Japanese space agency spotted zero-day attacks while cleaning up attack on M365

JAXA confirmed a late-2023 intrusion that began with a likely VPN vulnerability exploit, which led to compromised Active Directory and Microsoft 365 accounts; multiple unknown malware strains were used and later monitoring detected zero-day attacks. Some personal information in M365 was exposed but investigators found no compromise of classified launch or satellite data, and no public attribution has been made.