Microsoft resellers warned of Nobelium attacks on IT supply chain

Microsoft believes that 22,868 attacks have been conducted against 609 partners since July

The Microsoft logo on the front of an office building

Microsoft has warned its resellers and managed service providers that the hacking group behind the SolarWinds cyber attack has now turned its attention to the company's global supply chain.

The tech giant said that it believes the Russian state-backed hacking group, known as Nobelium, ultimately hopes to piggyback on any direct access that resellers may have to their customers’ IT systems and more easily impersonate an organisation’s trusted technology partner to gain access to their downstream customers.

Microsoft said that the attacks used well-known techniques, like password spray and phishing, to steal legitimate credentials and gain privileged access. It began observing Nobelium’s latest campaign in May 2021 and has been notifying affected partners and customers.

So far, the company has notified over 140 resellers and technology service providers currently being targeted by the group. It also believes as many as 14 resellers and service providers have already been compromised.

These attacks have been part of a larger wave of Nobelium activities this summer, the company said. Between 1 July and 19 October, Microsoft believes that 22,868 attacks were conducted by the group against 609 customers, with a success rate in the low single digits. As a comparison, before 1 July, approximately 20,500 attacks from nation-state hackers were recorded over the course of three years.

“This recent activity is another indicator that Russia is trying to gain long-term, systematic access to a variety of points in the technology supply chain and establish a mechanism for surveilling – now or in the future – targets of interest to the Russian government,” said Tom Burt, corporate vice president of Customer Security & Trust.

From what it has learned over the past several months, Microsoft is working to implement improvements to better secure and protect its technology partners. This includes launching a programme on 15 October to provide two years of an Azure Active Directory Premium plan for free to strengthen security controls, and it’s piloting new granular features for organisations that want to provide privileged access to resellers.

Related Resource

The best defence against ransomware

How ransomware is evolving and how to defend against it

Blue padlock Free download

It's also piloting improved monitoring to help partners and customers manage and audit their delegated privileged accounts and remove unnecessary authority, as well as auditing unused privileged accounts and working with partners to assess and remove unnecessary privilege and access.

The company also revealed it has been coordinating with the security community to improve its knowledge of Nobelium’s activity, including government agencies in the US and Europe. It believes it is in a much better position to defend against these threats thanks to the US cyber security executive order and information sharing between industry and government.

In September, it emerged that Nobelium was stealing data from Active Directory Federation Services (AD FS) servers, with Microsoft warning that the group was found to be using a post-exploitation backdoor dubbed FoggyWeb to remotely exfiltrate sensitive data.

The group was also blamed for an attack on a Microsoft employee’s computer in June, implanting malware on a device belonging to a customer support agent to obtain information belonging to customers.

Featured Resources

2021 Thales cloud security study

The challenges of cloud data protection and access management in a hybrid and multi cloud world

Free download

IDC agility assessment

The competitive advantage in adaptability

Free Download

Digital transformation insights from CIOs for CIOs

Transformation pilotes, co-pilots, and engineers

Free download

What ITDMs did next - and what they should be doing now

Enable continued collaboration and communication for hybrid workers

Recommended

The true story behind the IBM Personal Computer
Hardware

The true story behind the IBM Personal Computer

3 Dec 2021
Microsoft hit with formal complaint over "monopolistic" software bundling
collaboration

Microsoft hit with formal complaint over "monopolistic" software bundling

29 Nov 2021
Gmail vs Outlook.com: Which one is better?
email providers

Gmail vs Outlook.com: Which one is better?

26 Nov 2021
Business customers can get 30% off the Surface Laptop Go for Black Friday 2021
Laptops

Business customers can get 30% off the Surface Laptop Go for Black Friday 2021

26 Nov 2021

Most Popular

What should you really be asking about your remote access software?
Sponsored

What should you really be asking about your remote access software?

17 Nov 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

30 Nov 2021
How to move Microsoft's Windows 11 from a hard drive to an SSD
Microsoft Windows

How to move Microsoft's Windows 11 from a hard drive to an SSD

24 Nov 2021