Octo Tempest is a financially motivated cybercrime group that leverages social engineering and identity compromise to gain initial access to an environment. It exploits weaknesses in identity systems to steal data and deploy ransomware.
This group is particularly dangerous because they target a broad range of businesses, use native English speakers in their attacks, and can adapt their tactics quickly.
Organizations can mitigate the risks posed by Octo Tempest by implementing a response playbook that focuses on forensics and regaining control of identity and access management systems.
The regaining of administrative control of a Microsoft Entra ID environment after an identity plane compromise, where the key steps include using break-glass accounts for emergency access, switching federation authentication from Federated to Managed to prevent further token minting by attackers, and reviewing service principals to remove unnecessary permissions and ensure they are not exploited for persistence.
Scan Your Business Email Inbox to Find Advanced Email Threats - Try AI-Powered Free Threat Scan
To secure access to Microsoft Entra ID resources, implement Conditional Access policies requiring multi-factor authentication (MFA) for all users, especially phishing-resistant MFA for administrators, block legacy authentication protocols, and enforce password changes for high-risk users.
Additionally, implement user risk-based Conditional Access policies to challenge suspicious sign-ins, segregate cloud admin accounts and restrict password resets/MFA manipulation to authorized personnel.
During security incidents, revoke old admin permissions, create new secured accounts with modern MFA, and employ device-bound passkeys.
An immediate response is required to alleviate the impact of the Octo Tempest intrusion that has occurred within the Azure environment.
Review and analyze changes to Network Security Groups (NSGs), Azure Firewall rules, and access control for Azure Management Groups and Subscriptions to identify and remove malicious modifications.
Implement Intune Multi-Administrator Approval (MAA) to enforce two-person approval for critical actions and prevent further damage.
Investigate all MFA registrations during the intrusion timeframe, prepare to re-register compromised accounts, review the on-premises Active Directory, and consider full forest recovery if necessary.
Isolate domain controllers, sanitize the active directory, and rebuild the forest if administrative accounts are compromised.
Finally, investigate access to Key Vaults and Secret Servers to identify and rotate compromised credentials.
Microsoft recommends the AD Tiering model as a stop-gap measure to mitigate Pass-the-Hash attacks in on-premises Active
Directory environments, which is easier to implement than the more comprehensive Enterprise Access Model (EAM) and offers practical guidance.
Tiering involves creating segregated privileged accounts for different access levels and ensuring control plane isolation.
After a potential compromise, account disposition involves resetting passwords, disabling accounts, reviewing access controls, and a mass password reset.
Free Webinar! 3 Security Trends to Maximize MSP Growth -> Register For Free