Microsoft confirms it faced a series of large-scale DDoS attacks targeting Outlook and OneDrive earlier this month. The perpetrators could have ties to Russia.

Earlier this month, did you have no or limited access to Outlook, OneDrive, and other Azure services? It turned out that this was the result of a DDoS attack. Two weeks later, Microsoft looks back on the incidents in a blog post. The first wave of attacks on the mail service took place on June 5th, which later also spread to OneDrive and Azure Portal and lasted until June 9th.

According to Microsoft, it was a layer 7 DDoS attack in which the attackers targeted the application layer of the Azure infrastructure, which has to ensure that an email is visible in your mailbox. The attackers used various techniques to overload Microsoft’s servers, from processing millions of HTTPS requests per second to more sophisticated techniques like requesting source files without downloading them in order to keep the connection alive.

AnonymousSudan

At the height of the attack, Microsoft services for 10,000 to 20,000 customers were disrupted. To do this, the attackers must have a large botnet and sufficient cloud capabilities to host it. In other words, it wasn’t amateurs who were behind the attacks.

While Microsoft does not name names in its analysis, the blog points to the perpetrators Storm-1356, the company does so with no hesitation to AP. A spokesman points the finger at Anonymous Sudan. Contrary to what the name might suggest, experts assume that this group comes from Russia and pursues pro-Russian motives.

Microsoft confirms that customers shouldn’t worry about compromised data. This is typically not the primary objective of DDoS attacks, which are primarily concerned with disrupting activity. However, a DDoS attack can act as a springboard or distraction for malware attacks.