Lessons Learned from Last Week’s Email Breach on Federal Agencies

Discover key cybersecurity takeaways from last week’s email breach on federal agencies by a Chinese APT group.
July 20, 2023

This article was originally published on SC Media.

Cyberattacks are happening all the time and every day, but nation-state attacks are a different beast—not only because of their implications for national security but also because they are typically very difficult to detect. These types of threat groups are highly selective in their targeting, compared to most cybercriminals who operate opportunistically, are incredibly sophisticated in their attack techniques, and have substantial funding to carry out their operations.

So What Happened Last Week?

We learned early last week that a group of Chinese hackers exploited a vulnerability in Microsoft’s cloud email service to gain access to the cloud-based email accounts at 25 organizations.

The attackers primarily targeted West European organizations, but there were also reports in the mainstream press that U.S. government agencies such as the Commerce and State departments were hacked. An investigation by Microsoft determined that this group—coined Storm-0558—forged authentication tokens to compromise the email accounts, most likely to gain access to data residing in those systems for espionage purposes.

The attack by Storm-0558 wasn’t a “smash and grab” scenario more typical of high-volume/low-yield spam and credential phishing attacks—it was an advanced and strategically-executed attack. Nation-state attackers have the resources and skills to break into accounts, and they can also go undetected once inside. In this attack, the Storm-0558 attackers were lurking within government email accounts, with access to the data in those accounts, for as long as a month before targeted agencies noticed anomalous mail activity.

What Can We Learn from This Incident?

Although this particular incident was targeted at the U.S. government, there are important lessons that any organization can take away from this when it comes to mitigating advanced email compromise attacks.

In the case of the Storm-0558 attack, the threat actors accessed target accounts by exploiting a vulnerability they found in the authentication process. Because every attack is different, security teams may not know of an undiscovered or undisclosed vulnerability that could lead to an account takeover.

Remaining a step ahead and guaranteeing the best means of protection requires a layered security approach. Start by diligently exercising foundational security measures, including multi-factor authentication to ensure airtight email account access. From there, continue building up defenses with a strong vulnerability and application security program.

But while these steps can prevent initial infiltration, it’s important to consider a means of detection in the instance that an attacker does manage to gain access to an account. Today’s cybercriminals are only getting savvier, and it’s much more likely than not that you will experience a compromised account at some point.

How to Stay One Step Ahead of Sophisticated Threat Actors

Security teams should consider behavior-based anomaly detection that leverages artificial intelligence, especially when focused on the identity and behavior of the account holder. Organizations should not have to rely on human detection to catch suspicious activity — cybercriminals have gotten too good at flying under the radar. Detection needs to happen in seconds, especially in organizations with high-value intelligence like the federal government.

Advanced email attacks – whether by sophisticated nation-state operations seeking high-value national intelligence, or by petty criminals after a simple money grab – are only continuing to increase, and organizations need to harden their defenses accordingly. By layering security protections with an emphasis on detection and remediation, security teams can put themselves in the best position to defend against today’s threat landscape.

Interested in learning more about the latest attack trends? Check out our attack library here or if you're ready to see Abnormal in action, schedule a demo below!

See a Demo
Lessons Learned from Last Week’s Email Breach on Federal Agencies

See Abnormal in Action

Get a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

Get AI Protection for Your Human Interactions

Protect your organization from socially-engineered email attacks that target human behavior.
Request a Demo
Request a Demo

Related Posts

B 07 22 24 MKT624 Images for Paris Olympics Blog
Threat actors are targeting French businesses ahead of the Paris 2024 Olympics. Learn how they're capitalizing on the event and how to protect your organization.
Read More
B Cross Platform ATO
Cross-platform account takeover is an attack where one compromised account is used to access other accounts. Learn about four real-world examples: compromised email passwords, hijacked GitHub accounts, stolen AWS credentials, and leaked Slack logins.
Read More
B Why MFA Alone Will No Longer Suffice
Explore why account takeover attacks pose a major threat to enterprises and why multi-factor authentication (MFA) alone isn't enough to prevent them.
Read More
Learn how Abnormal uses natural language processing or NLP to protect organizations from phishing, account takeovers, and more.
Read More
B DK Compromise 7 11 24
Discover the top five ways hackers compromise accounts, from exploiting leaked API credentials to SIM swapping partnerships, and more. Learn how these techniques enable account takeover (ATO) and pose risks to enterprises.
Read More
B Sans Recap 7 11 24
Discover trends among modern SOC teams, including misaligned budgets, increased automation, unsatisfactory AI tools, staffing issues, and more.
Read More