Microsoft Active Directory Supply Chain Compromise Reflects Shifting Adversary Tactics to Exploit Identity

Microsoft is having a bad month year. The industry has faced a crisis of trust with numerous challenges over the past year in securing Active Directory (AD), the IT foundation of most organizations. These challenges have included vulnerabilities with other critical Microsoft infrastructure services such Exchange (ProxyLogon, Autodiscover) and Azure (CosmosDB, OMI), and with core Windows (including several remote code execution vulnerabilities such as PrintNightmare). Now we learn with the most recent Microsoft disclosure that COZY BEAR used a weak link in the authentication stack for Active Directory Federated Services (ADFS) to target 140 Microsoft resellers, resulting in the confirmation of 14 organizations being compromised.

ADFS becomes critical when enterprises have to work with various cloud services and a broader ecosystem such as its supply chain. While this attack on the supply chain and Microsoft’s IT service providers may sound similar to the SolarWinds attack in 2020, the key difference is that attackers are using a common “unsophisticated password spray and phishing” technique, as opposed to exploiting legitimate software or zero-day vulnerabilities. The theft of legitimate credentials makes such an attack campaign very difficult to discover using traditional SIEM analysis and post-event hunt methods. Microsoft put forth technical guidance to its service partners and affected customers; however, the complexity of following the steps (and reliance on customers to correctly configure systems for protection) makes it nearly impossible for an organization to respond adequately and still run its core business.

To reduce this complexity, CrowdStrike has built the industry’s only cloud-native approach to protecting identities, specifically to ensure ease of deployment, operation and compatibility with a wide range of systems and cloud environments.

The extension of this attack to the supply chain means that protecting immediate employees and assets for an enterprise is not enough, given the interconnectivity of all businesses, including the IT services affected in this recent attack. Supply chain attacks have risen 430% recently, as attackers find it easier to enter into an organization by the weakest points and then move laterally to the end target. To address the broadest protection for the supply chain, CrowdStrike uniquely protects not only endpoints and workloads with agents, but can also stop identity-centric threats for unmanaged endpoints and for users with federated services (e.g., Okta or ADFS). Since credential or identity store compromise is used in nearly 60% to 80% of all breaches, we should not be surprised by attacks that continue to leverage identity-centric techniques. The solution cannot stop at implementing only post-disclosure patches, but in fact must enforce Zero Trust on every user, credential and resource.