Microsoft has recently discovered another type of malware, named FoggyWeb by Microsoft, that hackers are currently using to remotely steal network admin credentials. The credentials allow the attacker group, which the company has called Nobelium, to hack into admin accounts of the Active Directory Federation Services’ (AD FS) servers and control users’ access to various resources.
Microsoft claims that this is the same group behind the SolarWinds software supply chain attack that was revealed in December.
The malware acts as a backdoor for the hackers and facilitates their remote theft of tokens and certificates from Microsoft’s identity platform.
The newly discovered malware is used by the attackers once the server they’re targeting has already been compromised in terms of security. The hacker group uses several tactics to access users’ identities and the necessary infrastructure that is required to take control of their app usage.
Ramin Nafisi of the Microsoft Threat Intelligence Center says: “Nobelium uses FoggyWeb to remotely exfiltrate the configuration database of compromised AD FS servers, decrypted token-signing certificate, and token-decryption certificate, as well as to download and execute additional components”.
“FoggyWeb is a passive and highly targeted backdoor capable of remotely exfiltrating sensitive information from a compromised AD FS server. It can also receive additional malicious components from a command-and-control (C2) server and execute them on the compromised server,” Microsoft adds.
The backdoor that Nobelium manages to get past allows the hacker to access the Security Assertion Markup Language (SAML) token. This token is for assisting users to authenticate apps. Hacking the token permits the attackers to stay inside the network even after regular cleanups. In fact, according to Microsoft, FoggyWeb has been in use since April 2021.
Microsoft has uncovered a number of modules used by Nobelium. These include the GoldMax, GoldFinder, and Sibot components. These were built with the help of other malware that the same group was found guilty of using. These include Sunburst, Solarigate, Teardrop, and Sunspot.
For people who fall prey to the attack, Microsoft recommends auditing on-premise and cloud infrastructure for configurations, and per-user and per-app settings; removing user and app access, reviewing configurations, and reissuing new, strong credentials; and using a hardware security module to prevent FoggyWeb from stealing secrets from AD FS servers.
