Ankura CTIX FLASH Update - June 16, 2023

Malware Activity

Successful Ransomware Attack Against Microsoft 365's SharePoint Online Observed

Researchers have recently observed a successful ransomware attack against SharePoint Online (Microsoft 365). This attack was conducted through a Microsoft Global Software-as-a-Service (SaaS) administrator account and is currently speculated to have been conducted by the 0mega ransomware operation due to the account name, additional observables, and infrastructure that were created and used. 0mega launched in May 2022 and has been observed targeting organizations around the globe with double-extortion attacks. Few victims have been posted to the group's leak site and a sample of the ransomware has yet to be reviewed as of June 7, 2023. The researchers shared that the actor created a new Active Directory (AD) user called "Omega" with escalated privileges, which included Global Administrator, SharePoint Administrator, Exchange Administrator, Teams Administrator,