Compromised Mimecast Certificates Used to Target M365

Summary

Mimecast, an email security provider used by organizations worldwide, was alerted to an attack in which a sophisticated threat actor compromised an authentication certificate. This certificate is used by approximately 10 percent of Mimecast customers to authenticate Mimecast Sync and Recover, Continuity Monitor, and IEP products to Microsoft 365 Exchange Web Services. Microsoft investigators who informed Mimecast of the attack indicated that a small number of customers’ Microsoft 365 tenants were targeted. Investigators have not disclosed any connection to the SolarWinds incident at the time of this writing.

Recommendations

The NJCCIC urges Mimecast customers using the compromised certificate to follow guidance put forth in the Mimecast blog post and immediately delete the existing connection within their Microsoft 365 tenant. Customers may reestablish a certificate-based connection using a new certificate provided by Mimecast. Additional reporting can be found in the ZDNet article.