New analysis of the ExfilSquad data extortion group has tied it to leaked data from at least 13 victims from sectors including government, education, financial services and manufacturing.
Fortra Intelligence and Research Experts (FIRE) have reviewed data samples made public by the group and concluded that the criminals’ claim they have access to sensitive data is correct.
The group, which first emerged on July 26, has claimed to have exfiltrated the data of 15 separate organizations.
On August 7, data dumps of 13 of the victims were published via torrents, with the criminal group claiming these organizations did not meet the agreements.
The full archive “[victim]_exfilsquad” was made available for download and the total data was reported to be 382.64 GB and 27 million records across the 13 victims.
The victims included City of Atlanta (atlantaga.gov), UK Department for Education (education.gov.uk) and the UK Police National Legal Database.
District of Columbia Public Schools (DCPS) was also listed by the attackers and a note that read: “We are not going to dox a bunch of school children, but we are going to expose how incompetent DCPS is at keeping children as young as six's information safe. Thus, we are releasing a censored version of the leak and have shredded the original entirely from our servers."
In this instance, 60,000 records containing student names, dates of birth and unique student identifiers, among other personally identifiable information (PII), has been leaked.
Zenith Bank Plc and Analog Devices were not present, despite being included in the original 15 victim list, noted the FIRE team.
Unauthorized Access, Misconfigured Power Pages
The researchers said that the data breaches are most likely limited to unauthorized access of Microsoft D365 CRM and ERP instances.
“The leading theory on the initial attack vector that enabled exfiltration is misconfigured Microsoft Power Page portals that allowed for public read access,” the FIRE team wrote.
Power Pages is a SaaS platform designed for creating, hosting and administering modern, external-facing business websites.
The leaked data formations were consistent with Microsoft Dataverse exports, which Fortra said suggested unauthorized read access was likely achieved during the incidents.
Victims were likely identified by the attackers’ crawling for misconfigured Microsoft Power Portals or other enumeration techniques.
The Fortra researchers noted that because the data breach reached just 15 victims, rather than tens of thousands, it is unlikely that a D365 vulnerability was the source of the data breach.
The cybersecurity firm also highlighted a known issue in Microsoft Power Pages, which is when the Anonymous Users web role is assigned to a table permission, the table’s data can be read by anyone visiting the site.
The Power Pages can be accessed via an API, specifically at https:///_api/*
Microsoft advise against using this role in publicly exposed sites in their documentation: https://learn.microsoft.com/en-us/power-pages/security/assign-table-permissions
Automated scanning for exposed Power Pages sites is a known technique, Fortra noted, and the firm said in its research it was able to identify over 10,000 potential Power Pages instances accessible to the public.