Microsoft: Russian malware hijacks ADFS to log in as anyone in Windows

HomeNewsSecurityMicrosoft: Russian malware hijacks ADFS to log in as anyone in Windows Microsoft has discovered a new malware used by the Russian hacker group APT29 (a.k.a. NOBELIUM, Cozy Bear) that enables authentication as anyone in a compromised network. As a state-sponsored cyberespionage actor, APT29 employs the new capability to hide their presence on the networks of their targets, typically

[imakita_corp]

>>Dubbed ‘MagicWeb’~which allowed hackers to exfiltrate the configuration database of compromised Active Directory Federation Services (ADFS) servers, decrypt token-signing and token-decryption certificates, and fetch additional payloads from the command and control (C2) server.

[IGA-OS]

ほんとAD環境がやられると大変だなぁ・・・