Baku: Cyberattack attempts have been recorded against the user accounts of some organizations in Azerbaijan, APA-Economics reports, citing the National Cybersecurity Agency (NCA). These coordinated efforts aim to gain unauthorized access to user accounts of various institutions and organizations operating in the country.

According to Azeri-Press News Agency, cyber attackers are employing various methods to breach these accounts. They are utilizing both foreign IP addresses and VPN or proxy infrastructures that provide Azerbaijani IP addresses. This technique is used to disguise the attacks as legitimate connections originating within Azerbaijan, thus circumventing potential geographical restrictions.

The primary goal of these cyberattacks is to infiltrate Microsoft 365 and other email platforms to access confidential information, electronic correspondence, and sensitive data from targeted institutions and organizations. In response to these threats, the National CERT has issued several recommendations to enhance the security of user accounts.

Organizations and institutions are advised to scrutinize login logs, paying close attention to logins recorded on the same day from both foreign locations and Azerbaijani IP addresses. Additionally, they should investigate multiple failed login attempts from the same source and identify any suspicious successful logins. Enabling multi-factor authentication (MFA) for all user accounts is also strongly recommended.

For reference, the indicators of compromise (IOCs) related to the observed cyber activity include IP addresses such as 146.70.247[.]20, 179.43.158[.]195, 130.94.80[.]141, 94.20.154[.]138, and 35.178.160[.]238.