New Phishing Campaign Targeting Governments and NGOs Using Microsoft Teams Device Code Phishing

A new and sophisticated phishing campaign has recently been discovered, leveraging Microsoft Teams video conferencing invitations to target governments, NGOs, and various industries across Europe, North America, Africa, and the Middle East. This campaign utilizes a tactic called device code phishing, which is designed to deceive victims into handing over valid access tokens, thus allowing attackers to gain unauthorized access to sensitive data such as emails, documents, and other confidential information.

The attack was uncovered by Microsoft, which issued a warning to affected organizations and users. Microsoft has linked the threat to a group tracked as Storm-2372, which has been associated with Russian cyber tactics and interests. In this article, we will delve deeper into the details of this attack, how device code phishing works, and the potential implications for organizations across various sectors.

What is Device Code Phishing?

Device code phishing is a type of phishing attack that exploits the authentication mechanisms commonly used by services like Microsoft Teams and other applications that rely on two-factor authentication (2FA) or similar security measures. Unlike traditional phishing attacks, which often involve fraudulent emails or fake websites designed to steal login credentials, device code phishing is more subtle and relies on tricking victims into entering authentication codes generated by the attacker.

In this campaign, the attacker sends a Microsoft Teams video conferencing invitation to the victim, prompting them to join a meeting. Once the victim clicks on the link, they are asked to enter a device code in a seemingly legitimate Microsoft login page. However, this page is controlled by the attacker. By entering the code, the victim unknowingly provides the attacker with valid access tokens, which can then be used to gain access to sensitive accounts and data.

The device code is a unique, one-time authentication code that is often used for logging into accounts from devices or applications that don’t have direct access to a user’s Microsoft account. When the victim enters this code, they are inadvertently handing over the access credentials required for the attacker to access their Microsoft services, including Outlook, OneDrive, and SharePoint, as well as sensitive organizational data.

How Does the Phishing Campaign Work?

The phishing campaign targeting Microsoft Teams is highly effective due to its use of familiar and trusted services like Microsoft Teams, which many organizations rely on for communication and collaboration. Here’s a step-by-step breakdown of how the attack typically works:

1. Initial Email or Teams Invitation: The attacker sends a legitimate-looking Teams meeting invitation to the target, which could come from an external or trusted internal source. The invitation appears to be a typical Teams meeting request, encouraging the victim to join the meeting.

2. Prompt to Enter Device Code: Once the victim clicks on the invitation link to join the meeting, they are redirected to a login page that asks them to enter a device code. This page may appear identical to the legitimate Microsoft login page, making it difficult for the victim to detect the scam.

3. Victim Enters Device Code: The victim enters the device code provided by the attacker, believing it to be a legitimate process to access the meeting.

4. Access Tokens Stolen: By entering the device code, the victim unknowingly grants the attacker access to their Microsoft account via a valid access token. This allows the attacker to bypass traditional login credentials, including username and password, and directly access the victim’s account.

5. Exfiltration of Data: With valid access, the attacker can view emails, calendar events, and any other sensitive data stored within the victim’s Microsoft 365 environment. The attacker may also exfiltrate files, install malicious software, or compromise the victim’s account further.

The Impact on Governments, NGOs, and Other Organizations

The fact that this phishing campaign targets governments, NGOs, and various industries across multiple regions such as Europe, North America, Africa, and the Middle East underscores the severity and global reach of this threat. These organizations typically handle high-value information, including sensitive government data, diplomatic communications, and private sector intellectual property.

The impact of a successful device code phishing attack on these sectors can be catastrophic. Once attackers have access to the victim’s email account or Microsoft 365 environment, they can:

• Access Sensitive Government Data: For government organizations, this could mean access to classified information, communications between government officials, and potentially even diplomatic correspondence.

• Exfiltrate Private Sector Information: NGOs and businesses dealing with sensitive data could suffer significant breaches, with intellectual property or proprietary business information being stolen or leaked.

• Spread Malware or Ransomware: The attacker can use the compromised accounts to distribute malicious software within the organization’s network, potentially leading to the deployment of ransomware or other types of cyberattacks.

• Undermine Trust: A successful phishing attack undermines the trust between organizations, their stakeholders, and the public. For governments and NGOs, this can have a devastating impact on public perception, while businesses may face regulatory fines and reputational damage.

Storm-2372: The Russian Cyber Group Behind the Attack

Microsoft has assessed with a medium level of confidence that the group behind the device code phishing campaign is Storm-2372, a Russian cyber group known for conducting sophisticated and targeted cyberattacks. Storm-2372 has previously been linked to espionage campaigns that align with Russian tactics, often targeting government agencies, defense contractors, and entities of strategic importance.

Microsoft’s analysis of the attack suggests that the group’s primary motivation is to steal sensitive data that could provide intelligence on political, military, or economic matters. The use of Microsoft Teams as the vector for this phishing campaign is particularly notable, as it reflects the group’s ability to leverage trusted platforms to bypass traditional security measures.

The use of device code phishing also suggests that the attackers are continually evolving their techniques to evade detection and improve the effectiveness of their operations. The fact that the group has employed this method, which is less common than traditional phishing attacks, indicates a high level of sophistication in their approach.

What Can Organizations Do to Protect Themselves?

Given the growing sophistication of phishing attacks like the one described here, organizations must take proactive steps to protect themselves from device code phishing and other similar threats. Here are several strategies that can help reduce the risk:

1. Educate Employees and Users: Awareness training is crucial. Employees and users should be trained to recognize suspicious links, unusual login prompts, and unexpected Teams invitations. They should also be taught to verify the authenticity of meeting invitations before entering any codes or credentials.

2. Implement Multi-Factor Authentication (MFA): MFA is one of the most effective defenses against phishing. Even if attackers steal login credentials or access tokens, MFA adds an additional layer of security that requires a second form of verification.

3. Monitor for Unusual Activity: Regularly monitor account activity for any signs of suspicious behavior, such as logins from unexpected locations or devices. Implementing alerts for such anomalies can help detect phishing attacks early.

4. Use Anti-Phishing Tools: Employ anti-phishing and email filtering solutions that can block phishing attempts and suspicious emails before they reach the inbox. Tools that detect malicious links and attachments can prevent many phishing attacks from succeeding.

5. Update and Patch Systems: Ensure that all software and systems, including Microsoft Teams and other collaboration tools, are regularly updated and patched to fix any security vulnerabilities that attackers might exploit.

Conclusion: The Growing Threat of Device Code Phishing

The device code phishing campaign targeting governments, NGOs, and other organizations across multiple regions highlights the growing sophistication of cyber threats. By exploiting Microsoft Teams and relying on a method that bypasses traditional login processes, attackers are able to steal valuable access tokens and gain unauthorized access to sensitive data.

As cyber threats continue to evolve, organizations must remain vigilant and take proactive steps to protect themselves from this and other phishing tactics. With the involvement of advanced threat actors like Storm-2372, who align with Russian cyber interests, this campaign serves as a reminder of the importance of robust cybersecurity practices in an increasingly interconnected world.

SEO Keywords Used:

• Device code phishing

• Microsoft Teams phishing attack

• Storm-2372 Russian cyber group

• Phishing campaign targeting governments

• Phishing attack Microsoft 365

• Access tokens phishing

• Microsoft Teams security threat

• Anti-phishing tools

• Two-factor authentication Microsoft

• Microsoft Teams phishing Europe, North America

• Cyberattack on NGOs

• Phishing tactics and techniques