Monday , April 21 2025
CISA

CISA immediately orders agencies to mitigate risk impacted by Microsoft hack

CISA has ordered U.S. federal agencies to address risks from the breach of multiple Microsoft email accounts by the Russian APT29 hacking group.

Emergency Directive 24-02 requires Federal Civilian Executive Branch (FCEB) agencies to investigate affected emails, reset any compromised credentials, and secure privileged Microsoft Azure accounts.

Samsung phone is saving your passwords in plain text

You copy a password from your manager, thinking it's safe. Meanwhile, your phone is saving it in plain text. Samsung...
Read More
Samsung phone is saving your passwords in plain text

UK Software Firm Exposed 8 million of Healthcare Worker Records

A data leak involving 8 million UK healthcare worker records, including IDs and financial information, was caused by a misconfigured...
Read More
UK Software Firm Exposed 8 million of Healthcare Worker Records

GitHub Enterprise Server Vulns Expose Risk of Code Execution

GitHub has released security updates for GitHub Enterprise Server to fix several vulnerabilities, including a high-severity flaw that could allow...
Read More
GitHub Enterprise Server Vulns Expose Risk of Code Execution

CVE-2025-2492
ASUS warns of critical auth bypass flaw in routers

Hackers can exploit a vulnerability in Asus routers to execute unauthorized functions. This serious issue, rated 9.2 out of 10,...
Read More
CVE-2025-2492  ASUS warns of critical auth bypass flaw in routers

16,000+ Fortinet devices compromised with symlink backdoor, Mostly in Asia

According to Shadowserver Foundation around 17,000 Fortinet devices worldwide have been compromised using a new technique called "symlink". This number...
Read More
16,000+  Fortinet devices compromised with symlink backdoor, Mostly in Asia

Patch now! Critical Erlang/OTP SSH Vuln Allows UCE

A critical security flaw has been found in the Erlang/Open Telecom Platform (OTP) SSH implementation, allowing an attacker to run...
Read More
Patch now! Critical Erlang/OTP SSH Vuln Allows UCE

CISA warns of increasing risk tied to Oracle legacy Cloud leak

On Wednesday, CISA alerted about increased breach risks due to the earlier compromise of legacy Oracle Cloud servers, emphasizing the...
Read More
CISA warns of increasing risk tied to Oracle legacy Cloud leak

CVE-2025-20236
Cisco Patches Unauthenticated RCE Flaw in Webex App

Cisco issued a security advisory about a serious vulnerability in its Webex App that allows unauthenticated remote code execution (RCE)...
Read More
CVE-2025-20236  Cisco Patches Unauthenticated RCE Flaw in Webex App

Apple released emergency security updates for 2 zero-day vulns

On Wednesday, Apple released urgent operating system updates to address two security vulnerabilities that had already been exploited in highly...
Read More
Apple released emergency security updates for 2 zero-day vulns

Oracle Released Patched for 378 flaws for April 2025

On April 15, 2025, Oracle released a Critical Patch Update for 378 flaws for its products. The patch update covers...
Read More
Oracle Released Patched for 378 flaws for April 2025

CISA reports that Russian SVR operatives are using information stolen from Microsoft’s corporate email systems to access certain customer systems.

“This Emergency Directive requires immediate action by agencies to reduce risk to our federal systems. For several years, the U.S. government has documented malicious cyber activity as a standard part of the Russian playbook; this latest compromise of Microsoft adds to their long list,” said CISA Director Jen Easterly on Thursday.

“We will continue efforts in collaboration with our federal government and private sector partners to protect and defend our systems from such threat activity.”

Federal agencies’ emails stolen:

The affected federal agencies have been informed by Microsoft and the U.S. cybersecurity agency about the exfiltration of their email correspondence by the Russian hackers.

CISA’s new directive confirms that federal agency emails were taken in the January Microsoft Exchange breaches, the first time the U.S. government has acknowledged this.

CISA has ordered agencies to find all agency correspondence with compromised Microsoft accounts and analyze the cybersecurity impact by April 30, 2024.

Those who detect signs of authentication compromises are required to:

Take immediate remediation action for tokens, passwords, API keys, or other authentication credentials known or suspected to be compromised.
For any known or suspected authentication compromises identified through action 1 by April 30, 2024:
Reset credentials in associated applications and deactivate associated applications that are no longer of use to the agency.
Review sign-in, token issuance, and other account activity logs for users and services whose credentials were suspected or observed as compromised for potential malicious activity.

ED 24-02 only applies to FCEB agencies. However, the exfiltration of Microsoft corporate accounts may affect other organizations. These organizations should seek guidance from their Microsoft account teams.

All organizations should use strong passwords, enable multifactor authentication when possible, and avoid sharing sensitive information through unsecured channels.

APT29’s Microsoft hacks:

In January, Microsoft revealed that APT29 hackers (also tracked as Midnight Blizzard and NOBELIUM) had breached its corporate email servers following a password spray attack that led to the compromise of a legacy non-production test tenant account.

The company later disclosed that the test account didn’t have MFA enabled, allowing the hackers to access Microsoft’s systems.

The account also had access to an OAuth application with elevated access to Microsoft’s corporate environment, which let the attackers access and steal data from corporate mailboxes. These email accounts belonged to Microsoft’s leadership team members and an undisclosed number of employees in the company’s cybersecurity and legal departments.

APT29 gained notoriety after the 2020 SolarWinds supply chain attack, which resulted in the breach of some U.S. federal agencies and numerous companies, including Microsoft.

Microsoft later confirmed the attack allowed the Russian hacking group to steal source code for some Azure, Intune, and Exchange components.

In June 2021, the APT29 hackers again breached a Microsoft corporate account, providing them access to customer support tools.

Source: CISA, Bleepingcomputer

Check Also

symlink

16,000+ Fortinet devices compromised with symlink backdoor, Mostly in Asia

According to Shadowserver Foundation around 17,000 Fortinet devices worldwide have been compromised using a new …

Leave a Reply

Your email address will not be published. Required fields are marked *