Microsoft cyber signals report highlights growing gift card fraud

The report reveals that Storm-0539 conducts extensive research on gift card business processes, federated identity service providers, and employees of targeted organisations. To evade detection, they impersonate legitimate nonprofits to obtain free or discounted cloud resources and register domains that closely resemble legitimate services.

Increased activity around holidays

The group has been particularly active during high-demand periods for gift cards. There was a 60% increase in Storm-0539 intrusion activity between September and December 2023, coinciding with the holiday season, and a 30% increase in May 2024. These spikes in activity highlight the group's strategy to exploit the heightened demand for gift cards during these times.

Implications and recommendations

The findings of the Microsoft Cyber Signals report underscore the growing threat posed by cybercriminal groups like Storm-0539. Businesses, particularly those in retail, luxury, and fast-food sectors, need to bolster their cybersecurity measures to protect against such sophisticated attacks.

The report further suggests enhancing employee training on recognising phishing and smishing attempts, implementing robust access controls and multi-factor authentication. Furthermore, conducting regular security audits and penetration testing to identify vulnerabilities is also advised.
Monitoring for unusual activity, especially during peak gift card demand periods can help reduce cyber frauds.