{"id":125667,"date":"2023-02-08T09:00:00","date_gmt":"2023-02-08T17:00:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=125667"},"modified":"2023-06-21T06:14:57","modified_gmt":"2023-06-21T13:14:57","slug":"solving-one-of-nobeliums-most-novel-attacks-cyberattack-series","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/02\/08\/solving-one-of-nobeliums-most-novel-attacks-cyberattack-series\/","title":{"rendered":"Solving one of NOBELIUM\u2019s most novel attacks: Cyberattack Series"},"content":{"rendered":"\n

Our story begins with eight Microsoft Detection and Response Team<\/a> (DART) analysts gathered around a customer\u2019s conference room to solve a cybersecurity mystery. Joined by members of the customer\u2019s cybersecurity team, they were there to figure out how a Russia-based nation-state hacking group known as NOBELIUM had bypassed authentication checks and impersonated users to gain access to its data. This attack, later known as MagicWeb, wasn\u2019t so much a whodunit as a how-done-it.<\/p>\n\n\n\n

To discover potential security threats like MagicWeb, Microsoft DART uses the trillions of security signals that Microsoft tracks daily that help provide broad and deep insight into the threat landscape. Microsoft DART and the Microsoft Threat Intelligence Center (MSTIC) work together to find bad actors, understand their tactics, techniques, and procedures (TTPs), and alert the organizations that are, or could be, at risk. As with any observed nation-state actor activity, Microsoft directly notifies customers that have been targeted or compromised, providing them with the information they need to secure their accounts. In some cases, the notified customers will engage with Microsoft DART and other industry partners on investigations, gathering new insights and disrupting the threat actors at each stage of the campaign.<\/p>\n\n\n\n

NOBELIUM is an advanced and persistent adversary because of its tenacious attacks and ever-evolving TTPs. Most attackers play an impressive game of checkers, but increasingly we see advanced persistent threat actors playing a masterclass-level game of chess.<\/p>\n\n\n\n

MagicWeb is a great example of NOBELIUM\u2019s advanced attacks and was first profiled by Microsoft in August 2022<\/a>. It was the first time that a Global Assembly Cache (GAC) implant was seen in the wild. This malware, later named MagicWeb, allows the attacker to authenticate as anyone in a targeted network and maintain persistent access to the customer environment they compromised. The team quickly homed in on examining certificate irregularities, which helped to solve the incident. The key to understanding MagicWeb lay in highly privileged certifications that NOBELIUM used to move laterally to gain administrative privileges to an Active Directory Federation Services (AD FS) system. The team discovered that NOBELIUM was using a compromised dynamic link library (DLL) that lived in an obscure GAC, a machine-wide cache for the common language infrastructure in the .NET framework.<\/p>\n\n\n\n

Read the report<\/a><\/u><\/strong> to go deeper into the details of the attack, including NOBELIUM\u2019s tactics, the response activity, and lessons that other organizations can learn from this case.<\/p>\n\n\n\n

What is the Cyberattack Series?
<\/strong>
With this new Cyberattack series, customers will discover how Microsoft incident responders investigate unique and notable exploits. For each attack story, we will share:<\/p>\n\n\n\n