Microsoft Confirms New Cyberattack by Group Linked to SolarWinds Hack
Microsoft Confirms New Cyberattack by Group Linked to SolarWinds Hack

By Tom Ozimek

Microsoft said on Friday that the hackers behind the notorious SolarWinds cyberattack have launched a fresh campaign mostly focusing on U.S. interests that, while mostly unsuccessful, managed to compromise three entities.

The Russia-based hacking group, which goes by various names including Nobelium, launched the new campaign using “password spray and brute-force attacks,” the Microsoft Security Response Center said in an alert, noting that 36 countries in total had been targeted.

The bulk of the attacks—45 percent—targeted entities within the United States, followed by 10 percent in the UK, and smaller numbers in Germany and Canada. The activity targeted specific customers, Microsoft said, mostly IT companies (57 percent), government agencies (20 percent), followed by smaller percentages for non-governmental organizations, think tanks, and financial services.

“This recent activity was mostly unsuccessful, and the majority of targets were not successfully compromised—we are aware of three compromised entities to date,” Microsoft said. The company did not specify the entities that were breached or targeted, but said it was contacting all those affected by the cyberattack.

As part of its probe into the new campaign, Microsoft detected information-stealing malware on a computer belonging to one of its customer support agents who had access to account information for a “small number” of customers.

The threat actor, which Microsoft identified as Nobelium, “used this information in some cases to launch highly-targeted attacks as part of their broader campaign.” Microsoft said it “responded quickly, removed the access, and secured the device.”

A Microsoft spokesman told Reuters that the latest breach by the threat actor was not part of Nobelium’s previous successful attack on Microsoft, in which the group obtained some source code.

In the SolarWinds attack, which has been attributed to Nobelium, the group altered code to access SolarWinds customers, including nine U.S. federal agencies.

Microsoft later said that the group had compromised its own employee accounts and taken software instructions governing how Microsoft verifies user identities.

U.S. authorities have linked Nobelium to Russia’s Foreign Intelligence Service, allegations Moscow denies.

A spokesperson for the Department of Homeland Security, which oversees the U.S. Cybersecurity and Infrastructure Security Agency, told The Wall Street Journal that the agency is “aware of this activity and is working with Microsoft and our interagency partners to evaluate the impact.” He declined to say whether any government agencies had been affected by the new attack.

Reuters contributed to this report.

Affiliate News Feeds

  • Hardware
  • Internet of Things
  • Networking
  • Industry News
  • Software

A new single board computer range offers developers flexibility and the option of custom hardware. The post OKdo partners with Radxa to deliver new ROCK SBCs appeared first on TechRepublic. [...]

Cybersecurity threats and attacks are on an upswing with no end in sight. It’s clear that organizations must do more to protect their data and employees. AMD and Microsoft have… [...]

The need to protect your Mac's data should prove no surprise, but there are many options beyond using iCloud and Time Machine. Here are several leading options, should you need… [...]

A new single board computer range offers developers flexibility and the option of custom hardware. The post OKdo partners with Radxa to deliver new ROCK SBCs appeared first on TechRepublic. [...]

Blockchain and edge computing can be a formidable combination in terms of power, scalability and versatility. The post How blockchain and edge computing can work together appeared first on TechRepublic. [...]

IoT use cases continue to grow as this report projects that the IoT-enabled asset tracking and monitoring market will witness exponential growth in the coming years. The post IoT-based asset… [...]

Jack Wallen shows you how to quickly get Samba shares up and running on any Linux distribution based on Red Hat Enterprise Linux. The post How to install and configure… [...]

Google Fiber hopes to expand its reach to deliver one of the fastest fiber networks to multiple U.S. communities. The post Google Fiber plots speedy multi-gig future appeared first on… [...]

Learn the basics of automation in Windows PowerShell for just $19.99 with this certification bundle. The post Automate Windows administration with PowerShell: Learn how in this training course appeared first… [...]

Cybersecurity threats and attacks are on an upswing with no end in sight. It’s clear that organizations must do more to protect their data and employees. AMD and Microsoft have… [...]

Professional risk factors into career decisions, and successful women need to encourage other women to accept the risks, says Accenture. The post Report finds women are declining CISO/CSO roles appeared… [...]

CompTIA finds tech investments will support innovation and recruitment, while Verizon Business reveals 31% of SMBs will cut tech investments. The post Two SMB reports reveal differing views on tech… [...]

Data observability tools allow you to monitor what is happening to your data. Here is a list of the top data observability tools of 2022. The post Best observability tools… [...]

Once you decide the default Auto Date table isn’t adequate, you can create one that fulfills your grouping and filtering requirements in Microsoft Power BI. The post How to create… [...]

Talend is one of the most popular tools for data quality. Get details on using Talend's tools for data profiling, cleaning, standardization, matching and deduplication. The post Data quality solutions… [...]