chat
expand_more

Lessons Learned from Last Week’s Email Breach on Federal Agencies

Discover key cybersecurity takeaways from last week’s email breach on federal agencies by a Chinese APT group.
July 20, 2023

This article was originally published on SC Media.

Cyberattacks are happening all the time and every day, but nation-state attacks are a different beast—not only because of their implications for national security but also because they are typically very difficult to detect. These types of threat groups are highly selective in their targeting, compared to most cybercriminals who operate opportunistically, are incredibly sophisticated in their attack techniques, and have substantial funding to carry out their operations.

So What Happened Last Week?

We learned early last week that a group of Chinese hackers exploited a vulnerability in Microsoft’s cloud email service to gain access to the cloud-based email accounts at 25 organizations.

The attackers primarily targeted West European organizations, but there were also reports in the mainstream press that U.S. government agencies such as the Commerce and State departments were hacked. An investigation by Microsoft determined that this group—coined Storm-0558—forged authentication tokens to compromise the email accounts, most likely to gain access to data residing in those systems for espionage purposes.

The attack by Storm-0558 wasn’t a “smash and grab” scenario more typical of high-volume/low-yield spam and credential phishing attacks—it was an advanced and strategically-executed attack. Nation-state attackers have the resources and skills to break into accounts, and they can also go undetected once inside. In this attack, the Storm-0558 attackers were lurking within government email accounts, with access to the data in those accounts, for as long as a month before targeted agencies noticed anomalous mail activity.

What Can We Learn from This Incident?

Although this particular incident was targeted at the U.S. government, there are important lessons that any organization can take away from this when it comes to mitigating advanced email compromise attacks.

In the case of the Storm-0558 attack, the threat actors accessed target accounts by exploiting a vulnerability they found in the authentication process. Because every attack is different, security teams may not know of an undiscovered or undisclosed vulnerability that could lead to an account takeover.

Remaining a step ahead and guaranteeing the best means of protection requires a layered security approach. Start by diligently exercising foundational security measures, including multi-factor authentication to ensure airtight email account access. From there, continue building up defenses with a strong vulnerability and application security program.

But while these steps can prevent initial infiltration, it’s important to consider a means of detection in the instance that an attacker does manage to gain access to an account. Today’s cybercriminals are only getting savvier, and it’s much more likely than not that you will experience a compromised account at some point.

How to Stay One Step Ahead of Sophisticated Threat Actors

Security teams should consider behavior-based anomaly detection that leverages artificial intelligence, especially when focused on the identity and behavior of the account holder. Organizations should not have to rely on human detection to catch suspicious activity — cybercriminals have gotten too good at flying under the radar. Detection needs to happen in seconds, especially in organizations with high-value intelligence like the federal government.

Advanced email attacks – whether by sophisticated nation-state operations seeking high-value national intelligence, or by petty criminals after a simple money grab – are only continuing to increase, and organizations need to harden their defenses accordingly. By layering security protections with an emphasis on detection and remediation, security teams can put themselves in the best position to defend against today’s threat landscape.

Interested in learning more about the latest attack trends? Check out our attack library here or if you're ready to see Abnormal in action, schedule a demo below!

See a Demo
Lessons Learned from Last Week’s Email Breach on Federal Agencies

See Abnormal in Action

Schedule a Demo

Get the Latest Email Security Insights

Subscribe to our newsletter to receive updates on the latest attacks and new trends in the email threat landscape.

 

See the Abnormal Solution to the Email Security Problem

Protect your organization from the full spectrum of email attacks with Abnormal.

See a Demo
 
Integrates Insights Reporting 09 08 22

Related Posts

B Maximize Cybersecurity Awareness Month
It’s the 20th anniversary of Cybersecurity Awareness Month! Make sure your workforce is prepared to combat emerging threats with these 5 tips.
Read More
B Health Care
Email attacks like BEC against the healthcare industry are on the rise in 2023. Protect yourself with sophisticated cloud-native email security.
Read More
B AI Series
Discover how Abnormal's advanced AI models are used to detect abnormalities in email behavior and protect organizations from the most sophisticated email attacks.
Read More
B Insights from Clemson University CISO
John Hoyt, CISO at Clemson University, shares his take on the unique cybersecurity challenges of higher education and how Abnormal Security can help.
Read More
B Nigerian Prince
Scams about the Nigerian Prince that promise millions have been around for decades. But they are transitioning, now using ChatGPT and similar tools to seem more convincing.
Read More
B 9 12 23 ATO
Learn why account takeovers are successful, how to detect and remediate them, and how to better protect yourself from cybercriminals in the future.
Read More