MuddyWater cloud destruction operation

Microsoft identified a destructive operation executed by MuddyWater (also known as MERCURY or Mango Sandstorm), a threat actor attributed to the Iranian government, in partnership with “DarkBit” (who gained notoriety for attacking the Technion, an Israeli university, in February 2023). The attacks targeted both on-premises and cloud environments, with destruction and disruption as the ultimate goals. The actors likely exploited known vulnerabilities in unpatched applications for initial access and moved laterally throughout the network, using Azure AD Connect to pivot from the on-premises environment to the Azure AD environment. The attackers then leveraged highly privileged compromised credentials to perform mass destruction of resources.