IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Mimecast links breach to SolarWinds hackers

The company has confirmed that the Microsoft credentials hack was related to the SolarWinds Orion compromise

Mimecast has confirmed that a recent security incident which saw users’ Microsoft 365 accounts breached was carried out by the same threat actors responsible for the SolarWinds hack.

The major incident saw SolarWinds fall victim to “a highly sophisticated, manual supply chain attack” which was likely conducted by the Russian state. Moscow has denied involvement in the attack but warned businesses in the country that they could be at risk of US retaliation.

Weeks later, Mimecast announced that it had also been the target of a hack, with cyber criminals obtaining one of its digital certificates and abusing it to gain access to clients’ Microsoft 365 accounts.

While previously suspected, it has now been determined that the two incidents are linked. 

Mimecast has revealed on its blog that an internal investigation into the incident found that it “is related to the SolarWinds Orion software compromise and was perpetrated by the same sophisticated threat actor”.

“Our investigation also showed that the threat actor accessed, and potentially exfiltrated, certain encrypted service account credentials created by customers hosted in the United States and the United Kingdom," Mimecast said.

"These credentials establish connections from Mimecast tenants to on-premise and cloud services, which include LDAP, Azure Active Directory, Exchange Web Services, POP3 journaling, and SMTP-authenticated delivery routes."

The cloud cyber security services provider also advised its US and UK-based users “to take precautionary steps to reset their credentials”.

However, it added that it is “not aware that any of the encrypted credentials have been decrypted or misused”.

The company said that it is cooperating with law enforcement and that “elements of the investigation into this threat actor remain ongoing”.

13/01/2021: Mimecast admits hackers accessed users’ Microsoft credentials

Mimecast has admitted that a number of its users may have their Microsoft 365 accounts accessed by “a sophisticated threat actor”.

The security incident involved hackers obtaining one of Mimecast's digital certificates and abusing it to gain access to clients’ accounts.

The cloud cyber security services provider was alerted about the incident by Microsoft, and the two companies are working with a third-party forensics expert and law enforcement to investigate the breach.

According to Mimecast, “approximately 10%” of its customers used the connection involving the affected certificate, with not more than nine customers believed to be affected by the breach.

“There are indications that a low single digit number of our customers’ M365 tenants were targeted,” the company announced in a blog post, adding that it had “already contacted these customers to remediate the issue”.

Mimecast also advised “customers using this certificate-based connection to immediately delete the existing connection within their M365 tenant and re-establish a new certificate-based connection using the new certificate" that the company had "made available”.

The London-based company said that taking this precaution would “not impact inbound or outbound mail flow or associated security scanning”.

The news comes days after it was revealed that the cyber criminals who compromised SolarWinds in a sophisticated supply chain cyber attack broke into Microsoft and accessed the company’s  source code repositories.

However, it was also confirmed that the attackers, linked by US authorities to the Russian state, didn’t alter the codebase at the heart of Microsoft's core products and services. They did so through an internal account that had permissions to view, but not edit, these repositories.

Mimecast also made headlines last year when its Threat Center researchers discovered a rise in LimeRAT malware delivery using Microsoft Excel’s “VelvetSweatshop” default password. The research team found making an Excel file read-only instead of locking it encrypts the file without needing an externally created password to open it.

For some time, hackers had taken advantage of how Excel’s encryption and decryption processes work to distribute malware, Mimecast said at the time.

Featured Resources

Activation playbook: Deliver data that powers impactful, game-changing campaigns

Bringing together data and technology to drive better business outcomes

Free Download

In unpredictable times, a data strategy is key

Data processes are crucial to guide decisions and drive business growth

Free Download

Achieving resiliency with Everything-as-a-Service (XAAS)

Transforming the enterprise IT landscape

Free Download

What is contextual analytics?

Creating more customer value in HR software applications

Free Download

Recommended

What is hacktivism?
hacking

What is hacktivism?

27 May 2022
Mastering endpoint security implementation
Security

Mastering endpoint security implementation

18 May 2022
The Total Economic Impact™ of Apple Mac in Enterprise: M1 update
Whitepaper

The Total Economic Impact™ of Apple Mac in Enterprise: M1 update

12 May 2022
Dell Technologies World 2022: Dell unveils fastest storage architecture in company history
Server & storage

Dell Technologies World 2022: Dell unveils fastest storage architecture in company history

4 May 2022

Most Popular

Linux-based Cheerscrypt ransomware found targeting VMware ESXi servers
ransomware

Linux-based Cheerscrypt ransomware found targeting VMware ESXi servers

26 May 2022
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022
Open source packages with millions of installs hacked to harvest AWS credentials
hacking

Open source packages with millions of installs hacked to harvest AWS credentials

24 May 2022