CRIMINAL CYBER CAPITALI$M
Russian-linked Nobelium hacker behind SolarWinds attack strikes again
The Russian-linked hacker Nobelium behind the 2020 Solarwind attacks has targeted global information technology supply chains again, a Microsoft blog said Sunday.
File Photo by Ken Wolter/UPI/Shutterstock
Oct. 25 (UPI) -- The Russia-linked hacker Nobelium behind the 2020 SolarWinds cyberattacks has struck global information technology supply chains again.
Tom Burt, who serves as corporate vice president of Microsoft's Customer Security and Trust team, warned of the new attack by the Russian nation-state actor Nobelium Sunday in a blog.
"Nobelium has been attempting to replicate the approach it has used in past attacks by targeting organizations integral to the global IT supply chain," Burt said in the blog. "This time, it is attacking a different part of the supply chain: resellers and other technology service providers that customize, deploy and manage cloud services and other technologies on behalf of their customers.
"We believe Nobelium ultimately hopes to piggyback on any direct access that resellers may have to their customers' IT systems and more easily impersonate an organization's trusted technology partner to gain access to their downstream customers."
Oct. 25 (UPI) -- The Russia-linked hacker Nobelium behind the 2020 SolarWinds cyberattacks has struck global information technology supply chains again.
Tom Burt, who serves as corporate vice president of Microsoft's Customer Security and Trust team, warned of the new attack by the Russian nation-state actor Nobelium Sunday in a blog.
"Nobelium has been attempting to replicate the approach it has used in past attacks by targeting organizations integral to the global IT supply chain," Burt said in the blog. "This time, it is attacking a different part of the supply chain: resellers and other technology service providers that customize, deploy and manage cloud services and other technologies on behalf of their customers.
"We believe Nobelium ultimately hopes to piggyback on any direct access that resellers may have to their customers' IT systems and more easily impersonate an organization's trusted technology partner to gain access to their downstream customers."
Burt said Microsoft first noticed the new attack in its "early stages" in May and since then has notified more than 140 resellers and technology service providers who were targeted.
Investigators found that 14 of these resellers and service providers were compromised.
The attack against resellers and service providers is part of the Russian-linked hacker's broader activities this summer. From July 1 through Tuesday, Microsoft informed 609 customers of 22,868 attempted attacks with a success rate in the "low single digits."
Prior to July 1, Microsoft notified customers about overall nation-state hacker attempts 20,500 times, including a phishing scheme in May targeting government and organizations through mimicking the United States Agency for International Development.
Earlier this month, Microsoft published a report on digital defense that found Russia was behind 58% of state-backed hacks over the past year.
"The recent activity is another indicator that Russia is trying to gain long-term systematic access to a variety of points in the technology supply chain and establish a mechanism for surveilling -- now or in the future -- targets of interest to the Russian government," Burt said in the blog Sunday.
The attack n network security software from SolarWinds last year breached at least nine U.S. federal agencies, along with dozens of companies, including Fortune 500 businesses.
Earlier this year, technology executives testified before Congress that the SolarWinds attack launched in March 2020 and discovered by cybersecurity firm Microsoft and Fire Eye (now known as Mandiant) in December, was unprecedented in scale and sophistication.
"While the SolarWinds supply chain attack involved malicious code inserted in legitimate software, most of this recent intrusion activity has involved leveraging stolen identities and the networks of technology solutions, services, and reseller companies in North America and Europe to ultimately access the environments of organizations that are targeted by the Russian government," Charles Carmakal, Mandiant senior vice president and chief technology officer, said in a statement to ZDNet.com.
Investigators found that 14 of these resellers and service providers were compromised.
The attack against resellers and service providers is part of the Russian-linked hacker's broader activities this summer. From July 1 through Tuesday, Microsoft informed 609 customers of 22,868 attempted attacks with a success rate in the "low single digits."
Prior to July 1, Microsoft notified customers about overall nation-state hacker attempts 20,500 times, including a phishing scheme in May targeting government and organizations through mimicking the United States Agency for International Development.
Earlier this month, Microsoft published a report on digital defense that found Russia was behind 58% of state-backed hacks over the past year.
"The recent activity is another indicator that Russia is trying to gain long-term systematic access to a variety of points in the technology supply chain and establish a mechanism for surveilling -- now or in the future -- targets of interest to the Russian government," Burt said in the blog Sunday.
The attack n network security software from SolarWinds last year breached at least nine U.S. federal agencies, along with dozens of companies, including Fortune 500 businesses.
Earlier this year, technology executives testified before Congress that the SolarWinds attack launched in March 2020 and discovered by cybersecurity firm Microsoft and Fire Eye (now known as Mandiant) in December, was unprecedented in scale and sophistication.
"While the SolarWinds supply chain attack involved malicious code inserted in legitimate software, most of this recent intrusion activity has involved leveraging stolen identities and the networks of technology solutions, services, and reseller companies in North America and Europe to ultimately access the environments of organizations that are targeted by the Russian government," Charles Carmakal, Mandiant senior vice president and chief technology officer, said in a statement to ZDNet.com.
Microsoft: Russian-backed hackers targeting cloud services
By ALAN SUDERMAN
FILE - In this Jan. 28, 2020, file photo, a Microsoft computer is among items displayed at a Microsoft store in suburban Boston. Microsoft says the same Russia-backed hackers responsible for the 2020 SolarWinds breach continue to attack the global technology supply chain and are have been relentlessly targeting cloud service resellers and others since summer. (AP Photo/Steven Senne, File)
RICHMOND, Va. (AP) — Microsoft said Monday the same Russia-backed hackers responsible for the 2020 SolarWinds breach continue to attack the global technology supply chain and have been relentlessly targeting cloud service companies and others since summer.
The group, which Microsoft calls Nobelium, has employed a new strategy to piggyback on the direct access that cloud service resellers have to their customers’ IT systems, hoping to “more easily impersonate an organization’s trusted technology partner to gain access to their downstream customers.” Resellers act as intermediaries between giant cloud companies and their ultimate customers, managing and customizing accounts.
“Fortunately, we have discovered this campaign during its early stages, and we are sharing these developments to help cloud service resellers, technology providers, and their customers take timely steps to help ensure Nobelium is not more successful,” Tom Burt, a Microsoft vice president, said in a blog post.
The Biden administration downplayed Microsoft’s announcement. A U.S. government official briefed on the issue who insisted on anonymity to discuss the government’s response noted that “the activities described were unsophisticated password spray and phishing, run-of-the mill operations for the purpose of surveillance that we already know are attempted every day by Russia and other foreign governments.”
The Russian Embassy did not immediately reply to a request for comment.
U.S. and Russian ties have already been strained this year over a string of high-profile ransomware attacks against U.S. targets launched by Russia-based cyber gangs. U.S. President Joe Biden has warned to Russian President Vladimir Putin to get him to crack down on ransomware criminals, but several top administration cybersecurity officials have said recently that they have seen no evidence of that.
Supply chain attacks allow hackers to steal information from multiple targets by breaking into a single product they all use. The U.S. government has previously blamed Russia’s SVR foreign intelligence agency for the SolarWinds hack, a supply-chain hack which went undetected for most of 2020, compromised several federal agencies and badly embarrassing Washington.
The hacking campaign is called SolarWinds after the U.S. software company whose product was used in that effort. The Biden administration in April placed new sanctions against six Russian companies that support the country’s cyber efforts in response to the SolarWinds hack.
Microsoft has been observing Nobelium’s latest campaign since May and has notified more than 140 companies targeted by the group, with as many as 14 believed to have been compromised. The attacks have been increasingly relentless since July, with Microsoft noting that it had informed 609 customers that they had been attacked 22,868 times by Nobelium, with a success rate in the low single digits. That’s more attacks than Microsoft had flagged from all nation-state actors in the previous three years.
“Russia is trying to gain long-term, systematic access to a variety of points in the technology supply chain and establish a mechanism for surveilling – now or in the future – targets of interest to the Russian government,” Burt said.
Microsoft did not name any of the hackers’ targets in their latest campaign. But cybersecurity firm Mandiant said it had seen victims in both Europe and North America.
Mandiant Chief Technology Officer Charles Carmakal said the hackers’ method of going after resellers make detection difficult.
“It shifts the initial intrusion away from the ultimate targets, which in some situations are organizations with more mature cyber defenses, to smaller technology partners with less mature cyber defenses,” he said.
___
AP Business Writer Matt Ott in Silver Spring, Maryland, contributed to this report.
By ALAN SUDERMAN
FILE - In this Jan. 28, 2020, file photo, a Microsoft computer is among items displayed at a Microsoft store in suburban Boston. Microsoft says the same Russia-backed hackers responsible for the 2020 SolarWinds breach continue to attack the global technology supply chain and are have been relentlessly targeting cloud service resellers and others since summer. (AP Photo/Steven Senne, File)
RICHMOND, Va. (AP) — Microsoft said Monday the same Russia-backed hackers responsible for the 2020 SolarWinds breach continue to attack the global technology supply chain and have been relentlessly targeting cloud service companies and others since summer.
The group, which Microsoft calls Nobelium, has employed a new strategy to piggyback on the direct access that cloud service resellers have to their customers’ IT systems, hoping to “more easily impersonate an organization’s trusted technology partner to gain access to their downstream customers.” Resellers act as intermediaries between giant cloud companies and their ultimate customers, managing and customizing accounts.
“Fortunately, we have discovered this campaign during its early stages, and we are sharing these developments to help cloud service resellers, technology providers, and their customers take timely steps to help ensure Nobelium is not more successful,” Tom Burt, a Microsoft vice president, said in a blog post.
The Biden administration downplayed Microsoft’s announcement. A U.S. government official briefed on the issue who insisted on anonymity to discuss the government’s response noted that “the activities described were unsophisticated password spray and phishing, run-of-the mill operations for the purpose of surveillance that we already know are attempted every day by Russia and other foreign governments.”
The Russian Embassy did not immediately reply to a request for comment.
U.S. and Russian ties have already been strained this year over a string of high-profile ransomware attacks against U.S. targets launched by Russia-based cyber gangs. U.S. President Joe Biden has warned to Russian President Vladimir Putin to get him to crack down on ransomware criminals, but several top administration cybersecurity officials have said recently that they have seen no evidence of that.
Supply chain attacks allow hackers to steal information from multiple targets by breaking into a single product they all use. The U.S. government has previously blamed Russia’s SVR foreign intelligence agency for the SolarWinds hack, a supply-chain hack which went undetected for most of 2020, compromised several federal agencies and badly embarrassing Washington.
The hacking campaign is called SolarWinds after the U.S. software company whose product was used in that effort. The Biden administration in April placed new sanctions against six Russian companies that support the country’s cyber efforts in response to the SolarWinds hack.
Microsoft has been observing Nobelium’s latest campaign since May and has notified more than 140 companies targeted by the group, with as many as 14 believed to have been compromised. The attacks have been increasingly relentless since July, with Microsoft noting that it had informed 609 customers that they had been attacked 22,868 times by Nobelium, with a success rate in the low single digits. That’s more attacks than Microsoft had flagged from all nation-state actors in the previous three years.
“Russia is trying to gain long-term, systematic access to a variety of points in the technology supply chain and establish a mechanism for surveilling – now or in the future – targets of interest to the Russian government,” Burt said.
Microsoft did not name any of the hackers’ targets in their latest campaign. But cybersecurity firm Mandiant said it had seen victims in both Europe and North America.
Mandiant Chief Technology Officer Charles Carmakal said the hackers’ method of going after resellers make detection difficult.
“It shifts the initial intrusion away from the ultimate targets, which in some situations are organizations with more mature cyber defenses, to smaller technology partners with less mature cyber defenses,” he said.
___
AP Business Writer Matt Ott in Silver Spring, Maryland, contributed to this report.
No comments:
Post a Comment