Hackers Compromise Mimecast Certificate For Microsoft Authentication

The certificate used to authenticate Mimecast’s Sync and Recover, Continuity Monitor and Internal Email Protect (IEP) products to Microsoft 365 has been compromised by a sophisticated threat actor.

A sophisticated threat actor compromised a Mimecast certificate used to authenticate several of the company’s products to Microsoft 365 Exchange Web Services, Mimecast disclosed Tuesday.

The Lexington, Mass.-based email security vendor said the certificate used to authenticate its Sync and Recover, Continuity Monitor and Internal Email Protect (IEP) products to Microsoft 365 has been compromised. Mimecast said it was recently informed of the compromise by Microsoft.

Mimecast’s stock is down $2.40 per share (4.67 percent) to $49 per share in pre-market trading Tuesday, which is the lowest the company’s stock has traded since Dec. 15. Mimecast declined to answer questions about whether the compromise of its certificate was carried out by the same threat actor who for months injected malicious code into the SolarWinds Orion network monitoring tool.

[Related: SolarWinds Hackers Gain Access To Microsoft’s Source Code]

Approximately 10 percent of Mimecast’s customers use the compromised connection, according to the company. Of those that do, Mimecast said currently indications are that a low-single-digit number of Mimecast customers’ Microsoft 365 tenants were actually targeted. Mimecast said it has already contacted the customers with targeted Microsoft 365 tenants to remediate the issue.

“The security of our customers is always our top priority,” Mimecast said in a statement issued Tuesday morning. “We have engaged a third-party forensics expert to assist in our investigation, and we will work closely with Microsoft and law enforcement as appropriate.”

Mimecast said it’s asking the 10 percent of its customer base using this certificate-based connection to Microsoft 365 to immediately delete the existing connection within their Microsoft 365 tenant. Customers should then re-establish a new certificate-based connection using a new certificate that Mimecast has made available, according to the company.

“We can confirm that a certificate provided by Mimecast was compromised by a sophisticated actor,” a Microsoft spokesperson told CRN in a statement. “This certificate enables their customers to connect certain Mimecast applications to their M365 tenant. At Mimecast’s request, we are blocking this certificate on Monday, January 18, 2021.” Microsoft 365 customers not using Mimecast are unaffected by the compromise, according to Microsoft.

One of the SolarWinds hackers’ primary persistence and escalation mechanisms has been adding authentication tokens and credentials to highly privileged Microsoft Active Directory domain accounts, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said Dec. 17. In many instances, CISA said the tokens enable access to both on-premises and hosted resources.

One of the main ways the Russian hackers have collected victim information is by compromising the Security Assertion Markup Language (SAML) signing certificate using their escalated Active Directory privileges, CISA said. Hosted email services, hosted business intelligence applications, travel systems, timecard systems, and file storage services (such as SharePoint) commonly use SAML, according to CISA.

Microsoft, however, said Dec. 31 that it hasn’t any found any evidence that the SolarWinds hackers abused forged SAML tokens against the company’s own corporate domains. The colossal SolarWinds hacking campaign is believed to have been carried out by the Russian foreign intelligence service, or APT29.

Microsoft disclosed Dec. 31 that an account compromised by suspected Russian hackers had been used to view source code in a number of source code repositories, but none of the code itself was altered. The compromised Microsoft account didn’t have permissions to modify any code or engineering systems, and an investigation confirmed no changes were made, Microsoft said at the time.

A week earlier, CrowdStrike disclosed that the hackers behind the SolarWinds attack had attempted to hack the company through a Microsoft reseller’s Azure account but were ultimately unsuccessful. The reseller’s Azure account was used for managing CrowdStrike’s Microsoft Office licenses, and the hackers failed in their attempt to read the company’s email since CrowdStrike doesn’t use Office 365 email.