We do not use Azure cloud services in our production environments.”
“The investigation indicates the attackers leveraged a dormant email protection product within our Office 365 tenant that allowed access to a limited subset of internal company emails. “We received information from the Microsoft Security Response Center on December 15 about suspicious activity from a third-party application in our Microsoft Office 365 tenant consistent with the tactics, techniques and procedures (TTPs) of the same advanced threat actor involved in the SolarWinds attacks,” the vendor explained. The security vendor said attackers abused applications with privileged access to Microsoft Office 365 and Azure environments.
#MALWAREBYTES SOLARWINDS AZURE PASSWORD#
While many of the organizations caught up in the suspected Russian cyber-espionage campaign were compromised via a malicious SolarWinds Orion update, US government agency CISA had previously pointed to a second threat vector. This involved use of password guessing or spraying and/or exploiting inappropriately secured admin or service credentials. “It is imperative that security companies continue to share information that can help the greater industry in times like these, particularly with such new and complex attacks often associated with nation state actors.Malwarebytes has confirmed that the SolarWinds attackers managed to access internal emails, although via a different intrusion vector to many victims. “While we have learned a lot of information in a relatively short period of time, there is much more yet to be discovered about this long and active campaign that has impacted so many high-profile targets,” Kleczynski said. Malwarebytes is the fourth cybersecurity firm to confirm that its systems were targeted by the threat actor that orchestrated the SolarWinds supply-chain attack after Microsoft, FireEye, and CrowdStrike. This later allowed them to “authenticate using the key and make API calls to request emails via MSGraph.” The SolarWinds hackers also targeted Malwarebytes administrative and service credentials by adding a self-signed certificate with credentials to the Microsoft Graph service principal account. Emails accessed via the Microsoft Graph service
#MALWAREBYTES SOLARWINDS AZURE SOFTWARE#
Malwarebytes software is safe to use given that a thorough analysis of “all Malwarebytes source code, build and delivery processes,” did not reveal any signs of unauthorized access or compromise. “The investigation indicates the attackers exploited an Azure Active Directory weakness that allowed access to a limited subset of internal company emails.” “We received information from the Microsoft Security Response Center on December 15 about suspicious activity from a third-party application in our Microsoft Office 365 tenant consistent with the tactics, techniques and procedures (TTPs) of the same advanced threat actor involved in the SolarWinds attacks,” Kleczynski added.
Malwarebytes discovered that the threat actor that coordinated the SolarWinds hack used applications with privileged access infiltrate the company’s Microsoft Office 365 and Azure environments. The threat actor behind the SolarWinds hack is tracked as StellarParticle (CrowdStrike), UNC2452 (FireEye), and Dark Halo (Volexity), and is likely a Russian-backed Advanced Persistent Threat (APT) group according to a joint statement issued by the FBI, CISA, ODNI, and the NSA earlier this month. However, Kleczynski also added that the company did not find evidence of a compromise or unauthorized access to internal production or on-premises environments. “After an extensive investigation, we determined the attacker only gained access to a limited subset of internal company emails.” “We can confirm the existence of another intrusion vector that works by abusing applications with privileged access to Microsoft Office 365 and Azure environments.
“While Malwarebytes does not use SolarWinds, we, like many other companies were recently targeted by the same threat actor,” Malwarebytes CEO and co-founder Marcin Kleczynski said. Cybersecurity firm Malwarebytes today confirmed that the threat actor behind the SolarWinds supply-chain attack were able to gain access to some company emails.
0 kommentar(er)
