Cybersecurity incident — 2022-10-04 00:00:00
Affected organization: Unnamed defense company
Affected country: United States of America
Industry: Public Administration
Event type: Exploitive
Event subtype: Exploitation of Application Server
Motive: Political-Espionage
Actor: Undetermined
Actor type: Criminal
Actor country: Undetermined

The Cybersecurity and Infrastructure Security Agency (CISA), FBI and National Security Agency (NSA), say it is likely that multiple government hacking groups had "long-term" access to the network of a defense company, exploiting Microsoft Exchange vulnerabilities to gain access remotely and compromise legitimate company accounts to access emails, meetings, and contacts belonging to other employees, via a custom data exfiltration tool, CovalentStealer.