Yesterday, Mimecast put out a blog informing customers and partners of a recent compromise by a suspected sophisticated threat actor.
"Microsoft recently informed us that a Mimecast-issued certificate provided to certain customers to authenticate Mimecast Sync and Recover, Continuity Monitor, and IEP products to Microsoft 365 Exchange Web Services has been compromised by a sophisticated threat actor.
Approximately 10 percent of our customers use this connection. Of those that do, there are indications that a low single digit number of our customers’ M365 tenants were targeted. We have already contacted these customers to remediate the issue.
As a precaution, we are asking the subset of Mimecast customers using this certificate-based connection to immediately delete the existing connection within their M365 tenant and re-establish a new certificate-based connection using the new certificate we’ve made available. Taking this action does not impact inbound or outbound mail flow or associated security scanning.
The security of our customers is always our top priority. We have engaged a third-party forensics expert to assist in our investigation, and we will work closely with Microsoft and law enforcement as appropriate."
Cyber experts weighed-in on this development:
Vishal Jain, CTO at Valtix, a Santa Clara, Calif.-based provider of cloud native network security services:
“With the recently issued NSA advisory wherein the recommendation is to use TLS1.2 with perfect forward secrecy cipher suites or TLS1.3, the issue of a compromised key becomes moot. This problem exists if you don't follow this recommendation. We recommend taking out the misconfiguration possibility by only supporting PFS suites. You can also add the good practice of having (1) CRLs and/or (2) OCSP in place. Both are a bit expensive for handshakes, but can help in revoking compromised certs where the key exchange for a new session was not PFS protected.”
Terence Jackson, Chief Information Security Officer at Thycotic, a Washington D.C. based provider of privileged access management (PAM) solutions:
“The certificates that were compromised were used by Mimecast email security products. These products would access customers Microsoft 365 exchange servers in order for them to provide security services (backup, spam, and phishing protection). Since these certificates were legit, an adversary would have been able to connect without raising suspicions to eavesdrop and exfiltrate email communications.”