Microsoft has been closely monitoring the Octo Tempest, a significant financial threat organization.
This threat group employs various strategies and TTPs for worldwide extortion, making it one of the most sophisticated financial threat groups.
Octo Tempest, a native English-speaking group that uses:-
This group has been linked with the following threat clusters and started in 2022, targeting telecoms and BPOs for SIM swaps:-
- 0ktapus
- Scattered Spider
- UNC3944
They made money by selling SIM swaps and taking over high-net-worth individuals’ accounts for cryptocurrency theft.
Octo Tempest Focus on Financial Data
Based on their early success, Octo Tempest expanded their tactics and targets. They extorted victim organizations for stolen data and joined ALPHV/BlackCat ransomware as a service.
By mid-2023, they deployed ransomware to various industries, including technology and financial services. Octo Tempest’s methods include SMS phishing, SIM swapping, and advanced social engineering, challenging typical threat models.
The highly organized attacks of Octo Tempest showcase technical depth with multiple operators.
Octo Tempest targets technical admins with social engineering, mimicking victims to trick them into password resets and MFA changes. They even impersonate new hires to seem legit.
To get business credentials, Octo Tempest sometimes uses terror tactics by threatening people physically and using personal information, reads the Microsoft report.
Here below, we have mentioned all the tools used:-
- Using PingCastle
- Using ADRecon
- Using Advanced IP Scanner
- Using MicroBurst
- Using Mimikatz, Hekatomb, Lazagne, gosecretsdump, smbpasswd.py, LinPEAS, ADFSDump,
- Using VMAccess Extension
- Using privacy.sexy
- Using ScreenConnect, FleetDeck, AnyDesk, RustDesk, Splashtop, Pulseway, TightVNC, LummaC2, Level.io, Mesh, TacticalRMM, Tailscale, Ngrok, WsTunnel, Rsocx, and Socat
- Usage of the third-party tunneling tool Twingate
Octo Tempest’s goal is financial gain, employing diverse tactics like data theft from various sources, data exfiltration through file-hosting services, and employing Azure Data Factory for data movement.
They also use legitimate Microsoft 365 backup solutions for data export and deploy ransomware for encryption, negotiation, and extortion, causing reputational damage.
Recommendations
Here below we have mentioned all the recommendations:-
- Align privilege in Microsoft Entra ID and Azure
- Segment Azure landing zones
- Implement Conditional Access policies and authentication methods
- Develop and maintain a user education strategy
- Use out-of-band communication channels
Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Try a free trial to ensure 100% security.
