Microsoft announced yesterday that it has removed 18 Azure Active Directory apps from the Azure portal that were developed and used maliciously by Chinese hackers. The 18 Azure AD apps were removed from the Azure portal in April, Microsoft’s threat intelligence team said in a report published yesterday. The report details recent tactics used by Chinese hackers from the Gadolinium, also known as APT40 or Leviathan.
Azure AD apps were part of the group's attacks in 2020, which Microsoft described as "particularly difficult" to detect, due to the multi-stage infection process and widespread use of PowerShell payloads.
These attacks began with spear-phishing emails targeting organizations, which were sent malicious documents, usually PowerPoint, about the COVID-19. Those who opened one of these documents were infected with PowerShell-based malware payloads. This is where the malicious Azure AD apps began to operate.
Microsoft said that on the infected computers , Chinese hackers from Gadolinium used PowerShell malware to install one of 18 Azure AD apps. The role of these apps was to automatically configure the victim's endpoint with the permissions required to dump data to the attacker's own Microsoft OneDrive storage .
By removing the 18 Azure AD apps, Microsoft offset the attacks carried out by Chinese hackers, at least for a while, while also forcing them to rethink and “refresh” their attack infrastructure.
Additionally, Microsoft said it worked to take down a GitHub that the Gadolinium group had used as part of the attacks it carried out in 2018. This action prevented the hackers from reusing the same account for potential future attacks.
Microsoft's actions against this Chinese hacking group are not an isolated incident. In recent years, Microsoft has been working intensively to destroy malware infrastructure that may have been used by "low-level or high-level" hackers. Microsoft has previously tried to destroy infrastructure used by other state-run hacking groups, including those linked to Russia, Iran , and North Korea.
