{"id":19342,"date":"2021-01-13T23:06:16","date_gmt":"2021-01-14T04:06:16","guid":{"rendered":"https:\/\/www.elteni.com\/?p=19342"},"modified":"2021-01-13T23:06:16","modified_gmt":"2021-01-14T04:06:16","slug":"cftc-issues-an-alert-about-potential-microsoft-azure-and-office-365-compromise-resulting-from-solarwinds-breach","status":"publish","type":"post","link":"https:\/\/www.elteni.com\/insights\/?p=19342","title":{"rendered":"CFTC issues an alert about potential Microsoft Azure and Office 365 compromise resulting from SolarWinds breach"},"content":{"rendered":"<p>On January 13, 2021, the Market Participant Division (MPD) of the CFTC sent an email to registrants informing them about an alert that was issued by the DHS Cybersecurity and Infrastructure Security Agency (CISA). In the alert CISA highlighted post compromise activity related to the SolarWinds Breach.<\/p>\n<p>More specifically, the alert highlighted that threat actors were able to compromise some Microsoft Azure and\/or Office 365 environments after gaining access through the initial SolarWinds vector of infection.<\/p>\n<p>In the alert issued by the MPD, they informed market participants to run one of following three tools to determine if they were compromised:<\/p>\n<ul>\n<li>Sparrow: <a href=\"https:\/\/github.com\/cisagov\/Sparrow\">https:\/\/github.com\/cisagov\/Sparrow<\/a><\/li>\n<li>Hawk: <a href=\"https:\/\/github.com\/T0pCyber\/hawk\">https:\/\/github.com\/T0pCyber\/hawk<\/a><\/li>\n<li>Crowdstrike\u2019s reporting tool: <a href=\"https:\/\/github.com\/CrowdStrike\/CRT\">https:\/\/github.com\/CrowdStrike\/CRT<\/a><\/li>\n<\/ul>\n<p>If a market participant identified they were compromised, they were informed by the MPD to reach out to them directly over the phone.\u00a0<span style=\"color: #ff0000;\"><strong>The MPD is requesting to be contacted before close of business on January 18, 2021 if you have reason to believe your firm has been compromised.<\/strong><\/span><\/p>\n<h3>What should you do if you are using Microsoft Azure and\/or Office 365?<\/h3>\n<ol>\n<li>If you <strong>are<\/strong> CFTC registered and your firm determined that the SolarWinds products were in use at your firm, you should run one of these tools and identify if you were compromised.\n<ol>\n<li>If you were compromised reach out to the numbers provided to you in the email you received (or should have received) from the CFTC. If you need those numbers, feel free to reach out to us.<\/li>\n<\/ol>\n<\/li>\n<li>If you are CFTC registered, but do not use any of the SolarWinds products, you should consider running the tool. It may not be necessary, but it does not hurt verifying to give you peace of mind.<\/li>\n<li>If you are not CFTC registered, and your firm determined that the SolarWinds products were in use, you should run one of these tools to identify if you were compromised.\n<ol>\n<li>If you were compromised, work with your IT team to address the issue, and\/or call use for our assistance.<\/li>\n<\/ol>\n<\/li>\n<li>If you are not CFTC registered, and there is no SolarWinds use in your environment, consider running the tool anyway to get a glimpse of your environment.<\/li>\n<\/ol>\n<h3>Too Complicated?<\/h3>\n<p>If you need assistance with performing verification in your environment, feel free to reach out and ask us how we can help. Please note that your IT team and or providers should be able to do this for you, but if you want some independence and security experts validating it, we are an email or phone call away.<\/p>\n<figure id=\"attachment_19346\" aria-describedby=\"caption-attachment-19346\" style=\"width: 455px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-19346 size-full\" src=\"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2021\/01\/Original-CFTC-Notice.png\" alt=\"Original CFTC Notice\" width=\"455\" height=\"574\" srcset=\"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2021\/01\/Original-CFTC-Notice.png 455w, https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2021\/01\/Original-CFTC-Notice-238x300.png 238w\" sizes=\"auto, (max-width: 455px) 100vw, 455px\" \/><figcaption id=\"caption-attachment-19346\" class=\"wp-caption-text\">Original CFTC Notice<\/figcaption><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>On January 13, 2021, the Market Participant Division (MPD) of the CFTC sent an email to registrants informing them about an alert that was issued by the DHS [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":19343,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[84,24,90],"tags":[],"class_list":["post-19342","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cftc","category-ransomware-attack","category-sec"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>CFTC issues an alert about potential Microsoft Azure and Office 365 compromise resulting from SolarWinds breach - Insights<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.elteni.com\/insights\/?p=19342\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"CFTC issues an alert about potential Microsoft Azure and Office 365 compromise resulting from SolarWinds breach - Insights\" \/>\n<meta property=\"og:description\" content=\"On January 13, 2021, the Market Participant Division (MPD) of the CFTC sent an email to registrants informing them about an alert that was issued by the DHS [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.elteni.com\/insights\/?p=19342\" \/>\n<meta property=\"og:site_name\" content=\"Insights\" \/>\n<meta property=\"article:published_time\" content=\"2021-01-14T04:06:16+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2021\/01\/Important-Message.png\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"547\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Elteni\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Elteni\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19342#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19342\"},\"author\":{\"name\":\"Elteni\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#\\\/schema\\\/person\\\/e415dfcf12d1dc9ad6eca68055c5e075\"},\"headline\":\"CFTC issues an alert about potential Microsoft Azure and Office 365 compromise resulting from SolarWinds breach\",\"datePublished\":\"2021-01-14T04:06:16+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19342\"},\"wordCount\":447,\"image\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19342#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2021\\\/01\\\/Important-Message.png\",\"articleSection\":[\"CFTC\",\"Ransomware Attack\",\"SEC\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19342\",\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19342\",\"name\":\"CFTC issues an alert about potential Microsoft Azure and Office 365 compromise resulting from SolarWinds breach - Insights\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19342#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19342#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2021\\\/01\\\/Important-Message.png\",\"datePublished\":\"2021-01-14T04:06:16+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#\\\/schema\\\/person\\\/e415dfcf12d1dc9ad6eca68055c5e075\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19342#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19342\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19342#primaryimage\",\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2021\\\/01\\\/Important-Message.png\",\"contentUrl\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/wp-content\\\/uploads\\\/2021\\\/01\\\/Important-Message.png\",\"width\":800,\"height\":547,\"caption\":\"Important Message\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?p=19342#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.elteni.com\\\/insights\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"CFTC issues an alert about potential Microsoft Azure and Office 365 compromise resulting from SolarWinds breach\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#website\",\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/\",\"name\":\"Insights\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/#\\\/schema\\\/person\\\/e415dfcf12d1dc9ad6eca68055c5e075\",\"name\":\"Elteni\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/?s=96&d=mm&r=g\",\"caption\":\"Elteni\"},\"url\":\"https:\\\/\\\/www.elteni.com\\\/insights\\\/?author=2\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"CFTC issues an alert about potential Microsoft Azure and Office 365 compromise resulting from SolarWinds breach - Insights","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.elteni.com\/insights\/?p=19342","og_locale":"en_US","og_type":"article","og_title":"CFTC issues an alert about potential Microsoft Azure and Office 365 compromise resulting from SolarWinds breach - Insights","og_description":"On January 13, 2021, the Market Participant Division (MPD) of the CFTC sent an email to registrants informing them about an alert that was issued by the DHS [&hellip;]","og_url":"https:\/\/www.elteni.com\/insights\/?p=19342","og_site_name":"Insights","article_published_time":"2021-01-14T04:06:16+00:00","og_image":[{"width":800,"height":547,"url":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2021\/01\/Important-Message.png","type":"image\/png"}],"author":"Elteni","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Elteni","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.elteni.com\/insights\/?p=19342#article","isPartOf":{"@id":"https:\/\/www.elteni.com\/insights\/?p=19342"},"author":{"name":"Elteni","@id":"https:\/\/www.elteni.com\/insights\/#\/schema\/person\/e415dfcf12d1dc9ad6eca68055c5e075"},"headline":"CFTC issues an alert about potential Microsoft Azure and Office 365 compromise resulting from SolarWinds breach","datePublished":"2021-01-14T04:06:16+00:00","mainEntityOfPage":{"@id":"https:\/\/www.elteni.com\/insights\/?p=19342"},"wordCount":447,"image":{"@id":"https:\/\/www.elteni.com\/insights\/?p=19342#primaryimage"},"thumbnailUrl":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2021\/01\/Important-Message.png","articleSection":["CFTC","Ransomware Attack","SEC"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.elteni.com\/insights\/?p=19342","url":"https:\/\/www.elteni.com\/insights\/?p=19342","name":"CFTC issues an alert about potential Microsoft Azure and Office 365 compromise resulting from SolarWinds breach - Insights","isPartOf":{"@id":"https:\/\/www.elteni.com\/insights\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.elteni.com\/insights\/?p=19342#primaryimage"},"image":{"@id":"https:\/\/www.elteni.com\/insights\/?p=19342#primaryimage"},"thumbnailUrl":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2021\/01\/Important-Message.png","datePublished":"2021-01-14T04:06:16+00:00","author":{"@id":"https:\/\/www.elteni.com\/insights\/#\/schema\/person\/e415dfcf12d1dc9ad6eca68055c5e075"},"breadcrumb":{"@id":"https:\/\/www.elteni.com\/insights\/?p=19342#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.elteni.com\/insights\/?p=19342"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.elteni.com\/insights\/?p=19342#primaryimage","url":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2021\/01\/Important-Message.png","contentUrl":"https:\/\/www.elteni.com\/insights\/wp-content\/uploads\/2021\/01\/Important-Message.png","width":800,"height":547,"caption":"Important Message"},{"@type":"BreadcrumbList","@id":"https:\/\/www.elteni.com\/insights\/?p=19342#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.elteni.com\/insights"},{"@type":"ListItem","position":2,"name":"CFTC issues an alert about potential Microsoft Azure and Office 365 compromise resulting from SolarWinds breach"}]},{"@type":"WebSite","@id":"https:\/\/www.elteni.com\/insights\/#website","url":"https:\/\/www.elteni.com\/insights\/","name":"Insights","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.elteni.com\/insights\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.elteni.com\/insights\/#\/schema\/person\/e415dfcf12d1dc9ad6eca68055c5e075","name":"Elteni","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/?s=96&d=mm&r=g","caption":"Elteni"},"url":"https:\/\/www.elteni.com\/insights\/?author=2"}]}},"_links":{"self":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/posts\/19342","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=19342"}],"version-history":[{"count":0,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/posts\/19342\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=\/wp\/v2\/media\/19343"}],"wp:attachment":[{"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=19342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=19342"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.elteni.com\/insights\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=19342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}