Expect to see other certificate chicanery over the next weeks and months…:
[…] Mimecast said it’s asking the 10 percent of its customer base using this certificate-based connection to Microsoft 365 to immediately delete the existing connection within their Microsoft 365 tenant. Customers should then re-establish a new certificate-based connection using a new certificate that Mimecast has made available, according to the company.
“We can confirm that a certificate provided by Mimecast was compromised by a sophisticated actor,” a Microsoft spokesperson told CRN in a statement. “This certificate enables their customers to connect certain Mimecast applications to their M365 tenant. At Mimecast’s request, we are blocking this certificate on Monday, January 18, 2021.” Microsoft 365 customers not using Mimecast are unaffected by the compromise, according to Microsoft.
One of the SolarWinds hackers’ primary persistence and escalation mechanisms has been adding authentication tokens and credentials to highly privileged Microsoft Active Directory domain accounts, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said Dec. 17. In many instances, CISA said the tokens enable access to both on-premises and hosted resources.
One of the main ways the Russian hackers have collected victim information is by compromising the Security Assertion Markup Language (SAML) signing certificate using their escalated Active Directory privileges, CISA said. Hosted email services, hosted business intelligence applications, travel systems, timecard systems, and file storage services (such as SharePoint) commonly use SAML, according to CISA.