Malwarebytes says SolarWinds hackers accessed its internal emails

Cybersecurity firm Malwarebytes today confirmed that the threat actor behind the SolarWinds supply-chain attack were able to gain access to some company emails.

"While Malwarebytes does not use SolarWinds, we, like many other companies were recently targeted by the same threat actor," Malwarebytes CEO and co-founder Marcin Kleczynski said.

"We can confirm the existence of another intrusion vector that works by abusing applications with privileged access to Microsoft Office 365 and Azure environments.

"After an extensive investigation, we determined the attacker only gained access to a limited subset of internal company emails."

However, Kleczynski also added that the company did not find evidence of a compromise or unauthorized access to internal production or on-premises environments.

The threat actor behind the SolarWinds hack is tracked as StellarParticle (CrowdStrike), UNC2452 (FireEye), and Dark Halo (Volexity), and is likely a Russian-backed Advanced Persistent Threat (APT) group according to a joint statement issued by the FBI, CISA, ODNI, and the NSA earlier this month.

Malwarebytes software is safe to use

Malwarebytes discovered that the threat actor that coordinated the SolarWinds hack used applications with privileged access infiltrate the company's Microsoft Office 365 and Azure environments.

"We received information from the Microsoft Security Response Center on December 15 about suspicious activity from a third-party application in our Microsoft Office 365 tenant consistent with the tactics, techniques and procedures (TTPs) of the same advanced threat actor involved in the SolarWinds attacks," Kleczynski added.

"The investigation indicates the attackers leveraged a dormant email protection product within our Office 365 tenant that allowed access to a limited subset of internal company emails. We do not use Azure cloud services in our production environments."

Malwarebytes software is safe to use given that a thorough analysis of "all Malwarebytes source code, build and delivery processes," did not reveal any signs of unauthorized access or compromise.

Emails accessed via the Microsoft Graph service

The SolarWinds hackers also targeted Malwarebytes administrative and service credentials by adding a self-signed certificate with credentials to the Microsoft Graph service principal account.

This later allowed them to "authenticate using the key and make API calls to request emails via MSGraph."

Malwarebytes is the fourth cybersecurity firm targeted by the SolarWinds hackers, after Microsoft and FireEye confirmed that their systems were infiltrated and CrowdStrike disclosed a failed attack attempt.

"While we have learned a lot of information in a relatively short period of time, there is much more yet to be discovered about this long and active campaign that has impacted so many high-profile targets," Kleczynski said.

"It is imperative that security companies continue to share information that can help the greater industry in times like these, particularly with such new and complex attacks often associated with nation state actors."