Starting in August of 2023, Microsoft observed malicious activity targeting and stealing credentials from Microsoft customers. These intrusion activities were enabled by password spray attacks. According to Microsoft, the source of these password spray attacks is a network of compromised devices known as CovertNetwork-1658. The credentials acquired from this operation are leveraged by multiple Chinese threat actors.
One such threat actor pointed out in the report is Storm-0940. Storm-0940 has been active since 2021 and is known to target North American and European organizations, including:
- Government organizations
- Think tanks
- Law firms
- Defense industrial baes
- Non-governmental organizations
Storm-0940 is known to gain access via password spray, brute-force attacks or exploiting network edge applications and services. Jim Edwards, Senior Director of Engineering at Keeper Security, states, “The rise of Storm-0940 and its use of the Quad7 botnet serves as yet another reminder that the cybersecurity landscape is evolving. Attackers are increasingly targeting vulnerabilities in everyday devices, such as home routers and VPNs, to infiltrate corporate networks. As remote work remains common, organizations must adopt a comprehensive security strategy that goes beyond traditional defenses.”
How can organizations protect against Storm-0940?
To defend against Storm-0940 and other related threats, Edwards offers the following advice.
“First, it’s critical for organizations to address the weak credentials that often serve as low-hanging fruit for attackers. Security teams must implement rigorous password policies, requiring strong and unique passwords for all accounts. Multi-Factor Authentication (MFA) is essential — adding an extra layer of security that significantly reduces the chances of unauthorized access.
While adopting a zero trust architecture is an important step, organizations should also focus on Privileged Access Management (PAM) to protect sensitive information. By limiting access to critical systems and continuously monitoring account activity, PAM can help mitigate risks from compromised accounts.
Another key aspect of a robust security posture is Endpoint Device Management (EDM). Keeping software updated and ensuring consistent security patching across all environments — cloud and on-premise — helps close off avenues that attackers might exploit. Integrating advanced monitoring tools to provide real-time visibility into network activity is crucial, enabling security teams to detect anomalies early and respond swiftly, preventing minor issues from escalating into major breaches.”