Accounts of organizations in Azerbaijan targeted by cyberattacks
Coordinated attempts to gain unauthorized access to the user accounts of a number of organizations and government agencies have been recorded in Azerbaijan.
As 1news.az reports, citing the National Cybersecurity Agency (MKA), the attackers are using various methods to bypass protection. In addition to foreign IP addresses, they are employing VPN and proxy servers with Azerbaijani IP addresses, thereby masking the real origin of the traffic and attempting to circumvent geographic restrictions.
The main goal of the attacks is to gain access to Microsoft 365 and other email systems. As a result, the attackers may attempt to seize confidential information, email correspondence, and other official data.
The National Cyber Incident Response Center (CERT) has recommended that organizations strengthen control over account security. In particular, it is necessary to check authorization logs, pay attention to logins from different countries and from Azerbaijani IP addresses within a single day, and also analyze mass failed login attempts from a single source.
In addition, specialists are advised to identify suspicious successful authorizations and to activate multifactor authentication (MFA) for all user accounts.
The following IP addresses have been listed as indicators of compromise associated with the detected activity: 146.70.247.20, 179.43.158.195, 130.94.80.141, 94.20.154.138, and 35.178.160.238.
