Researchers have recently observed a successful ransomware attack against SharePoint Online (Microsoft 365). This attack was conducted through a Microsoft Global Software-as-a-Service (SaaS) administrator account and is currently speculated to have been conducted by the 0mega ransomware operation due to the account name, additional observables, and infrastructure that were created and used. 0mega launched in May 2022 and has been observed targeting organizations around the globe with double-extortion attacks. Few victims have been posted to the group’s leak site and a sample of the ransomware has yet to be reviewed as of June 7, 2023. The researchers shared that the actor created a new Active Directory (AD) user called “Omega” with escalated privileges, which included Global Administrator, SharePoint Administrator, Exchange Administrator, Teams Administrator, and site collection administrator capabilities to various SharePoint collections and sites. It was noted that the actor also removed over 200 existing administrators in just a two (2) hour period. The observed attack exfiltrated files, did not encrypt files on the victim machine, and uploaded thousands of “PREVENT-LEAKAGE.txt” text files. This upload is believed to be for notifying the victim of the exfiltration that occurred and to provide a communication method for negotiating a ransom. Researchers stated that “the attacker invested the time to build automation for this attack, which implies a desire to use this capability in the future,” and emphasized that this type of attack will continue to occur because “there are few companies with a strong SaaS security program, whereas many companies are well invested in endpoint security products.” CTIX analysts will continue to monitor for attacks against SharePoint Online as well as confirmation of the threat group responsible for the observed attack.