Microsoft Tracks Attack Campaign Against Customer Support Agents
The company attributes the attack to Nobelium, the same group it linked to the SolarWinds campaign earlier this year.
The Microsoft Security Response Center is tracking a new attack campaign in which Nobelium, a group connected to Russia, targets Microsoft customer support agents and uses its foothold to attempt further attacks.
Nobelium is the same group Microsoft attributed to the SolarWinds supply chain attack in 2020, and it has been active since then. Last month, Nobelium launched a phishing attack after gaining access to the Constant Contact account of the United States Agency for International Development.
An investigation into Nobelium's recent activity revealed information-stealing malware on a machine belonging to a Microsoft customer support agent. The device had access to basic account information for a small number of customers. Attackers used the information, in some cases, to launch highly targeted attacks as part of a broader campaign. The access was removed and the device secured.
Microsoft says its latest activity targeted specific customers, mostly IT companies (57%), government (20%), and non-governmental organizations and think tanks, as well as financial services. About 45% of attacks were focused on US interests, followed by 10% in the UK and smaller numbers in Germany and Canada. A total of 36 countries were targeted, they report.
"This recent activity was mostly unsuccessful, and the majority of targets were not successfully compromised – we are aware of three compromised entities to date," officials found. All affected customers are being contacted.
Read the full MSRC blog post for more details.
About the Author
You May Also Like
A Cyber Pros' Guide to Navigating Emerging Privacy Regulation
Dec 10, 2024Identifying the Cybersecurity Metrics that Actually Matter
Dec 11, 2024The Current State of AI Adoption in Cybersecurity, Including its Opportunities
Dec 12, 2024Cybersecurity Day: How to Automate Security Analytics with AI and ML
Dec 17, 2024The Dirt on ROT Data
Dec 18, 2024