H-ISAC TLP White Threat Bulletin: Microsoft Cloud Environment Post-Compromise Threat Activity Detection

On January 8, 2021, the Cybersecurity and Infrastructure Security Agency (CISA) distributed an alert (AA21-008A) as a companion alert to (AA20-352A). The predated alert focuses on an advanced persistent threat (APT) actor’s compromise of SolarWinds Orion products as an initial access vector into networks of entities including US government, critical infrastructure, and private network organizations.  

This alert addresses activity irrespective of the initial access vectors leveraged that CISA attributes to an APT threat actor. Specifically, this alert serves to address threat actor exploitation via the compromise of applications in a victim’s Microsoft 365 (M365)/Azure environment in addition to the utilization of additional credentials and API access to cloud resources of private and public sector organizations.