After the Midnight Blizzard attack in January, Microsoft warned its customers in June via an explanatory email. It's just unfortunate that such an important message ended up in spam, as Microsoft apparently sent it without email authentication such as SPF or DKIM. Security experts are raising the alarm in many channels.
Microsoft was already on January 12, 2024 attacked by Midnight BlizzardThe Russian-sponsored actors apparently had access to email accounts of high-ranking employees. However, the attackers apparently did not have access to customer environments. Microsoft investigated the attack and informed many customers about the security breach in June.
Important Microsoft email has no authentication like SPF or DKIM
Security experts like Kevin Beaumont now warns via LinkedIn Users that important information about the attack does not come via the secure Microsoft 365 portal, but as an email from "[email protected]“ to the client administrators. The security specialist Thanos Vrachnos describes on LinkedIn his customer experience: "Several of my customers received this email. All of them were worried that it was phishing because according to the email headers, no SPF & DKIM were used and the URL mentioned in the email message was hosted as a simple (almost dummy) Azure PowerApp with a simple DV SSL certificate issued by another trusted CA and without any organizational information (all other MS domains have OV/EV certificates issued by Microsoft as a publicly trusted CA)... Well, at first glance, this did not inspire confidence in the recipients, who started asking on forums or contacting Microsoft account managers to finally confirm that the email was legitimate... Strange way for a vendor like this to communicate an important issue to potentially affected customers."
To make the whole chaos perfect, Microsoft Support also responded to inquiries about the email from those responsible on Reddit as follows: "I contacted support and asked if it was real, and the only answer was: 'We don't have an email address from [email protected] known. Do not click on links in emails."
Subscribe to our newsletter now
Read the best news from B2B CYBER SECURITY once a month