Attacker phished way into US defense supplier's Microsoft 365 account

Defense contractor IEH Corporation disclosed a cybersecurity breach involving its Microsoft 365 mailbox in a regulatory filing. A phishing scam, facilitated by an employee, allowed an attacker to gain access to the account. The adversary impersonated a potential business partner, sending the employee a seemingly legitimate Microsoft sharing link.

This link led to a fraudulent login page that captured the victim's Microsoft 365 credentials. Upon infiltrating the system, the attacker accessed sensitive data, including emails, attachments, customer communications, purchase orders, engineering documents, and potentially export-controlled technical information. Despite the intrusion lasting an unspecified duration, IEH found no evidence of data exfiltration.

The company discovered the breach on August 4 and immediately took action, securing the compromised account, disabling malicious rules, preserving evidence, and initiating a review of its security controls. IEH asserts that the incident has not affected its operations and does not foresee any material impact. However, the investigation is ongoing.

The lack of detected data theft does not rule out the possibility that the attacker may have surveilled communications, mimicked employees, rerouted payments, or prepared subsequent attacks. IEH's clientele in the defense and aerospace sectors could make it an appealing target for espionage, but ordinary cybercriminals might also exploit compromised mailboxes for fraud and data theft.

The attack's attribution remains uncertain, as no evidence points to a specific nation-state involvement. IEH, headquartered in Brooklyn, specializes in manufacturing hyperboloid connectors for high-stress environments, with applications ranging from printed circuit boards to military systems such as the PATRIOT air-defense system, AMRAAM, THAAD, APKWS, and MARK-48 torpedo.