Russian hackers stole federal correspondence with Microsoft
Russian government-linked hackers stole correspondence between a number of U.S. federal agencies and Microsoft in a monthslong hack this year, the Cybersecurity and Infrastructure Security Agency said Thursday.
While the hack itself has been known since January, CISA’s disclosure is the first acknowledgment that federal agency emails with Microsoft were stolen.
The new details are likely to increase scrutiny of Microsoft, which has been under the federal spotlight in recent weeks for a separate hack of its systems by Chinese hackers.
New orders: The extent of the Russian hack was spelled out in an emergency directive issued by CISA on April 2 to federal agencies and made public on Thursday. It ordered agencies to take steps to immediately identify all compromised email correspondence, and to reset credentials for those accounts. The directive was reported last week by CyberScoop, but without mention that the correspondence between Microsoft and federal agencies was specifically targeted.
The directive reported that Russian hacking group Midnight Blizzard breached email accounts at an undisclosed number of federal agencies and stole emails between Microsoft and the agencies. Midnight Blizzard is Microsoft’s name for the prolific Russian government hackers behind the 2016 attack on the Democratic National Committee and for the SolarWinds hack in 2020 that led to the compromise of around a dozen U.S. federal agencies.
Eric Goldstein, executive assistant director for cybersecurity at CISA, said during a call on the directive Thursday that CISA was “not aware” of any breaches in production environments at federal agencies, but said the breach was an “exigent threat” to the government. Goldstein would not comment on the number of agencies impacted by the breach.
Intensification: The directive described the breach as “a grave and unacceptable risk to agencies.” CISA also notes in the document that Microsoft informed the agency that after the initial breach in January, Microsoft saw a “10-fold” increase in the attack overall, including mass efforts to use passwords from other compromised accounts.
CISA noted in the directive that Microsoft had notified all affected agencies, and that Microsoft was providing metadata for all compromised emails. Microsoft noted in a statement Thursday, “as we discover secrets in our exfiltrated email, we are working with our customers to help them investigate and mitigate. This includes working with CISA on an emergency directive to provide guidance to government agencies.”
John Sakellariadis contributed to this report.
