How can organisations defend against Operation Dust Storm?

How Operation Dust Storm defenders should think about the campaign

Defence starts by treating the campaign as an access-and-persistence problem, not just a malware problem. The highest-value controls are the ones that interrupt initial entry, stop credential abuse from turning into broad access, and reduce the number of places an attacker can persist. That means hardening email, endpoint and identity layers together, because gaps in any one of them can make the others easier to bypass.

A useful practical lens is to ask which paths the attacker would prefer after the first foothold, then remove those paths before focusing on cleanup. If email is used for delivery, credentials are the real prize; if remote administration is available, persistence becomes easier; if internal segmentation is weak, a single compromise becomes an organisation-wide problem.

Good defence also depends on visibility. Monitoring for unusual sign-in behaviour, new forwarding rules, abnormal administrative actions, and repeated access from unexpected locations or devices gives earlier warning than waiting for an alert on a payload. In campaigns like this, the incident often looks ordinary until several weak signals are correlated.

Where attackers usually turn a foothold into persistence

Defenders should assume the campaign will try to convert stolen access into durable control through identity abuse, remote access and administrative tooling. Removing unnecessary remote access reduces the number of externally reachable paths, while tighter identity controls make it harder for a compromised account to impersonate a trusted operator or service.

Segmentation matters because it limits the blast radius of any successful account takeover. If critical assets sit in the same trust zone as user endpoints, the attacker can often move from one compromised account to many systems without needing advanced exploitation. When critical systems are isolated, the attacker has to defeat additional barriers instead of inheriting the network’s default trust.

Attackers also benefit from environments where administration is routine and poorly distinguished from normal work. Unusual use of privileged tools, new management channels, or logins from unfamiliar hosts should be treated as a sign that the campaign may already have shifted from initial access to persistence.

What organisations should verify before they assume they are safe

It is not enough to have controls in place on paper. Organisations should verify that email protections actually block malicious delivery paths, that endpoint controls can see suspicious credential use, and that identity protections are strong enough to challenge abnormal access even when a password is valid. The control objective is to make stolen access noisy and short-lived.

Threat Actor Groups Guide is useful when teams want to translate campaign reporting into threat-informed defensive priorities, especially where adversary naming, clustering and campaign tracking shape hunt plans and escalation.

Verification should also include recovery assumptions. If an attacker already obtained valid credentials, teams need to know whether session revocation, password reset, key rotation, mailbox rule review and privileged access review can be completed quickly enough to matter. A defence plan that cannot be executed at speed is only partly defensive.

Risk and Threat Considerations

The main risk is not a single compromised account, but the way one trusted login can become a platform for broader compromise. Once the attacker can use legitimate credentials or administrative channels, detection becomes harder and lateral movement becomes easier, especially where remote access is broad and segmentation is weak.

Failure mechanism: An initial phishing, endpoint or credential event leads to valid access that bypasses perimeter-style controls, then persistence is maintained through mailbox rules, remote administration, stolen sessions or privileged tooling.

Impact: The attacker can exfiltrate data, expand access to critical assets, and remain present long enough to outlast a weak cleanup effort or partial reset.

Practitioner Guidance

What to prioritise: Start with the account types and systems that would let an attacker do the most harm if abused, especially privileged users, remote access paths and email accounts tied to operations. Those are the places where stolen access most often turns into campaign-wide impact.

What to verify: Confirm that privileged sessions can be revoked, suspicious mailbox persistence can be removed, and segmentation prevents a compromised endpoint from reaching core systems without additional approval or strong step-up controls.

Common mistake: Treating the campaign as a single alert or endpoint event. In practice, the deciding factor is usually whether the organisation can spot credential abuse early enough to stop persistence before the attacker normalises access.

Practitioner takeaway: The best defence is to make every stolen credential, session and remote path short-lived, observable and insufficient on its own to reach critical assets.

Related resources from NHI Mgmt Group

• How can organisations defend against Operation Triangulation?
• How can organisations defend against Operation Dream Job?
• How can organisations defend against Operation Sharpshooter?
• How can organisations defend against Operation Honeybee?