Helix Group’s Innovative Phishing Tactics
In recent developments, the Helix group has emerged as a dynamic force in the realm of data extortion, primarily targeting Microsoft 365 users through sophisticated phishing techniques rather than traditional malware strategies. The group focuses on gaining access to extensive corporate data, with SharePoint libraries often being a lucrative target.
This unique campaign distinguishes itself by favoring identity abuse over conspicuous ransomware activities. By persuading victims to enter device codes, attackers secure valid sessions, bypassing many typical security alerts associated with password theft.
Identity-Driven Intrusion Strategies
Analysts from ReliaQuest have observed that Helix’s operations signify a broader shift towards identity-centric intrusion methods. Their analysis, shared with Cyber Security News, highlights the group’s use of consistent infrastructure and core tactics across various targets.
It is believed that Helix has its roots in an existing data extortion ecosystem that has diversified into smaller operations, explaining the similarities in their techniques and post-compromise behaviors. This enables Helix to swiftly, yet discreetly, exfiltrate sensitive cloud information before organizations realize the breach.
Deceptive Tactics and Infrastructure
Helix’s approach involves gathering enough target information to convincingly impersonate authoritative figures over the phone. In one incident, a caller pretended to be a victim’s manager, guiding them to enter a device code in Chrome, thus capturing an authenticated session without needing the actual password.
Many employees fail to recognize this as credential sharing, although it effectively grants the same level of access. Helix also employs target-specific subdomains, residential proxies matching the victim’s location, and varied source addresses to mask unauthorized sign-ins.
SharePoint: The Primary Target
Once access is secured, Helix quickly moves to establish persistence, often by registering a new MFA authenticator within the compromised account. This facilitates a stable foothold. Subsequently, the focus shifts to exploring and collecting data within Microsoft 365, with SharePoint often being the source of high-value files.
In certain cases, data exfiltration occurs within an hour, while in others, attackers spend days meticulously preparing for larger data downloads. ReliaQuest reported a pattern of manual browsing followed by automated SharePoint enumeration and mass data downloads.
Standard response measures like password resets and session revocations can still be effective if executed swiftly across both cloud and on-premises systems. However, the narrow response window emphasizes the need for proactive defenses.
Helix’s activities highlight a sophisticated extortion model built on trust, timing, and exploitation of familiar cloud services. The group demonstrates that with a well-executed phone call and a device code, massive data theft can occur with minimal malware evidence for investigators to follow.
Organizations underestimating SharePoint’s appeal to extortionists may face significant risks. A single compromised identity exposing critical data transforms the cloud repository into both a target and a vulnerability.
To prevent critical incidents and financial losses, it is crucial to strengthen proactive defenses and integrate live threat feeds from multiple SOC teams.
