Emails accessed via the Microsoft Graph service
Is malwarebytes safe software#
Malwarebytes software is safe to use given that a thorough analysis of "all Malwarebytes source code, build and delivery processes," did not reveal any signs of unauthorized access or compromise. We do not use Azure cloud services in our production environments." "The investigation indicates the attackers leveraged a dormant email protection product within our Office 365 tenant that allowed access to a limited subset of internal company emails.
"We received information from the Microsoft Security Response Center on December 15 about suspicious activity from a third-party application in our Microsoft Office 365 tenant consistent with the tactics, techniques and procedures (TTPs) of the same advanced threat actor involved in the SolarWinds attacks," Kleczynski added. Malwarebytes discovered that the threat actor that coordinated the SolarWinds hack used applications with privileged access infiltrate the company's Microsoft Office 365 and Azure environments. The threat actor behind the SolarWinds hack is tracked as StellarParticle (CrowdStrike), UNC2452 (FireEye), and Dark Halo (Volexity), and is likely a Russian-backed Advanced Persistent Threat (APT) group according to a joint statement issued by the FBI, CISA, ODNI, and the NSA earlier this month. However, Kleczynski also added that the company did not find evidence of a compromise or unauthorized access to internal production or on-premises environments. "After an extensive investigation, we determined the attacker only gained access to a limited subset of internal company emails." "We can confirm the existence of another intrusion vector that works by abusing applications with privileged access to Microsoft Office 365 and Azure environments.
"While Malwarebytes does not use SolarWinds, we, like many other companies were recently targeted by the same threat actor," Malwarebytes CEO and co-founder Marcin Kleczynski said. Cybersecurity firm Malwarebytes today confirmed that the threat actor behind the SolarWinds supply-chain attack were able to gain access to some company emails.
0 kommentar(er)
