Sounds very sophisticated. I'm thinking China...

~~~~~~~~~~~~~~~~~~~~~~
Big US election coming up, security is vital and, oh look... a federal agency just got completely pwned for real
Hacker had set up shop on network using stolen Office 365 accounts
Fri 25 Sep 2020 - Shaun Nichols in San Francisco

An unspecified US government agency was hacked by a miscreant who appears to have made off with archives of information.

This is according to Uncle Sam's Cybersecurity and Infrastructure Security Agency (CISA), which on Thursday went into technical detail on how an intruder: broke into staffers' Office 365 accounts; gained access the agency's internal network via its VPN; and installed malware and exfiltrated data.

"CISA became aware – via EINSTEIN, CISA's intrusion detection system that monitors federal civilian networks – of a potential compromise of a federal agency's network," the team wrote. "In coordination with the affected agency, CISA conducted an incident response engagement, confirming malicious activity."

We're told the hacker possessed valid login credentials for a bunch of the hacked agency's Microsoft Office 365 accounts as well as domain administrator accounts. CISA suggested these details were obtained by someone exploiting the CVE-2019-11510 vulnerability in Pulse Secure products present in government networks, a hole that can be abused to fetch files and passwords from a vulnerable machine. CISA said it had "observed wide exploitation of CVE-2019-11510 across the federal government," worryingly enough.

Armed with those stolen Office 365 credentials, the attacker logged into one of the agency's O365 accounts, made a beeline for a SharePoint server, and browsed its pages and downloaded a file. Shortly after, the intruder connected to the unnamed agency's VPN, presumably using information gleaned so far from snooping around.

After that, once in the network, the miscreant returned to rifling through one of the Office 365 accounts, "viewing and downloading help desk email attachments with 'Intranet access' and 'VPN passwords' in the subject line, despite already having privileged access," CISA noted. "These emails did not contain any passwords." Nice try but no cigar, then.

Next, the miscreant enumerated the network using standard Windows command-line tools, connected to an external virtual server via SMB, and then, using their administrator credentials, sought to gain a persistent presence on the network by, according to CISA:...

~~~~~ more details at ~~~~~

https://www.theregister.com/2020/09/25/cisa_agency_hacked/