Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Identity Attack Watch: AD Security News, June 2023

semperis.com | incident | #cloud | #zero-day | #active-directory | #ransomware | #moveit | #news-roundup | #grafana | #azure-ad | #blackcat

Summary

June 2023 roundup: Clop's MOVEit zero-day attacks (NYC DOE, CalPERS, Genworth), Microsoft patching an Azure AD authorization flaw, Grafana fixing an auth bypass, and BlackCat hitting Reddit.
Published
Collected

original ↗

Related coverage

blog · projectblack.io
Should I Azure AD Sync/Entra Cloud Sync Domain Admins?
Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.
incident · semperis.com
Identity Attack Watch: January 2022
January 2022 roundup: phishing enrolled attacker devices into Azure AD tenants lacking enforced MFA; LockBit hit the French Ministry of Justice and European firms via GPO-based deployment; noPac can compromise DCs in seconds.
vulnerability · netspi.com
XSS Using Active Directory Automatic Provisioning
Azure AD SCIM provisioning synced user names into a web app without output encoding, giving script injection via the firstName field and a path to steal credentials with an imported JS file.
blog · netspi.com
Targeting Passwords for Managed and Federated Microsoft Accounts
Releases Invoke-ExternalDomainBruteforce, which detects whether a Microsoft domain is managed or federated, picks the right authentication flow, and automates password guessing against O365 and ADFS.
incident · semperis.com
Identity Attack Watch: AD Security News, September 2023
September 2023 roundup: Johnson Controls ransomware (Dark Angels ESXi encryptor), MOVEit victims in Canada and the US, Royal claiming Dallas, BlackCat hitting MGM, and APT33 spraying Entra ID.
incident · semperis.com
Identity Attack Watch: November 2022
November 2022 roundup: Sandworm spread RansomBoggs via domain controllers in Ukraine; LockBit hit Southampton County and Continental; Vice Society struck Cincinnati College; Black Basta hit Sobeys.
back