Saturday , February 15 2025
CISA

CISA immediately orders agencies to mitigate risk impacted by Microsoft hack

CISA has ordered U.S. federal agencies to address risks from the breach of multiple Microsoft email accounts by the Russian APT29 hacking group.

Emergency Directive 24-02 requires Federal Civilian Executive Branch (FCEB) agencies to investigate affected emails, reset any compromised credentials, and secure privileged Microsoft Azure accounts.

Xploit_Cr3w and Blind_Virus, champion for BCS CTF contest

Xploit_Cr3w and Blind_Virus are the two champion teams categorically for BCS ICT Fest 2025 arranged jointly by BCS and BUET....
Read More
Xploit_Cr3w and Blind_Virus, champion for BCS CTF contest

Salt Typhoon Exploits Vulnerable Cisco Devices of Telcoms Globally

Between December 2024 and January 2025, Recorded Future's Insikt Group discovered a campaign targeting unpatched Cisco devices used by major...
Read More
Salt Typhoon Exploits Vulnerable Cisco Devices of Telcoms Globally

CISA Releases Advisories For 20 Industrial Control Systems (ICS)

On February 13, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued 20 advisories about serious vulnerabilities in Industrial Control...
Read More
CISA Releases Advisories For 20 Industrial Control Systems (ICS)

“Astaroth” Phishing Kit Bypasses 2FA Of Gmail, Yahoo, AOL, M365

The new Astaroth Phishing Kit can bypass two-factor authentication to steal login credentials for Gmail, Yahoo, and Microsoft. It uses...
Read More
“Astaroth” Phishing Kit Bypasses 2FA Of Gmail, Yahoo, AOL, M365

CVE-2023-38831
Malware campaign target Bangladeshi Government Entities: Report

A sophisticated malware campaign is targeting military and government entities in Bangladesh. It uses social engineering to deliver malicious files...
Read More
CVE-2023-38831  Malware campaign target Bangladeshi Government Entities: Report

(CVE-2025-1146
CrowdStrike Fixed High-Severity TLS Vuln in Falcon Sensor

CrowdStrike has issued a security advisory for a serious TLS vulnerability, CVE-2025-1146, in its Falcon Sensor for Linux, Falcon Kubernetes...
Read More
(CVE-2025-1146  CrowdStrike Fixed High-Severity TLS Vuln in Falcon Sensor

CVE-2025-0108 & CVE-2025-0110
Palo Alto Networks Addressed High-Severity PAN-OS Vulns

Palo Alto Networks has issued advisories for two critical vulnerabilities in its PAN-OS. The vulnerabilities, CVE-2025-0108 and CVE-2025-0110, may enable...
Read More
CVE-2025-0108 & CVE-2025-0110  Palo Alto Networks Addressed High-Severity PAN-OS Vulns

Update Now
Ivanti Patches 3 Critical Flaws in Connect Secure and Policy Secure

Ivanti has released security updates for Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Secure Access Client (ISAC)...
Read More
Update Now  Ivanti Patches 3 Critical Flaws in Connect Secure and Policy Secure

This Adtech Company is Powering Surveillance of U.S. Military Personnel

Last year, a joint investigation revealed that a Florida-based data broker, Datastream Group, was selling highly sensitive location data that...
Read More
This Adtech Company is Powering Surveillance of U.S. Military Personnel

Intel Patched 374 Vulnerabilities in multiple products

In 2024, Intel addressed a remarkable 374 vulnerabilities across its software, firmware, and hardware products, distributing bug bounty rewards for...
Read More
Intel Patched 374 Vulnerabilities in multiple products

CISA reports that Russian SVR operatives are using information stolen from Microsoft’s corporate email systems to access certain customer systems.

“This Emergency Directive requires immediate action by agencies to reduce risk to our federal systems. For several years, the U.S. government has documented malicious cyber activity as a standard part of the Russian playbook; this latest compromise of Microsoft adds to their long list,” said CISA Director Jen Easterly on Thursday.

“We will continue efforts in collaboration with our federal government and private sector partners to protect and defend our systems from such threat activity.”

Federal agencies’ emails stolen:

The affected federal agencies have been informed by Microsoft and the U.S. cybersecurity agency about the exfiltration of their email correspondence by the Russian hackers.

CISA’s new directive confirms that federal agency emails were taken in the January Microsoft Exchange breaches, the first time the U.S. government has acknowledged this.

CISA has ordered agencies to find all agency correspondence with compromised Microsoft accounts and analyze the cybersecurity impact by April 30, 2024.

Those who detect signs of authentication compromises are required to:

Take immediate remediation action for tokens, passwords, API keys, or other authentication credentials known or suspected to be compromised.
For any known or suspected authentication compromises identified through action 1 by April 30, 2024:
Reset credentials in associated applications and deactivate associated applications that are no longer of use to the agency.
Review sign-in, token issuance, and other account activity logs for users and services whose credentials were suspected or observed as compromised for potential malicious activity.

ED 24-02 only applies to FCEB agencies. However, the exfiltration of Microsoft corporate accounts may affect other organizations. These organizations should seek guidance from their Microsoft account teams.

All organizations should use strong passwords, enable multifactor authentication when possible, and avoid sharing sensitive information through unsecured channels.

APT29’s Microsoft hacks:

In January, Microsoft revealed that APT29 hackers (also tracked as Midnight Blizzard and NOBELIUM) had breached its corporate email servers following a password spray attack that led to the compromise of a legacy non-production test tenant account.

The company later disclosed that the test account didn’t have MFA enabled, allowing the hackers to access Microsoft’s systems.

The account also had access to an OAuth application with elevated access to Microsoft’s corporate environment, which let the attackers access and steal data from corporate mailboxes. These email accounts belonged to Microsoft’s leadership team members and an undisclosed number of employees in the company’s cybersecurity and legal departments.

APT29 gained notoriety after the 2020 SolarWinds supply chain attack, which resulted in the breach of some U.S. federal agencies and numerous companies, including Microsoft.

Microsoft later confirmed the attack allowed the Russian hacking group to steal source code for some Azure, Intune, and Exchange components.

In June 2021, the APT29 hackers again breached a Microsoft corporate account, providing them access to customer support tools.

Source: CISA, Bleepingcomputer

Check Also

February 2025 Patch

Microsoft 2025 February Patch Tuesday fixes 2 zero-days, 55 flaws

Microsoft’s February 2025 Patch Tuesday includes security updates for 55 vulnerabilities, including four zero-days, two …

Leave a Reply

Your email address will not be published. Required fields are marked *