Microsoft Confirms New Cyberattack by Same Group Suspected of Being Behind SolarWinds Hack

An engineering student takes part in a hacking challenge near Paris on March 16, 2013. Thomas Samson/AFP via Getty Images

Microsoft said on June 25 that the hackers behind the notorious SolarWinds cyberattack have begun a fresh campaign mostly focusing on U.S. interests that, while mostly unsuccessful, has managed to compromise three entities.

The Russia-based hacking group—which goes by various names, such as Nobelium—launched the new effort using “password spray and brute-force attacks,” the Microsoft Security Response Center said in an alert, noting that 36 countries in total had been targeted.

The bulk of the attacks—45 percent—targeted entities within the United States, followed by 10 percent being focused on UK entities, and smaller numbers in Germany and Canada. The activity targeted specific customers, Microsoft said, mostly IT companies (57 percent) and government agencies (20 percent), followed by smaller percentages for non-governmental organizations, think tanks, and financial services.

“This recent activity was mostly unsuccessful, and the majority of targets were not successfully compromised—we are aware of three compromised entities to date,” Microsoft said. The company didn’t specify which entities were breached or targeted, but said that it was contacting those affected by the cyberattack.

As part of its probe into the new campaign, Microsoft detected information-stealing malware on a computer belonging to one of its customer support agents who had access to account information for a “small number” of customers.

The threat actor, which Microsoft identified as Nobelium, “used this information in some cases to launch highly-targeted attacks as part of their broader campaign.” Microsoft said it “responded quickly, removed the access, and secured the device.”

The Microsoft logo is illuminated on a wall during a Microsoft launch event in New York on May 2, 2017. Drew Angerer/Getty Images

A Microsoft spokesman told Reuters that the latest breach by the threat actor wasn’t part of Nobelium’s previous successful attack on Microsoft, in which the group obtained some source code.

In the SolarWinds attack, which has been attributed to Nobelium, the group altered code to access SolarWinds customers, including nine U.S. federal agencies.

“The latest cyberattack reported by Microsoft does not involve our company or our customers in any way,” a SolarWinds spokesperson said.

Microsoft later said that the group had compromised its own employee accounts and taken software instructions governing how Microsoft verifies user identities.

U.S. authorities have linked Nobelium to Russia’s Foreign Intelligence Service, allegations that Moscow denies.

A spokesperson for the Department of Homeland Security, which oversees the U.S. Cybersecurity and Infrastructure Security Agency, told The Wall Street Journal that the agency is “aware of this activity and is working with Microsoft and our interagency partners to evaluate the impact.” He declined to say whether any government agencies had been affected by the new attack.

Reuters contributed to this report.

Update: This article was updated on June 29, 2021, to include a statement from a SolarWinds spokesperson.