Full Report
On 2023-08-15, a campaign was reported, involving 0ktapus, gaining initial access via Unknown, while using Azure Run Commands abuse, with unknown impact.
Analysis Summary
# Incident Report: 0ktapus Exploitation of Azure Run Commands
## Executive Summary
On August 15, 2023, reports surfaced detailing a campaign attributed to the threat actor group known as 0ktapus (also referred to as Scattered Spider). The attackers leveraged advanced cloud-based techniques, specifically the abuse of Azure Run Commands, to execute code on virtual machine instances. While the specific initial access vector remains undisclosed, the campaign highlights the group's shift toward sophisticated cloud infrastructure manipulation.
## Incident Details
- **Discovery Date:** 2023-08-15
- **Incident Date:** Circa August 2023
- **Affected Organization:** Not specifically disclosed
- **Sector:** Multiple (Historically targets Tech, Telecom, and Finance)
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Reported 2023-08-15
- **Vector:** Unknown (Historically leverages sophisticated social engineering/SMS phishing)
- **Details:** The specific entry point for this campaign was not identified at the time of reporting, though the group is known for capturing Okta credentials.
### Lateral Movement
- Moving from identity provider access (Okta/Azure AD) into the Azure Management plane.
- Exploiting administrative privileges to interact with the Azure Resource Manager (ARM) API.
### Data Exfiltration/Impact
- **Details:** The impact was listed as unknown at the time of the report; however, the ability to run commands on Azure VMs typically leads to credential harvesting, data theft, or ransomware deployment.
### Detection & Response
- **Detection:** Identified through analysis of cloud audit logs showing anomalous use of the `Microsoft.Compute/virtualMachines/runCommand` action.
- **Response:** Security researchers publicized the methodology to alert cloud administrators to monitor for this specific abuse.
## Attack Methodology
- **Initial Access:** Unknown (Likely via compromised administrative credentials).
- **Persistence:** Utilization of legitimate cloud management tools (Azure Run Commands).
- **Privilege Escalation:** Exploiting high-privilege service principals or administrative accounts.
- **Defense Evasion:** Using native Azure functions to bypass traditional EDR/AV that may not monitor the cloud management plane.
- **Credential Access:** Potential harvesting of secrets from VM memory or local configuration files.
- **Lateral Movement:** Cloud-to-Terminal movement using Azure "Run Command" to jump from the management console into specific Virtual Machines.
- **Impact:** Code execution and potential full system compromise of cloud-hosted assets.
## Impact Assessment
- **Financial:** Unknown.
- **Data Breach:** High potential for unauthorized data access within targeted VMs.
- **Operational:** Risk of system downtime if attackers chose to disrupt services.
- **Reputational:** Significant risk due to the high profile of the 0ktapus group.
## Indicators of Compromise
- **Behavioral indicators:**
- High frequency of `Microsoft.Compute/virtualMachines/runCommand` in Azure Activity Logs.
- Unexpected creation of temporary scripts in `C:\Packages\Plugins\Microsoft.Cipp.RunCommandWindows` (Windows) or `/var/lib/waagent/run-command` (Linux).
- Logins to the Azure Portal from unusual geographic locations or known VPN/TOR exit nodes.
## Response Actions
- **Containment:** Revoking compromised administrative tokens and rotating service principal keys.
- **Eradication:** Identifying and removing any persistence mechanisms (e.g., new global admins) created by the actor.
- **Recovery:** Restoring cloud configurations to a known-good state.
## Lessons Learned
- **Visibility Gaps:** Traditional endpoint security often misses actions taken via the cloud management plane (API/Portal).
- **Identity is the Perimeter:** 0ktapus continues to demonstrate that once identity is compromised, traditional network security is easily bypassed.
- **Native Tool Abuse:** Threat actors are increasingly using "Living off the Cloud" techniques by abusing legitimate management features like Azure Run Commands.
## Recommendations
- **Enforce MFA:** Use FIDO2-compliant security keys to prevent credential harvesting via phishing.
- **Monitor Azure Activity Logs:** Alert on the execution of `RunCommand` actions, especially from users who do not regularly perform administrative tasks.
- **Least Privilege:** Restrict the use of the `Virtual Machine Contributor` role and specifically the `Microsoft.Compute/virtualMachines/runCommand/action` permission.
- **Conditional Access:** Implement strict Conditional Access Policies (CAP) to limit Azure Portal access to trusted locations and compliant devices.