Lessons to learn from last week’s email breach on federal agencies by a Chinese APT group

We learned early last week that a group of Chinese hackers exploited a vulnerability in Microsoft’s cloud email service to gain access to the cloud-based email accounts at 25 organizations.

The attackers primarily targeted West European organizations, but there were also reports in the mainstream press that U.S. government agencies such as the Commerce and State departments were hacked.

An investigation by Microsoft determined that this group – coined Storm-0558 – forged authentication tokens to compromise the email accounts, most likely to gain access to data residing in those systems for espionage purposes.

Cyberattacks are happening all time and every day, but nation-state attacks are a different beast – not only because of their implications for national security, but also because they are typically very difficult to detect. These threat groups are highly selective in their targeting, compared to most cybercriminals who operate opportunistically, are incredibly sophisticated in their attack techniques, and have substantial funding to carry out their operations.

The attack by Storm-0558 wasn’t a “smash and grab” scenario more typical of high-volume/low-yield spam and credential phishing attacks – it was an advanced and strategically-executed attack. Nation-state attackers have the resources and skills to break into accounts, and they can also go undetected once inside. In this attack, the Storm-0558 attackers were lurking within government email accounts, with access to the data in those accounts, for as long as a month before targeted agencies noticed anomalous mail activity.

What can we learn from this incident?

Although this particular incident was targeted at the U.S. government, there are important lessons that any organization can take away from this when it comes to mitigating advanced email compromise attacks.

In the case of the Storm-0558 attack, the threat actors accessed target accounts by exploiting a vulnerability they found in the authentication process. Because every attack is different, security teams may not know of an undiscovered or undisclosed vulnerability that could lead to an account takeover.

Remaining a step ahead and ensuring the best means of protection requires a layered security approach. Start by diligently exercising foundational security measures, including multi-factor authentication to ensure airtight email account access. From there, continue building up defenses with a strong vulnerability and application security program.

But while these steps can prevent initial infiltration, it’s important to consider a means of detection in the instance that an attacker does manage to gain access to an account. Today’s cybercriminals are only getting savvier and it’s much more likely than not that you will experience a compromised account at some point.

Security teams should consider behavior-based anomaly detection that leverages artificial intelligence, especially when focused on the identity and behavior of the account holder. Organizations should not have to rely on human detection to catch suspicious activity — cybercriminals have gotten too good at flying under the radar. Detection needs to happen in seconds, especially in organizations with high-value intelligence like the federal government.

Advanced email attacks – whether by sophisticated nation-state operations seeking high-value national intelligence, or by petty criminals after a simple money grab – are only continuing to increase, and organizations need to harden their defenses accordingly. By layering security protections with an emphasis on detection and remediation, security teams can put themselves in the best position to defend against today’s threat landscape.

Mike Britton, chief information security officer, Abnormal Security