SolarWinds fallout: DOJ says hackers accessed its Microsoft O365 email server

The US Department of Justice confirmed in the present day that the hackers behind the SolarWinds provide chain assault focused its IT programs, the place they escalated entry from the trojanized SolarWinds Orion app to maneuver throughout its inside community and entry the email accounts of a few of its staff.

“At this level, the variety of doubtlessly accessed O365 mailboxes seems restricted to round 3-percent and we now have no indication that any labeled programs have been impacted,” DOJ spokesperson Marc Raimondi stated in a brief press release revealed earlier in the present day.

With DOJ worker numbers estimated at round 100,000 to 115,000, the variety of impacted DOJ staff is at the moment believed to be round 3,000 to three,450.

The DOJ stated it has now blocked the attacker’s level of entry.

The DOJ now joins an extended record of corporations and authorities companies that publicly admitted to having been impacted within the SolarWinds hack. Previous victims embody the likes of:

• The US Treasury Department
• The US Department of Commerce’s National Telecommunications and Information Administration (NTIA)
• The Department of Health’s National Institutes of Health (NIH)
• The Cybersecurity and Infrastructure Agency (CISA)
• The Department of Homeland Security (DHS)
• The US Department of State
• The National Nuclear Security Administration (NNSA)
• The US Department of Energy (DOE)
• Three US state governments
• City of Austin
• Many lots of extra, similar to Cisco, Intel, VMWare, and others.

SolarWinds hack a part of a Russian intelligence-gathering effort

The SolarWinds supply chain attack got here to mild on December 14 when Microsoft and FireEye confirmed that hackers gained entry to the inner community of IT software program firm SolarWinds the place they inserted malware inside a number of replace packages for the Orion software program stock and IT monitoring platform.

Around 18,000 non-public corporations and authorities organizations downloaded these trojanized Orion updates and have been contaminated with a model of the Sunburst (Solorigate) backdoor trojan.

However, in a subsequent evaluation revealed because the authentic assault, safety companies and US cyber-security companies investigating the hack stated that hackers escalated the assault solely on just a few of the contaminated corporations.

This escalation relied on deploying a second-phase malware pressure named Teardrop, taking management of the native community, after which pivoting to realize entry to the sufferer firm’s cloud and email infrastructure, with the aim of gathering intelligence on the goal’s latest actions.

In a joint assertion revealed yesterday, the FBI, CISA, ODNI, and the NSA attributed the SolarWinds provide chain assault to an Advanced Persistent Threat (APT) actor, likely Russian in origin.”

The 4 companies described the complete SolarWinds operation as “an intelligence gathering effort,” relatively than an operation seeking to destroy or trigger mayhem amongst US IT infrastructure.