Resolved after 2 days 3 hours, affecting Rapid Response, on November 17, 2024.
Dear Customers, An Axon report on the Adversary-in-the-Middle (AiTM) campaign was released. The report includes: Indicators of Compromise (IOCs) Threat-hunting queries Insights into relevant hits If you have any questions or need further assistance, please feel free to reach out. Sincerely, Team AXON
Affected components
Update timeline
- investigating Nov 17, 2024, 10:49 AM UTC
Dear customers, Team AXON is aware of an ongoing Adversary-in-the-Middle (AiTM) campaign, targeting Microsoft 365 user accounts, using Axios infrastructure. This infrastructure provides the threat actor with the capability of intercepting HTTP traffic, to steal the credentials and/or session tokens of victim users. Users that authenticate using MFA are also vulnerable to this kind of attack. A threat-focused threat-hunting related to this campaign is now on-going. In case of any significant finding that requires your attention, we’ll of course reach out. An AXON report will be available for all of our AXON customers as soon as the Rapid Response efforts are concluded. Please don’t hesitate to contact us in case of any questions. Sincerely, Team AXON.
- resolved Nov 19, 2024, 02:30 PM UTC
Dear Customers, An Axon report on the Adversary-in-the-Middle (AiTM) campaign was released. The report includes: Indicators of Compromise (IOCs) Threat-hunting queries Insights into relevant hits If you have any questions or need further assistance, please feel free to reach out. Sincerely, Team AXON
Your product runs on more than Hunters Rapid Response
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services