Mimecast breach investigators probe possible SolarWinds connection

The illicit access would have allowed attackers to spy on Mimecast clients.

Mimecast, a global email security provider, on Tuesday said that one of its software security certificates had been breached by a “sophisticated threat actor” in a targeted operation to access customer emails.

London-based Mimecast has a sprawling footprint, claiming some 39,000 customers around the world. The company said 10% of its customers use the particular software implementation involved in the breach, adding that attackers apparently targeted “a low single-digit number” of customers.

The illicit access would have allowed attackers to spy on Mimecast clients.

The hackers’ methods, and the fact that they targeted Microsoft’s cloud-based email services, have parallels with a suspected Russian hacking campaign that has used tainted software made by contractor SolarWinds to breach multiple U.S. government agencies. A person familiar with the matter told CyberScoop that investigators are examining whether the same attackers who breached SolarWinds also infiltrated Mimecast, a detail first reported by Reuters.

“As a precaution, we are asking the subset of Mimecast customers using this certificate-based connection to immediately delete the existing connection within their [Microsoft 365] tenant and re-establish a new certificate-based connection using the new certificate we’ve made available,” Mimecast said in a statement.  

The attackers behind the SolarWinds’ compromises have used multiple techniques to burrow their way into U.S. government and corporate networks. U.S. Department of Homeland Security officials said last week that the hackers had been assigning tokens and certificates to existing Microsoft 365 software to make it harder for forensic teams to find them.

Microsoft, which has played a key role in investigating the SolarWinds’ breach, told Mimecast it had been compromised, Mimecast said. A Microsoft spokesperson did not immediately respond to a request for comment on Wednesday on whether the same attackers could be responsible.

Mimecast said it had enlisted a “third-party forensic expert” to help investigate. A Mimecast spokesperson declined to comment on who might be behind the breach, citing an ongoing investigation.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure