UNC3944 Uses Azure Serial Console for Stealthy Access to Virtual Machines

Researchers revealed that the UNC3944 threat actors use phishing and SIM-swapping attacks to get control over Microsoft Azure admin accounts. Hackers maliciously used the Azure Serial Console on Azure Virtual Machines (VM) to deploy remote management software within client environments. The method succeeded to avoid the usual detection methods that Azure uses and enabled threat […]

The post UNC3944 Uses Azure Serial Console for Stealthy Access to Virtual Machines appeared first on Heimdal Security Blog.