Microsoft discovered that Russia-linked SolarWinds hackers, tracked as Nobelium, have breached the network of three new organizations.
Microsoft revealed on Friday that Russia-linked SolarWinds hackers, tracked as Nobelium or APT29, have conducted news cyber attacks against other organizations.
Threat actors carried out brute-force and password spraying attacks in an attempt to gain access to Microsoft customer accounts.
Microsoft pointed out that the recent campaign was mostly unsuccessful and most of the attempts failed, but confirmed to be aware of three compromised entities to date. Compromised and targeted entities are being contacted through the Microsoft nation-state notification process.
Most of the targeted organizations are IT companies (57%), followed by government organizations (20%). The hackers also targeted non-governmental organizations and think tanks, as well as financial services.
“The activity was largely focused on US interests, about 45%, followed by 10% in the UK, and smaller numbers from Germany and Canada. In all, 36 countries were targeted.” reads the post published by Microsoft.
“As part of our investigation into this ongoing activity, we also detected information-stealing malware on a machine belonging to one of our customer support agents with access to basic account information for a small number of our customers. The actor used this information in some cases to launch highly-targeted attacks as part of their broader campaign.”
Microsoft also discovered that the nation-state actors employed information-stealing malware on the device of one of its employees working as a customer support agent. The IT giant quickly removed the access and secured the device.
The attackers aimed at stealing this information to use them in highly targeted attacks as part of their campaign.
The customer’s agent device has been secured, the company added.
Microsoft highlights the importance of best practices such as Zero-trust architecture and multi-factor authentication to prevent these attacks. Below the additional information on best practices shared by the IT giant:
Follow me on Twitter: @securityaffairs and Facebook
(SecurityAffairs – hacking, Nobelium)
Share On
Pierluigi Paganini
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at “Cyber Defense Magazine”, Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog “Security Affairs” recently named a Top National Security Resource for US. Pierluigi is a member of the “The Hacker News” team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books “The Deep Dark Web” and “Digital Virtual Currency and Bitcoin”.
Microsoft discovered that Russia-linked SolarWinds hackers, tracked as Nobelium, have breached the network of three new organizations.
Microsoft revealed on Friday that Russia-linked SolarWinds hackers, tracked as Nobelium or APT29, have conducted news cyber attacks against other organizations.
Threat actors carried out brute-force and password spraying attacks in an attempt to gain access to Microsoft customer accounts.
Microsoft pointed out that the recent campaign was mostly unsuccessful and most of the attempts failed, but confirmed to be aware of three compromised entities to date. Compromised and targeted entities are being contacted through the Microsoft nation-state notification process.
Most of the targeted organizations are IT companies (57%), followed by government organizations (20%). The hackers also targeted non-governmental organizations and think tanks, as well as financial services.
“The activity was largely focused on US interests, about 45%, followed by 10% in the UK, and smaller numbers from Germany and Canada. In all, 36 countries were targeted.” reads the post published by Microsoft.
“As part of our investigation into this ongoing activity, we also detected information-stealing malware on a machine belonging to one of our customer support agents with access to basic account information for a small number of our customers. The actor used this information in some cases to launch highly-targeted attacks as part of their broader campaign.”
Microsoft also discovered that the nation-state actors employed information-stealing malware on the device of one of its employees working as a customer support agent. The IT giant quickly removed the access and secured the device.
The attackers aimed at stealing this information to use them in highly targeted attacks as part of their campaign.
The customer’s agent device has been secured, the company added.
Microsoft highlights the importance of best practices such as Zero-trust architecture and multi-factor authentication to prevent these attacks. Below the additional information on best practices shared by the IT giant:
Follow me on Twitter: @securityaffairs and Facebook
(SecurityAffairs – hacking, Nobelium)