Cybersecurity News: Microsoft 365 outage, Bomb hoaxers in hijacked inboxes, Operation Endgame pulls malware plugs - CISO Series

Thursday, Microsoft identified that servers in the Americas and Europe failed automated health checks and were taken offline, redirecting traffic to remaining systems. The outage impacted Exchange, Teams, SharePoint, Copilot, and other Microsoft 365 services. The company suspects configuration updates may have contributed to the failures but hasn't confirmed the exact cause. Microsoft implemented an alternative health-check method that restored some affected servers, but full global service recovery remains pending.

Outdated Exchange servers

Microsoft now considers Exchange Server 2016 and 2019 'permanently vulnerable' after stopping security testing for these versions. The company released final patches on October 13th after extending paid support twice. November's fixes only address Exchange Server Subscription Edition, including a critical remote code execution flaw. Organizations still running these older versions face immediate security risks and must upgrade.

Bomb hoax investigation

Taiwan's Da-Yeh University suspended a compromised email account used in bomb threats against thousands of schools. Proofpoint confirmed that similar threats originated from hijacked accounts that passed authentication checks and bypassed spam filters. Investigators face challenges tracing logins potentially hidden behind VPNs and obtaining records across multiple countries, with no government yet claiming responsibility.

Operation Endgame continues

Europol and law enforcement partners from nine countries seized 235 servers and 257 domains used by Gootloader, CastleRAT, and StealC malware operations. The action targeted tools delivering malware, providing remote access, or stealing credentials for ransomware gangs. Authorities discovered 6.4 million stolen victim datasets on the seized infrastructure, with information to be shared through Have I Been Pwned.