The Russian-based group behind the SolarWinds hack has launched a new campaign that appears to target government agencies, think tanks and non-governmental organizations, Microsoft said Thursday.
Nobelium launched the current attacks after getting access to an email marketing service used by the United States Agency for International Development, or USAID, according to Microsoft.
“These attacks appear to be a continuation of multiple efforts by Nobelium to target government agencies involved in foreign policy as part of intelligence gathering efforts,” Tom Burt, Microsoft vice president of customer security and trust, wrote in a blog post.
The campaign, which Microsoft called an active incident, targeted 3,000 email accounts across 150 organizations, mostly in the United States, Burt said. But the targets are in at least 24 countries. At least a quarter of the targeted organizations are said to be involved in things like international development and human rights work.
The effort involved sending phishing emails that were made to look legitimate but designed to deliver malicious files.
Cybersecurity firm Volexity, which also tracked the campaign but has less visibility into email systems than Microsoft, wrote in a post that relatively low detection rates of the phishing emails suggest the attacker was “likely having some success in breaching targets,” the Associated Press reported.
The email campaign has been going on since at least January and evolved over waves, Microsoft said in a separate blog post.
Microsoft said in Thursday’s blog that Nobelium’s spear-phishing are recurring. “It is anticipated that additional activity may be carried out by the group using an evolving set of tactics,” it said.
Nobelium, Burt said, accessed the USAID’s account with Constant Contact, a mass-mailing service.
On Wednesday, emails were sent that were meant to look like they were from USAID, including some that read “special alert” and “Donald Trump has published new documents on election fraud,” Microsoft said.
The link ultimately goes to infrastructure controlled by Nobelium, which delivers a malicious file. Getting the malicious files delivered allows Nobelium “persistent access to compromised machines,” Microsoft said.
Burt said Microsoft detected the attack through the work of its threat intelligence center in tracking “nation-state actors.” He wrote that the company has no reason to believe there is a vulnerability with its products or services.
The SolarWinds attack, which was discovered late last year, involved hacking widely used software made by the Texas-based company and lead to the infiltration of at least nine federal agencies and dozens of companies.
Microsoft President Brad Smith called it “the largest and most sophisticated attack the world has ever seen.”
The Associated Press contributed.
Source: | This article originally belongs to Nbcnews.com
