Security News > 2021 > January > Mimecast Certificate Hacked in Microsoft Email Supply-Chain Attack
"First, if the stolen certificate was used for Mimecast customers to verify the validity of the servers their users' connect to, it would allow an attacker that was able to man-in-the middle the user to server connection to easily decrypt the encrypted data stream and access potentially sensitive information."
Kevin Bocek, vice president of security strategy and threat intelligence at Venafi, told Threatpost that attackers could also possibly disable Office 365's Mimecast protections altogether to make an email-borne attack more effective.
When reached for comment, a Mimecast spokesperson only said, "Our investigation is ongoing and we don't have anything additional to share at this time. All updates from Mimecast will be delivered through our blog."
In the meantime, Mimecast has issued a new certificate and is urging users to re-establish their connections with the fresh authentication.
Researchers speaking anonymously to Reuters about the Mimecast incident told the outlet that they suspected the same advanced persistent threat responsible for the SolarWinds supply-chain attack is at work here.
"The attack against Mimecast and their secure connection to Microsoft's Office 365 infrastructure appears to be the work of the same sophisticated attackers that breached SolarWinds and multiple government agencies," Saryu Nayyar, CEO at Gurucul, said via email.
News URL
https://threatpost.com/mimecast-certificate-microsoft-supply-chain-attack/162965/
Related news
- Microsoft: Hackers steal emails in device code phishing attacks (source)
- Hackers use FastHTTP in new high-speed Microsoft 365 password attacks (source)
- Microsoft fixes under-attack privilege-escalation holes in Hyper-V (source)
- Microsoft shares temp fix for Outlook crashing when writing emails (source)
- Ransomware gangs pose as IT support in Microsoft Teams phishing attacks (source)
- PlushDaemon APT Targets South Korean VPN Provider in Supply Chain Attack (source)
- IPany VPN breached in supply-chain attack to push custom malware (source)
- Supply chain attack hits Chrome extensions, could expose millions (source)
- Week in review: 48k Fortinet firewalls open to attack, attackers “vishing” orgs via Microsoft Teams (source)
- Microsoft Teams phishing attack alerts coming to everyone next month (source)