Kevin Beaumont
PSA to orgs: if you use Microsoft 365, check your email logs for an email from mbsupport@microsoft.com
Microsoft are emailing tenant admin email addresses about a breach by Midnight Blizzard - you might not get the emails due to spam filtering etc.
https://www.reddit.com/r/microsoft/comments/1dowpf9/midnight_blizzard_microsoft_email_data_sharing/ #threatintel
ian spence :yikes:
@GossiTheDog "Customer Success Account Manager (CSAM)"
NO. WHO APPROVED THIS.
Kevin Beaumont
I would suggest orgs who use M365 want to check their Exchange Online logs for that email address.
Kevin Beaumont
Just to be super clear, these are legit emails. Microsoft didn’t follow their M365 customer data breach notification process.
Kevin Beaumont
Also, if you don’t use M365, check your email logs anyway.
Kevin Beaumont
I’ve blown this up on LinkedIn now as it’s clear from talking to lots of impacted orgs they’ve found out about their breach from me.
The emails in the MS notification flow don’t even pass SPF, DKIM. It’s great that MS are being transparent — but they need to get down how to notify orgs.
faebudo
@GossiTheDog I'vejust read that mail. Didn't we learn from Qualys a few days ago that CSAM is not a good acronym in cybersecurity?
Also according to Microsoft itself that role doesn't exist but a CSM does.
fthy
Over 100 of those secret URLs: https://urlscan.io/search/#page.domain%3Apurviewcustomer.powerappsportals.com
Kevin Beaumont
I know Mastodon didn’t look at the screenshot in this thread as they haven’t freaked out about CSAM being used as a job title 🤣
Kevin Beaumont
Gonna start replying to these saying it’s legit since nobody else is. https://answers.microsoft.com/en-us/msoffice/forum/all/midnight-blizzard-data-sharing-request-email/1c1e90f6-43fc-4c91-ac77-3127fb6a340c
Kevin Beaumont
My favourite part of this saga is aside from the MS breach notification emails not having valid DKIM signing nor SPF, the emails are getting flagged as phishing and submitted to sandboxes.
Each tenant has a unique URL, and I’m tracking over 500 so far - so there’s at least 500 victim orgs.
Dźwiedziu
@GossiTheDog
* I would suggest orgs who use M365 to stop.
FTFY ^_^J
Dan Kletter 🥑
@GossiTheDog @zbender Sounds like you’re saying small companies are just now finding out about the breach? https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
Kevin Beaumont
I’ve had multiple people reach out to me to say Microsoft support have told them the email in the screenshot isn’t legit. It is.
Get the MS support team to talk to Redmond security team if you get caught in that loop.
Also, everybody dealing with this, drink.
Kevin Beaumont
Is there any interest in a Signal group for people dealing with the Midnight Blizzard Microsoft email heist caper?
petrichor
@GossiTheDog yes
Kevin Beaumont
A nice summary of where this is up to so far. Transparency from MS = good and much needed, they just need to execute it better.
Kevin Beaumont
When you send out a data breach notification but don’t tell your security staff 😅
Kevin Beaumont
Does anybody know if Microsoft has tried to notify *all* impacted orgs in this incident (Microsoft corporate email breach), i.e. every org that has emailed or been emailed by Microsoft and had the email stolen?
I can see TechCrunch asked them, but they declined to comment.
Kevin Beaumont
My posts about how to find the Midnight Blizzard Microsoft breach notification have reached over half a million views across social media now (excluding Mastodon, which doesn’t track).
My phone is still orgs finding out about the notification from my posts.
The most impacted parties appear to be Microsoft security customers, and most of my Signal messages are from CISOs.
Kevin Beaumont
Btw one of fave things about it is, after you find the email and follow the instructions, you get invited to a shared tenant at Microsoft for the victims - with ‘this email is not from Microsoft’ written on the email.. from Microsoft.
Graham Sutherland / Polynomial
@GossiTheDog I honestly don't understand how they keep butchering their handling of these situations.
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.