Microsoft has been closely monitoring the activities of a threat group known as Octo Tempest. This group has emerged as a major concern for businesses across a variety of sectors due to its financially driven motives and sophisticated tactics. Octo Tempest is notorious for its broad social engineering campaigns, aiming to compromise organizations worldwide with the intent of financial extortion.

A bit on Octo Tempest

Originating as a financially driven, native English-speaking threat collective, Octo Tempest became known for its extensive adversary-in-the-middle (AiTM) techniques, social engineering, and SIM-swapping capabilities.
  • Overlapping with other known threat groups, Octo Tempest began its operations in 2022 by targeting mobile telecommunications and business process outsourcing entities. 
  • By the end of 2022 and into early 2023, the attackers began extorting organizations using stolen data and even resorting to physical threats in some cases. 
  • In a significant development, by mid-2023, Octo Tempest was affiliated with ALPHV/BlackCat and began deploying ransomware payloads.

Modus operandi

  • One of Octo Tempest’s signature techniques involves SMS phishing, coupled with SIM swapping, allowing it to gain control over a user’s phone number, providing a gateway to multiple forms of personal and financial data.
  • Advanced social engineering remains at the core of its operations. By impersonating new employees or mimicking idiolect during phone calls, Octo Tempest deceives technical administrators, leading them to inadvertently grant access or reset authentication measures. 
  • Other tools used by the group include DBeaver, MongoDB Compass, Azure SQL Query Editor, and Cerebrata. Octo Tempest, furthermore, employs Azure Data Factory to discreetly extract data to external Secure File Transfer Protocol (SFTP) servers.

The bottom line

Given Octo Tempest’s relentless evolution and aggressive approach, organizations must be proactive in their defense strategies. It’s essential to understand and align privileges within systems such as Microsoft Entra ID and Azure, segment Azure landing zones, and implement robust Conditional Access policies. Additionally, organizations should prioritize user education, highlighting the significance of ongoing awareness about common cyber threats.