The U.S. Cybersecurity and Infrastructure Security Agency has revealed that Russian government-linked hackers utilized Microsoft’s email system to pilfer government emails. This was disclosed in an emergency directive issued by the agency. The directive, dated April 2, cautioned about hackers exploiting email authentication details to breach Microsoft’s customer systems, including those of government agencies.
This revelation comes after Microsoft’s acknowledgment in March of ongoing struggles with the intruders, dubbed “Midnight Blizzard.” Following this, a separate report from the U.S. Cyber Safety Review Board blamed China for a hack that could have been prevented, citing cybersecurity shortcomings and lack of transparency from Microsoft.
Although specific agencies targeted were not named by CISA, Microsoft affirmed collaboration with affected customers to investigate and mitigate the breach. The Russian Embassy in Washington declined immediate comment.
CISA also warned of potential impacts on non-governmental organizations, urging affected parties to reach out to Microsoft for further assistance.
