Ankura CTIX FLASH Update - August 4, 2023

Malware Activity

Midnight Blizzard Observed Conducting Highly Targeted Social Engineering Attacks Through Microsoft Teams

Microsoft Threat Intelligence researchers have observed the Russian nation-state threat group Midnight Blizzard conducting social engineering attacks over Microsoft Teams. In this latest campaign, Midnight Blizzard, otherwise known as NOBELIUM, APT29, and CozyBear, has been observed targeting approximately forty (40) global organizations within government, non-government organizations (NGOs), IT services, technology, discrete manufacturing, and media sectors. Researchers explained that malicious activity involving this attack pattern began in May 2023 and consisted of Midnight Blizzard utilizing previously compromised Microsoft 365 tenants owned by small businesses. New domains were created using these tenants, which appeared as technical support operations, and used as lures by the threat group in Microsoft Teams messages. The lures were