CISA has issued a new emergency directive ordering U.S. federal agencies to address risks resulting from the breach of multiple Microsoft corporate email accounts by the Russian APT29 hacking group.
It requires them to investigate potentially affected emails, reset any compromised credentials, and take measures to secure privileged Microsoft Azure accounts.
CISA says Russian Foreign Intelligence Service operatives now use information stolen from Microsoft's corporate email systems, including the authentication details shared between Microsoft and its customers by email, to gain access to certain customer systems.
Microsoft and the U.S. cybersecurity agency have already notified all federal agencies whose email correspondence with Microsoft was detected as exfiltrated by the Russian hackers.
CISA has ordered affected agencies to identify the full content of the agency correspondence with compromised Microsoft accounts and perform a cybersecurity impact analysis by April 30, 2024.
Take immediate remediation action for tokens, passwords, API keys, or other authentication credentials known or suspected to be compromised.
For any known or suspected authentication compromises identified through action 1 by April 30, 2024: Reset credentials in associated applications and deactivate associated applications that are no longer of use to the agency.
Review sign-in, token issuance, and other account activity logs for users and services whose credentials were suspected or observed as compromised for potential malicious activity.
Even though ED 24-02 requirements exclusively apply to FCEB agencies, the exfiltration of Microsoft corporate accounts may impact other organizations, which are urged to seek guidance from their respective Microsoft account teams.
In January, Microsoft revealed that APT29 hackers had breached its corporate email servers following a password spray attack that led to the compromise of a legacy non-production test tenant account.
The company later disclosed that the test account didn't have MFA enabled, allowing the hackers to access Microsoft's systems.
The account also had access to an OAuth application with elevated access to Microsoft's corporate environment, which let the attackers access and steal data from corporate mailboxes.
These email accounts belonged to Microsoft's leadership team members and an undisclosed number of employees in the company's cybersecurity and legal departments.
APT29 gained notoriety after the 2020 SolarWinds supply chain attack, which resulted in the breach of some U.S. federal agencies and numerous companies, including Microsoft.
Microsoft later confirmed the attack allowed the Russian hacking group to steal source code for some Azure, Intune, and Exchange components.
In June 2021, the APT29 hackers again breached a Microsoft corporate account, providing them access to customer support tools.
Microsoft still unsure how hackers stole MSA key in 2023 Exchange attack.
Microsoft expands free logging capabilities after May breach.
CISA says Sisense hack impacts critical infrastructure orgs.
Acuity confirms hackers stole non-sensitive govt data from GitHub repos.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 11 Apr 2024 17:50:28 +0000