ÐÇ¿Õ´«Ã½

Skip to main content

Microsoft: Russian-backed hackers targeting cloud services

In this April 28, 2015, file photo, a man walks past a Microsoft sign set up for the Microsoft BUILD conference at Moscone Center in San Francisco. (AP Photo/Jeff Chiu, File) In this April 28, 2015, file photo, a man walks past a Microsoft sign set up for the Microsoft BUILD conference at Moscone Center in San Francisco. (AP Photo/Jeff Chiu, File)
Share
RICHMOND, Va. -

Microsoft said Monday the same Russia-backed hackers responsible for the 2020 SolarWinds breach continue to attack the global technology supply chain and have been relentlessly targeting cloud service companies and others since summer.

The group, which Microsoft calls Nobelium, has employed a new strategy to piggyback on the direct access that cloud service resellers have to their customers' IT systems, hoping to "more easily impersonate an organization's trusted technology partner to gain access to their downstream customers." Resellers act as intermediaries between giant cloud companies and their ultimate customers, managing and customizing accounts.

"Fortunately, we have discovered this campaign during its early stages, and we are sharing these developments to help cloud service resellers, technology providers, and their customers take timely steps to help ensure Nobelium is not more successful," Tom Burt, a Microsoft vice president, said in a blog post.

The Biden administration downplayed Microsoft's announcement. A U.S. government official briefed on the issue who insisted on anonymity to discuss the government's response noted that "the activities described were unsophisticated password spray and phishing, run-of-the mill operations for the purpose of surveillance that we already know are attempted every day by Russia and other foreign governments."

The Russian Embassy did not immediately reply to a request for comment.

U.S. and Russian ties have already been strained this year over a string of high-profile ransomware attacks against U.S. targets launched by Russia-based cyber gangs. U.S. President Joe Biden has warned to Russian President Vladimir Putin to get him to crack down on ransomware criminals, but several top administration cybersecurity officials have said recently that they have seen no evidence of that.

Supply chain attacks allow hackers to steal information from multiple targets by breaking into a single product they all use. The U.S. government has previously blamed Russia's SVR foreign intelligence agency for the SolarWinds hack, a supply-chain hack which went undetected for most of 2020, compromised several federal agencies and badly embarrassing Washington.

The hacking campaign is called SolarWinds after the U.S. software company whose product was used in that effort. The Biden administration in April placed new sanctions against six Russian companies that support the country's cyber efforts in response to the SolarWinds hack.

Microsoft has been observing Nobelium's latest campaign since May and has notified more than 140 companies targeted by the group, with as many as 14 believed to have been compromised. The attacks have been increasingly relentless since July, with Microsoft noting that it had informed 609 customers that they had been attacked 22,868 times by Nobelium, with a success rate in the low single digits. That's more attacks than Microsoft had flagged from all nation-state actors in the previous three years.

"Russia is trying to gain long-term, systematic access to a variety of points in the technology supply chain and establish a mechanism for surveilling -- now or in the future -- targets of interest to the Russian government," Burt said.

Microsoft did not name any of the hackers' targets in their latest campaign. But cybersecurity firm Mandiant said it had seen victims in both Europe and North America.

Mandiant Chief Technology Officer Charles Carmakal said the hackers' method of going after resellers make detection difficult.

"It shifts the initial intrusion away from the ultimate targets, which in some situations are organizations with more mature cyber defenses, to smaller technology partners with less mature cyber defenses," he said.

------

AP Business Writer Matt Ott in Silver Spring, Maryland, contributed to this report.

CTVNews.ca ÐÇ¿Õ´«Ã½

Police have arrested an 18-year-old woman who allegedly stole a Porsche and then ran over its owner in an incident that was captured on video.

Since she was a young girl growing up in Vancouver, Ginny Lam says her mom Yat Hei Law made it very clear she favoured her son William, because he was her male heir.

Advocates have identified the woman who died this week after being shot by police in Surrey, B.C., as a South American refugee who was raising a young daughter.

Three men were injured after trying to subdue a man armed with a knife during afternoon prayers at a Montreal-area mosque Friday afternoon.

A 15-year-old boy who was the subject of an emergency alert in New Brunswick has been arrested.

The search for a missing six-year-old boy in Shamattawa is continuing Friday as RCMP hope recent tips can help lead to a happy conclusion.

Provincial police investigating the death of a cat that was allegedly set on fire in Orillia earlier this week released surveillance video of a person of interest in the case.

Local Spotlight

Getting a photograph of a rainbow? Common. Getting a photo of a lightning strike? Rare. Getting a photo of both at the same time? Extremely rare, but it happened to a Manitoba photographer this week.

An anonymous business owner paid off the mortgage for a New Brunswick not-for-profit.

They say a dog is a man’s best friend. In the case of Darren Cropper, from Bonfield, Ont., his three-year-old Siberian husky and golden retriever mix named Bear literally saved his life.

A growing group of brides and wedding photographers from across the province say they have been taken for tens of thousands of dollars by a Barrie, Ont. wedding photographer.

Paleontologists from the Royal B.C. Museum have uncovered "a trove of extraordinary fossils" high in the mountains of northern B.C., the museum announced Thursday.

The search for a missing ancient 28-year-old chocolate donkey ended with a tragic discovery Wednesday.

The Royal Canadian Mounted Police is celebrating an important milestone in the organization's history: 50 years since the first women joined the force.

It's been a whirlwind of joyful events for a northern Ontario couple who just welcomed a baby into their family and won the $70 million Lotto Max jackpot last month.

A Good Samaritan in New Brunswick has replaced a man's stolen bottle cart so he can continue to collect cans and bottles in his Moncton neighbourhood.

Stay Connected