The Microsoft Threat Intelligence Center said it’s been tracking recent activity from Nobelium, a Russia-based hacking group best known for the SolarWinds cyberattack of December 2020, and that the group managed to use information gleaned from a Microsoft worker’s device in attacks.
Microsoft said it “detected information-stealing malware on a machine belonging to one of our customer support agents with access to basic account information for a small number of our customers” and that “the actor used this information in some cases to launch highly-targeted attacks as part of their broader campaign.” The affected customers were notified of the breach.
Nobelium followed up the SolarWinds cyberattack in May with a campaign against the US Agency for International Development (USAID). The group reportedly used one of USAID’s email marketing tools to send phishing messages to more than 150 organizations. Those messages contained a link used to distribute malware that could steal data, infect other devices, and more.
Microsoft said Nobelium’s recent targets were “primarily IT companies (57%), followed by government (20%), and smaller percentages for non-governmental organizations and think tanks, as well as financial services.” The company said 45% of those targets were based in the U.S., 10% were based in the U.K., and the rest were spread across 36 different countries.
Few of those attacks bore fruit, however, with Microsoft saying Nobelium was only able to successfully compromise three of its targets. (It didn’t publicly disclose those targets, but it did say they were “being contacted through our nation-state notification process.”) It’s possible that successful attacks went unnoticed, but for now it seems Nobelium’s efforts have been ineffective.
Gaining access to the Microsoft customer support agent’s device might have change that, but the company said that its “support agents are configured with the minimal set of permissions required as part of our Zero Trust ‘least privileged access’ approach to customer information.” That approach helps keep Microsoft’s customers safe from rogue employees and malware alike.
