legitimate users. An array of more in-depth technical information on these techniques is available from Microsoft.