For several weeks now, cybercriminals have been highly active, orchestrating attacks against some of the world’s largest organizations. Recently, Microsoft was at the receiving end of a Distributed Denial-of-Service (DDoS) attack by Storm-1359, also known as Anonymous Sudan, that resulted in service disruptions.
As early as June, a surge of complaints on Twitter indicated that up to 18,000 users couldn’t access Outlook due to what eventually came to light as a DDoS attack. Microsoft confirmed the incident in a blog post and provided technical details and suggestions to prevent such attacks.
These recent cyberattacks presumably hinged on using several virtual private servers (VPS), combined with hired cloud infrastructures, open proxies, and DDoS tools. Interestingly, the DDoS operation specifically targeted the seventh layer of network architecture, instead of the third or fourth.
Details on DDoS traffic attacks
Microsoft’s analysis shows that Storm-1359, a group with access to various botnets and tools, conducts DDoS attacks from cloud services and open proxies. They primarily aim to create disturbances and garner attention.
Storm-1359 utilizes several Layer 7 DDoS traffic attacks:
- HTTP(S) flood attack: overwhelms system resources with a flood of SSL/TLS handshakes and HTTP(S) requests, depleting backend computing resources.
- Cache bypass: overloads origin servers by generating queries against URLs, forcing all requests to the origin rather than using cached contents.
- Slowloris: maintains an open server connection by slowly downloading requested resources, keeping the requested item in memory.
Though it’s unclear from the blog post if Microsoft regained control or ended the attack, updates from the Microsoft 365 Status Twitter account suggest they had control over the situation by the morning after the disruption on June 5th.
Microsoft gives updates on the outage incident. (Source – Microsoft 365 Status Twitter)
To counteract these attacks, Microsoft has enhanced its Layer 7 defenses, adjusting the Azure Web Application Firewall (WAF) to protect customers from similar DDoS incursions better. Even though these defensive measures are generally successful at reducing most service interruptions, Microsoft continues to evaluate the efficiency of its protection systems, using acquired insights to refine and enhance their effectiveness.
Who is Anonymous Sudan?
Anonymous Sudan emerged in January 2023, warning that they would instigate attacks against any nation that opposes Sudan. Since that declaration, they have trained their sights on various global organizations and governmental bodies, crippling them with DDoS attacks or releasing stolen data.
The group began striking at large organizations in May, imposing a ransom to end the attacks. The first strike targeted Scandinavian Airlines (SAS), with the threat actors demanding US$3,500 to halt the DDoS onslaught.
Subsequently, the group shifted its focus to the websites of American corporations, such as Tinder and Lyft, and an array of hospitals scattered across the USA.
In June, Microsoft fell into the crosshairs of Anonymous Sudan, as they launched DDoS assaults on web-accessible portals for Outlook, Azure, and OneDrive, raising their ransom demand to a staggering US$1 million.
The group taunted, “You have failed to repel the attack which has continued for hours, so how about you pay us 1,000,000 USD and we teach your cyber-security experts how to repel the attack and we stop the attack from our end? 1 million USD is peanuts for a company like you.”
During the DDoS offensive against Outlook, the group claimed their actions were in response to the USA’s meddling in Sudanese politics. Anonymous Sudan pronounced, “This is a continuous campaign against US/American companies & infrastructure because of the statement of the US Secretary of State saying there is a possibility of American invasion of Sudan.”
Source: techwireasia
