Microsoft has warned its resellers and managed service providers that the hacking group behind the SolarWinds cyber attack has now turned its attention to the company’s global supply chain.
The tech giant said that it believes the Russian state-backed hacking group, known as Nobelium, ultimately hopes to piggyback on any direct access that resellers may have to their customers’ IT systems and more easily impersonate an organisation’s trusted technology partner to gain access to their downstream customers.
Microsoft said that the attacks used well-known techniques, like password spray and phishing, to steal legitimate credentials and gain privileged access. It began observing Nobelium’s latest campaign in May 2021 and has been notifying affected partners and customers.
So far, the company has notified over 140 resellers and technology service providers currently being targeted by the group. It also believes as many as 14 resellers and service providers have already been compromised.
These attacks have been part of a larger wave of Nobelium activities this summer, the company said. Between 1 July and 19 October, Microsoft believes that 22,868 attacks were conducted by the group against 609 customers, with a success rate in the low single digits. As a comparison, before 1 July, approximately 20,500 attacks from nation-state hackers were recorded over the course of three years.
“This recent activity is another indicator that Russia is trying to gain long-term, systematic access to a variety of points in the technology supply chain and establish a mechanism for surveilling – now or in the future – targets of interest to the Russian government,” said Tom Burt, corporate vice president of Customer Security & Trust.
From what it has learned over the past several months, Microsoft is working to implement improvements to better secure and protect its technology partners. This includes launching a programme on 15 October to provide two years of an Azure Active Directory Premium plan for free to strengthen security controls, and it’s piloting new granular features for organisations that want to provide privileged access to resellers.
It’s also piloting improved monitoring to help partners and customers manage and audit their delegated privileged accounts and remove unnecessary authority, as well as auditing unused privileged accounts and working with partners to assess and remove unnecessary privilege and access.
The company also revealed it has been coordinating with the security community to improve its knowledge of Nobelium’s activity, including government agencies in the US and Europe. It believes it is in a much better position to defend against these threats thanks to the US cyber security executive order and information sharing between industry and government.
In September, it emerged that Nobelium was stealing data from Active Directory Federation Services (AD FS) servers, with Microsoft warning that the group was found to be using a post-exploitation backdoor dubbed FoggyWeb to remotely exfiltrate sensitive data.
The group was also blamed for an attack on a Microsoft employee’s computer in June, implanting malware on a device belonging to a customer support agent to obtain information belonging to customers.