Monday , May 27 2024
CISA

CISA immediately orders agencies to mitigate risk impacted by Microsoft hack

CISA has ordered U.S. federal agencies to address risks from the breach of multiple Microsoft email accounts by the Russian APT29 hacking group.

Emergency Directive 24-02 requires Federal Civilian Executive Branch (FCEB) agencies to investigate affected emails, reset any compromised credentials, and secure privileged Microsoft Azure accounts.

Researcher claimed: Biometrics of Indian Forces Exposed

Jeremiah Fowler, a security researcher, claimed to discover a major vulnerability in India's data security. He found an unprotected database...
Read More
Researcher claimed: Biometrics of Indian Forces Exposed

NSA Releases Guidance on Zero Trust Maturity

The NSA released an information sheet called "Advancing Zero Trust Maturity Throughout the Application and Workload Pillar." This sheet will...
Read More
NSA Releases Guidance on Zero Trust Maturity

Data protection is sovereignty: Mohammad A. Arafat
INFOCOM Dhaka ends promoting cyber resiliency

The two day long 7th edition of INFOCOM, India's biggest business, technology, and leadership event, themed "Sustainable Disruption", concluded today...
Read More
Data protection is sovereignty: Mohammad A. Arafat  INFOCOM Dhaka ends promoting cyber resiliency

Phoenix Summit 2024
Two days phoenix summit ended successfully at Dhaka

TheTeamPhoenix, a non-profit organization, successfully hosted Phoenix Summit 2024, the largest cyber security event in Bangladesh, from May 23-24. This...
Read More
Phoenix Summit 2024  Two days phoenix summit ended successfully at Dhaka

CISA Added Apache Flink CVE-2020-17519 Vulnerability to KEV

CISA warns Apache Flink users about a critical vulnerability. Cybercriminals are exploiting this flaw to compromise systems. Apache Flink is...
Read More
CISA Added Apache Flink CVE-2020-17519 Vulnerability to KEV

Cisco released software updates for CVE 2024-20360

Cisco, a global network solutions leader, has reported a security issue with its Firepower Management Center (FMC) software. This vulnerability,...
Read More
Cisco released software updates for CVE 2024-20360

Ivanti Patches Critical RCE Flaws in Endpoint Manager

Ivanti on Tuesday declare to patch for several products, including fixes for critical vulnerabilities in Endpoint Manager (EPM). Ivanti resolved...
Read More
Ivanti Patches Critical RCE Flaws in Endpoint Manager

German police warn of cyberattacks via Office 365

ompanies in Germany are facing a new wave of cyberattacks. The State Criminal Police Office of North Rhine-Westphalia has issued...
Read More
German police warn of cyberattacks via Office 365

Hacktivists group target Philippines government ransomware attack

SentinelOne researchers found that the Ikaruz Red Team is targeting the Philippines government using different ransomware builders like LockBit, Vice...
Read More
Hacktivists group target Philippines government ransomware attack

CISA ALERT
CISA Warns Exploiting NextGen Healthcare Mirth Connect Flaw

The US cybersecurity agency, CISA, added a flaw in NextGen Healthcare's Mirth Connect product to its catalog of Known Exploited...
Read More
CISA ALERT  CISA Warns Exploiting NextGen Healthcare Mirth Connect Flaw

CISA reports that Russian SVR operatives are using information stolen from Microsoft’s corporate email systems to access certain customer systems.

“This Emergency Directive requires immediate action by agencies to reduce risk to our federal systems. For several years, the U.S. government has documented malicious cyber activity as a standard part of the Russian playbook; this latest compromise of Microsoft adds to their long list,” said CISA Director Jen Easterly on Thursday.

“We will continue efforts in collaboration with our federal government and private sector partners to protect and defend our systems from such threat activity.”

Federal agencies’ emails stolen:

The affected federal agencies have been informed by Microsoft and the U.S. cybersecurity agency about the exfiltration of their email correspondence by the Russian hackers.

CISA’s new directive confirms that federal agency emails were taken in the January Microsoft Exchange breaches, the first time the U.S. government has acknowledged this.

CISA has ordered agencies to find all agency correspondence with compromised Microsoft accounts and analyze the cybersecurity impact by April 30, 2024.

Those who detect signs of authentication compromises are required to:

Take immediate remediation action for tokens, passwords, API keys, or other authentication credentials known or suspected to be compromised.
For any known or suspected authentication compromises identified through action 1 by April 30, 2024:
Reset credentials in associated applications and deactivate associated applications that are no longer of use to the agency.
Review sign-in, token issuance, and other account activity logs for users and services whose credentials were suspected or observed as compromised for potential malicious activity.

ED 24-02 only applies to FCEB agencies. However, the exfiltration of Microsoft corporate accounts may affect other organizations. These organizations should seek guidance from their Microsoft account teams.

All organizations should use strong passwords, enable multifactor authentication when possible, and avoid sharing sensitive information through unsecured channels.

APT29’s Microsoft hacks:

In January, Microsoft revealed that APT29 hackers (also tracked as Midnight Blizzard and NOBELIUM) had breached its corporate email servers following a password spray attack that led to the compromise of a legacy non-production test tenant account.

The company later disclosed that the test account didn’t have MFA enabled, allowing the hackers to access Microsoft’s systems.

The account also had access to an OAuth application with elevated access to Microsoft’s corporate environment, which let the attackers access and steal data from corporate mailboxes. These email accounts belonged to Microsoft’s leadership team members and an undisclosed number of employees in the company’s cybersecurity and legal departments.

APT29 gained notoriety after the 2020 SolarWinds supply chain attack, which resulted in the breach of some U.S. federal agencies and numerous companies, including Microsoft.

Microsoft later confirmed the attack allowed the Russian hacking group to steal source code for some Azure, Intune, and Exchange components.

In June 2021, the APT29 hackers again breached a Microsoft corporate account, providing them access to customer support tools.

Source: CISA, Bleepingcomputer

Check Also

Xaomi

Xiaomi Android Devices Hit by Multiple Flaws

Researchers found multiple vulnerabilities in various applications and system components on Xiaomi devices. “The vulnerabilities …

Leave a Reply

Your email address will not be published. Required fields are marked *