# U.S. Defense Manufacturer IEH Corporation Breached via Phishing, Potential Export-Controlled Data Exposure

> IEH Corporation (Nasdaq: IEHC), a Brooklyn, NY-based manufacturer of high-reliability electrical connectors for military and aerospace platforms, disclosed via SEC Form 8-K that a threat actor gained unauthorized access to an employee's Microsoft 365 mailbox after the employee clicked a phishing hyperlink disguised as a document-sharing invite and entered credentials on a fraudulent login page. The attacker created malicious mailbox rules for persistence and accessed emails, attachments, customer communications, purchase orders, and engineering documentation, some of which may be export-controlled under ITAR/EAR. IEH found no evidence of data exfiltration as of disclosure.

- **Published:** 2026-08-09T00:00:00Z
- **Last reviewed:** 2026-08-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1960
- **ID:** TL-2026-1960
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 2 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On August 4, 2026, IEH Corporation discovered that a threat actor, identified in the company's SEC filing only by an alias, had gained unauthorized access to the Microsoft 365 mailbox of a company employee. Investigation determined the intrusion began with a social-engineering phishing attack: the attacker impersonated a prospective business contact and sent the employee a hyperlink disguised as a legitimate Microsoft document-sharing (OneDrive/SharePoint-style) invite. When the employee clicked the link and entered their Microsoft 365 credentials into a fraudulent, attacker-controlled login page, the credentials were harvested and the attacker obtained full access to the mailbox.

Once inside, the attacker created malicious inbox/mailbox rules — a well-documented Microsoft 365 post-exploitation persistence technique used to hide, forward, or otherwise intercept incoming mail without alerting the account owner — in order to maintain access and monitor future communications. During the compromise window the attacker had access to email messages, attachments, customer communications, purchase orders, engineering-related documentation, and potentially export-controlled technical information subject to the International Traffic in Arms Regulations (ITAR) and Export Administration Regulations (EAR). This is materially significant because IEH manufactures specialized hyperboloid electrical connectors used in printed circuit boards, medical devices, and — critically — U.S. and allied defense and aerospace platforms including the THAAD missile-defense system, PATRIOT air-defense batteries, AMRAAM air-to-air missiles, APKWS guided rockets, MARK-48 torpedoes, military satellites, military radios, rotary-wing aircraft, and fighter jets (including aircraft used by European nations and India).

IEH states it found no evidence that emails were sent from the compromised account or that mailbox data was copied or downloaded, though the sensitive contents remained accessible to the unauthorized party for an unspecified duration prior to discovery — the company has not disclosed when the initial compromise occurred relative to the August 4, 2026 discovery date. Upon discovery, IEH secured the compromised account, disabled the malicious mailbox rules, preserved forensic evidence, and began a broader review of Microsoft 365 security controls and authentication protections. The company disclosed the incident via SEC Form 8-K (filed on/about August 6-7, 2026) and stated it does not currently expect a material adverse effect on its business, while continuing to review impacted communications to determine whether notifications to affected customers or regulators are required. No attacker attribution has been made; while nation-state actors (notably Russia and China) have recently targeted the U.S. defense industrial base, no evidence ties either to this specific incident. No CVE or software vulnerability is associated with this incident — it is a pure credential-phishing / business-email-compromise-style attack against a cloud identity, not an exploit of a technical flaw. No domain names, sender addresses, IP addresses, or other technical IOCs for the phishing infrastructure were disclosed in any public source as of this writing.

## MITRE ATT&CK

- T1591.002 Business Relationships
- T1589.002 Email Addresses
- T1585.002 Email Accounts
- T1583.001 Domains
- T1608.005 Link Target
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1684.001 Impersonation
- T1564.008 Email Hiding Rules
- T1078.004 Cloud Accounts
- T1114.002 Remote Email Collection

## Sources

- [U.S. defense manufacturer IEH hit by phishing attack, exposing potentially export-controlled data](https://securityaffairs.com/196890/cyber-crime/u-s-defense-manufacturer-ieh-hit-by-phishing-attack-exposing-potentially-export-controlled-data.html)
- [IEH Corp Form 8-K (SEC EDGAR)](https://www.sec.gov/Archives/edgar/data/50292/000117494726000761/form8k-36187_iehc.htm)
- [Attacker phished way into US defense supplier's Microsoft 365 account](https://www.theregister.com/security/2026/08/07/ieh-corp-says-phished-staffer-opened-gates-to-company-m365/5284523)
- [Military device manufacturer discloses cyber incident to SEC](https://therecord.media/military-device-manufacturer-discloses-cyber-incident)
- [IEH Investigates Microsoft 365 Mailbox Cybersecurity Incident](https://www.tipranks.com/news/company-announcements/ieh-investigates-microsoft-365-mailbox-cybersecurity-incident)
- [IEH reports Microsoft 365 mailbox breach after phishing, says no evidence of data exfiltration](https://www.tradingview.com/news/tradingview:5cea549ce9a4a:0-ieh-reports-microsoft-365-mailbox-breach-after-phishing-says-no-evidence-of-data-exfiltration/)
- [Mailbox rules in O365 — a post-exploitation tactic in cloud ATO](https://www.proofpoint.com/us/blog/threat-insight/mailbox-rules-o365-post-exploitation-tactic-cloud-ato)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1960