CISA orders agencies impacted by Microsoft hack to mitigate risks

Emergency Directive 24-02 was issued to Federal Civilian Executive Branch (FCEB) agencies on April 2. It requires them to investigate potentially affected emails, reset any compromised credentials (if any), and take measures to secure privileged Microsoft Azure accounts.

CISA says Russian Foreign Intelligence Service (SVR) operatives now use information stolen from Microsoft's corporate email systems, including the authentication details shared between Microsoft and its customers by email, to gain access to certain customer systems.

"This Emergency Directive requires immediate action by agencies to reduce risk to our federal systems. For several years, the U.S. government has documented malicious cyber activity as a standard part of the Russian playbook; this latest compromise of Microsoft adds to their long list," said CISA Director Jen Easterly on Thursday.

"We will continue efforts in collaboration with our federal government and private sector partners to protect and defend our systems from such threat activity."

Federal agencies' emails stolen

Microsoft and the U.S. cybersecurity agency have already notified all federal agencies whose email correspondence with Microsoft was detected as exfiltrated by the Russian hackers.

CISA's new emergency directive is the first time the U.S. government confirmed that federal agency emails were exfiltrated in the January Microsoft Exchange breaches.

CISA has now ordered affected agencies to identify the full content of the agency correspondence with compromised Microsoft accounts and perform a cybersecurity impact analysis by April 30, 2024.

Those who detect signs of authentication compromises are required to:

1. Take immediate remediation action for tokens, passwords, API keys, or other authentication credentials known or suspected to be compromised.
2. For any known or suspected authentication compromises identified through action 1 by April 30, 2024:
   1. Reset credentials in associated applications and deactivate associated applications that are no longer of use to the agency.
   2. Review sign-in, token issuance, and other account activity logs for users and services whose credentials were suspected or observed as compromised for potential malicious activity.

Even though ED 24-02 requirements exclusively apply to FCEB agencies, the exfiltration of Microsoft corporate accounts may impact other organizations, which are urged to seek guidance from their respective Microsoft account teams.

It's also essential that all organizations, regardless of the impact, adopt strict security measures, including using strong passwords, enabling multifactor authentication (MFA) whenever possible, and refraining from sharing unprotected sensitive information via unsecured channels.