CISA orders agencies impacted by Microsoft hack to mitigate risks

CISA issued Emergency Directive 24-02 after Russian APT29 breached Microsoft corporate email in January, exfiltrating emails — including from U.S. federal agencies — and using stolen authentication details to access customer systems; affected agencies are required to investigate the full content of impacted correspondence, reset compromised credentials, and secure privileged Azure accounts by April 30, 2024.