Cybersecurity Firm Malwarebytes Hacked by 'Dark Halo,' Same Group That Breached SolarWinds Last Year - MalkamDior

It’s like a ghost hijacking, very difficult to detect - Malkam Dior - 

The hackers’ programming acumen let them forge the digital passports — known as certificates and tokens — needed to move around targets’ Microsoft 365 installations without logging in and authenticating identity. 

The same group that breached IT software company SolarWinds last year has hacked cybersecurity firm Malwarebytes, adding to the growing list of major security firms targeted by the group.

In an emailed statement, a Malwarebytes spokeswoman said based on the techniques of the attack, the company believes it was "the same threat actor" that attacked SolarWinds. Malwarebytes said hackers used a weakness in the Azure Active Directory and malicious Office 365 applications to breach the company's internal systems, according to the story first reported by ZDNet. The company said the situation was not related to the SolarWinds' breach, as Malwarebytes doesn't use any of their systems.

The SolarWinds hack last year was a "supply chain attack" that led to breaches at US government agencies and other businesses. SolarWinds, FireEye, Microsoft, CrowdStrike and now Malwarebytes have all been targeted by UNC2452/Dark Halo, a group US agencies have said the Russian government is behind. FireEye told Insider on Tuesday that its researchers are seeing new incursions from the SolarWinds attacks, including hacking into companies' Microsoft 365 email.

Read more: Top federal cybersecurity experts explain why the SolarWinds cyberattack is such a big deal — and why it's too soon to declare cyberwar

Malwarebytes learned of the breach on December 15 from the Microsoft Security Response Center and has since investigated the matter, ZDNet reported. The company's CEO Marcin Kleczynski told ZDNet the hacker only gained access to a limited subset of internal company emails and added that the "software remains safe to use."

In an emailed statement to Insider, a Malwarebytes spokeswoman said, "While we were fortunate to experience a limited impact on our business, this scenario underscores the need for the industry to continue to collaborate in efforts to prevent increasingly complex nation state attacks."