The suspected Russian hackers behind last year’s SolarWinds breach have re-emerged to target dozens of companies across the global IT supply chain, according to Microsoft
The hacking group, dubbed Nobelium or Cozy Bear, is trying to attack resellers and technology providers that help customers manage and deploy their cloud services, Microsoft said in a Monday report. The goal: To hijack access and then target their “downstream customers,” including government offices and think tanks.
The strategy echoes last year’s attack on SolarWinds, a Texas-based IT company that serves numerous customers, including US government agencies. By breaking into the company, the suspected Russian hackers were able to spread malicious software via SolarWinds software to at least nine federal agencies and over 100 private firms, including Microsoft itself.
The latest hacking campaign, which Microsoft began tracking in May, has already succeeded in compromising some customers.
“Since May, we have notified more than 140 resellers and technology service providers that have been targeted by Nobelium. We continue to investigate, but to date we believe as many as 14 of these resellers and service providers have been compromised,” the company says.
Microsoft did not explain the severity of the breaches, but the private firms targeted include those based in the US and Europe.
Microsoft points the finger at the Kremlin for orchestrating the hacks. “This recent activity is another indicator that Russia is trying to gain long-term, systematic access to a variety of points in the technology supply chain and establish a mechanism for surveilling —now or in the future— targets of interest to the Russian government,” Microsoft claims.
In April, the White House formally blamed a Russian intelligence agency, the SVR, for instigating the SolarWinds breach. (The SVR was also allegedly behind the 2016 hack on the Democratic National Committee.)
To compromise victim companies, the hackers have relied on password guessing and spear phishing emails to gain access. “These attacks have highlighted the need for (IT) administrators to adopt strict account security practices and take additional measures to secure their environments,” according to Microsoft, which released an advisory with tips on how companies can fend off the threat.
"These attacks have been a part of a larger wave of Nobelium activities this summer," Microsoft adds. "In fact, between July 1 and October 19 this year, we informed 609 customers that they had been attacked 22,868 times by Nobelium, with a success rate in the low single digits."