The US cybersecurity agency CISA on Thursday issued an emergency directive mandating that all federal agencies immediately hunt for signs of a known Russian APT that broke into Microsoft's corporate network and pivoted to steal sensitive correspondence from US government agencies.
The directive comes less than three months after Redmond disclosed the embarrassing hack and confirmed the 'Midnight Blizzard' attackers also stole source code and may still be poking around its internal computer systems.
The agency warned that the Russian government-backed hackers are using information initially exfiltrated from the corporate email systems - including authentication details shared between Microsoft customers and Microsoft by email - to gain, or attempt to gain, additional access to Microsoft customer systems.
The agency said it worked with the world's largest software maker to notify all federal agencies whose email correspondence with Microsoft was identified as exfiltrated by the Midnight Blizzard threat actor.
The agency said Micrsooft also agreed to provide metadata for all exfiltrated federal agency correspondence - regardless of the presence of authentication secrets - upon the request of the National Cyber Investigative Joint Task Force, which is the single federal point of contact for this incident.
Earlier this year, Microsoft said the professional hacking team used a password spray attack to compromise a legacy non-production test tenant account and gain a foothold, and then used the account's permissions to access a very small percentage of Microsoft corporate email accounts.
The company said its security team detected the nation-state attack on our corporate systems on January 12, 2024 and traced the infection back to November 2023.
The discovery of Russian hackers in Microsoft's network comes less than six months after Chinese cyberspies were caught using forged authentication tokens using a stolen Azure AD enterprise signing key to break into M365 email inboxes.
This Cyber News was published on www.securityweek.com. Publication date: Thu, 11 Apr 2024 21:43:03 +0000