Microsoft Discloses New Customer Hack Linked to SolarWinds Cyberattackers
Microsoft Corp. said hackers, linked by U.S. authorities to Russia’s Foreign Intelligence Service, installed malicious information-stealing software on one of its systems and used information gleaned there to attack its customers.
The hackers compromised a computer used by a Microsoft customer support employee that could have provided access to different types of information, including ”metadata” of accounts and billing contact information for the organization, a Microsoft spokesman said.
Microsoft is aware of three customers that were affected by the recent activity, the company said in a blog post.
“The actor used this information in some cases to launch highly-targeted attacks as part of their broader campaign,” Microsoft said. “We responded quickly, removed the access and secured the device.”
The incident was part of a broader campaign—which involved other hacking techniques beyond leveraging the information taken from its support system—that primarily targeted technology companies and government agencies in 36 countries.
Most of the attacks were unsuccessful, but three of Microsoft’s customers were compromised during the campaign, the company said. “We have confirmed that two of the compromises were unrelated to the support agent issue, and are continuing to investigate the third instance,” a Microsoft spokesman said.
Microsoft identified the hackers behind the break-in as Nobelium, the same group associated with the sophisticated hack at Austin, Texas-based software maker SolarWinds Corp. SWI -1.79% U.S. authorities have said this group is part of Russia’s Foreign Intelligence Service, known as the SVR. Russia has denied involvement in the SolarWinds hack. A Russian embassy representative didn’t immediately return a message seeking comment on Microsoft’s blog post.
“This should concern all of us,” said Sherri Davidoff, chief executive of the security consulting firm LMG Security LLC. “Hackers made it past the defenses of one of the world’s most sophisticated technology suppliers, whose software underlies our entire economy.”
The incident marks the second time in recent months that Russia-linked hackers have breached Microsoft’s networks. In December, Microsoft said Nobelium hackers had broken into the company’s networks to view internal source code, used to build software products.
The U.S. Cybersecurity and Infrastructure Security Agency is “aware of this activity and is working with Microsoft and our interagency partners to evaluate the impact,” said a spokesman for the Department of Homeland Security, which oversees the agency. “We stand ready to assist any affected entities.” He declined to say whether any government agencies had been hit by the hack.
The breaches at Microsoft and SolarWinds have raised concerns among government and industry security professionals that Russian hackers are engaged in a longstanding and concerted effort to break into U.S. technology companies and use them as a back door into government and commercial targets, a tactic known as a “supply-chain attack.”
“This shows that the SVR continues to execute supply chain attacks. In this particular case, going after a support person at Microsoft who clearly has information and connections to Microsoft customers.” said Dmitri Alperovitch, a former cybersecurity investigator who is executive chairman at the Silverado Policy Accelerator think tank.
About 100 companies and at least nine government agencies are known to have been compromised during the SolarWinds attack, which went undetected for months before it was discovered this past fall.
“The latest cyberattack reported by Microsoft does not involve our company or our customers in any way,” a SolarWinds spokesman said.
In April, the Biden administration unveiled a series of sanctions against Russia citing, among other things, the SolarWinds cyberattack. Russia has denounced the sanctions.
Since then, the Russian-linked hackers have made it clear that they intend to continue their activity. In May, Microsoft said it discovered that the hackers were involved in a phishing campaign that targeted 3,000 email accounts belonging to workers at more than 150 organizations.
Earlier this month, President Biden said he warned his Russian counterpart, Vladimir Putin, that there would be consequences for cyberattacks on the U.S. at the two leaders’ first in-person meeting in Switzerland.
“The supply-chain attacks are here to stay with us,” Mr. Alperovitch said “It didn’t end with SolarWinds.”
