CISA says unnamed US federal agency got hacked using valid credentials for users' Microsoft 365 and domain admin accounts

CISA announced Thursday that an unnamed United States government agency was hacked in an unusual method. The attacker used valid credentials for multiple users' Microsoft 365 accounts, and users' domain administrator accounts.

The Cybersecurity & Infrastructure Security Agency, known as CISA, was alerted to the breach by an intrusion detection system that monitors federal civilian agencies, reports Bloomberg News:

The hacker implanted malware that evaded the agency's protection system and was able to gain access to the network by using valid access credentials for multiple users' Microsoft 365 accounts and domain administrator accounts, according to authorities.