Full Report
Researchers at Expel said a cybercrime group that specializes in gift card fraud used a novel tactic to hide its activities: signing up its own virtual machines (VMs) within a legitimate corporate cloud domain.
Analysis Summary
# Threat Actor: Atlas Lion
## Attribution & Identity
* **Identification:** Moroccan cybercrime group.
* **Known Aliases/Associations:** None explicitly named beyond the primary group name. Associated with cybercrime focused on gift card fraud.
## Activity Summary
Atlas Lion specializes in breaching big-box retailers, apparel companies, and restaurants primarily to fraudulently issue gift card codes.
Recently observed activity involved:
1. Sending SMS messages masquerading as helpdesk notifications containing a malicious link.
2. Phishing victims to capture usernames, passwords, and MFA codes.
3. Using immediately stolen credentials to register their own device into the victim's MFA authentication app for persistent access.
4. A novel technique of enrolling their own attacker-controlled Virtual Machine (VM) from their private cloud tenant (Microsoft Azure) into the organization's domain, making the VM appear as a legitimate corporate asset.
5. After initial detection/ejection, actors returned to download internal documentation concerning "Bring Your Own Device" policies, device management software, VPN setups, and crucially, detailed gift card issuance, refund, exchange, and fraud prevention processes.
6. Historical activity noted by Microsoft includes downloading legitimate 501(c)(3) letters from non-profit websites to obtain discounted cloud products.
## Tactics, Techniques & Procedures
* **Initial Access:** Phishing via SMS links presenting as helpdesk notifications to harvest credentials and MFA codes.
* **Persistence/Lateral Movement:** Immediately using harvested MFA data to enroll their own device/VM into the victim’s MFA system.
* **Evasion/Persistence:** Enrolling a VM hosted on their own Azure tenant into the victim’s corporate domain to mimic a legitimate, new corporate system, bypassing unauthorized device restrictions.
* **Reconnaissance/Objective Fulfillment:** Searching for and downloading internal documentation related to device policy configurations and gift card processes.
* **Financial Fraud:** Creating new gift cards derived from system compromises, subsequently cashing them out via money mules or selling them on the dark web.
* **Cloud Service Abuse:** Leveraging tax-exempt documentation (501(c)(3) letters) to obtain reduced cloud services.
## Targeting
* **Sectors:** Big-box retailers, apparel companies, restaurants, and nonprofit organizations (for resource acquisition).
* **Geography:** Implied focus on regions where the targeted retailers operate. Attribution points to a Moroccan origin.
* **Victims:** Large retailers and similar consumer-facing businesses; nonprofit organizations (as victims to harvest documentation).
## Tools & Infrastructure
* **Malware Families Used:** Not explicitly detailed, but relies heavily on custom interaction with legitimate cloud provisioning tools.
* **Infrastructure (C2, domains, IPs):** Attackers utilize their own **Microsoft Azure cloud tenant** for hosting the malicious Virtual Machine used for domain enrollment. Detection occurred when the VM connected using an IP address flagged for prior malicious activity.
## Implications
Atlas Lion demonstrates sophisticated abuse of legitimate cloud infrastructure enrollment processes to establish persistence directly within the victim's network perimeter, bypassing traditional device control measures. Their objective-driven attack chain—focusing intensely on gift card fraud—suggests a high-yield financial crime operation capable of extracting significant value quickly (up to \$100,000 daily in past observed instances). Their post-detection behavior indicates a learning capacity to adapt their VM enrollment techniques based on defense remediation steps.
## Mitigations
* **MFA Protection:** Ensure strong controls and immediate response protocols for MFA configuration changes, especially when new devices are enrolled, even if initially appearing legitimate (e.g., verification of new device enrollment via secondary out-of-band communication).
* **Device Enrollment Monitoring:** Scrutinize any new device attempting to join the corporate domain, paying close attention to the source IP address validity and reputation before permitting domain integration.
* **Endpoint Security:** Ensure endpoint detection and response (EDR) solutions (like Microsoft Defender) are configured to aggressively flag or block connections originating from known malicious or reputation-poor IP addresses, even during device setup phases.
* **Information Security:** Review and restrict access to internal documentation regarding device management, VPN setup, and fraud prevention policies.