Post-Compromise Threat Activity in Microsoft Cloud

Summary

The Cybersecurity and Infrastructure Security Agency (CISA) has evidence of post-compromise advanced persistent threat (APT) activity in the cloud environment. Specifically, CISA has seen an APT actor using compromised applications in a victim’s Microsoft 365 (M365)/Azure environment and using additional credentials and Application Programming Interface (API) access to cloud resources of private and public sector organizations. This activity is in addition to what has been previously detailed in  AA20-352A.

In response, CISA has released AA21-008A to describe this malicious APT activity and offer guidance on three open-source tools—including a CISA-developed tool, Sparrow, released on December 24. Network defenders can use these tools to help detect and remediate malicious APT actor activity as part of the ongoing supply chain compromise.

Reporting

We encourage recipients who discover signs of malicious cyber activity to contact us via the cyber incident report form here.