U.S. Federal Agencies Ordered to Hunt for Signs of Microsoft Breach and Mitigate Risks

CISA issued Emergency Directive ED 24-02 after Microsoft confirmed a compromise of its corporate systems by Russian-linked Midnight Blizzard (APT29), which resulted in exfiltration of email correspondence and access to some source code repositories; CISA warned that stolen emails may contain authentication details that could be used to access Microsoft customer systems and directed federal agencies to hunt for compromise, reset credentials, perform impact analyses, and report status.