Microsoft recommends potentially affected customers use a hardware security module (HSM) to prevent another piece of malware from stealing secrets from AD FS servers.
End of September 2021 Microsoft published news about FoggyWeb, another sophisticated persistent backdoor hack which is designed to steal credentials and compromise the contents of Microsoft AD FS servers. The hack is believed to be associated with Nobelium, a group of suspected state-sponsored hackers believed responsible for the devastating SolarWinds hack.
You can read more about Microsoft's recommendations here.
