Researchers have discovered a novel tactic used by Moroccan cybercrime group Atlas Lion to attack big-box retailers, apparel companies, restaurants and more. The group was observed using stolen credentials to enroll its own virtual machines (VMs) into an organization’s cloud domain, according to researchers at cybersecurity firm Expel. The move essentially allows the group to act like its cybercrime infrastructure is a legitimate part of a company’s network. Atlas Lion specializes in breaching the systems of large retailers in order to fraudulently issue gift card codes to themselves, according to Microsoft.
Moroccan cybercrime group Atlas Lion hiding in plain sight during attacks on retailers (Jonathan Greig, The Record)
Related articles
