To help US government agencies defend against foreign state-sponsored adversaries, Microsoft is expanding its free logging features in some products.
A Cybersecurity and Infrastructure Security Agency (CISA) announcement revealed reported all US federal agencies using Microsoft Pureview Audit will be granted the upgrade, regardless of their license tier.
The move comes in response to a cyberattack against U.S. government agencies that was discovered last summer.
Logs to the rescue
In July 2023, the US State Department tipped Microsoft off on a cyber-espionage campaign that leveraged forged authentication tokens for Outlook Web Access in Exchange Online, and Outlook.com.
Microsoft later attributed the attack to Storm-0558, allegedly a Chinese state-sponsored threat actor usually engaged in cyber-espionage against Western organizations and governments. Storm-0558 gained access to more than two dozen email accounts and obtained an unknown amount of sensitive information.
The US State Department was able to discover the attack by analyzing unclassified Microsoft 365 audit logs, available in Microsoft Pureview Audit for Premium subscribers.
"Storm-0558 operates with a high degree of technical tradecraft and operational security," Microsoft explained. "The actors are keenly aware of the target's environment, logging policies, authentication requirements, policies, and procedures."
China denied any wrongdoing, and called the US "the world's biggest hacking empire and global cyber thief." The Chinese added it was "high time that the U.S. explained its cyber attack activities and stopped spreading disinformation to deflect public attention."
Storm-0558 apparently used two malware, Bling and Cigril, with the latter being described as a trojan capable of decrypting encrypted files and running them directly from system memory on the target endpoint.
Via TheHackerNews
More from TechRadar Pro
- Ransomware is hitting the financial services industry harder than ever before
- Here's a list of the best firewalls around today
- These are the best endpoint security tools right now
