Microsoft: Russian-backed hackers targeting cloud services

https://techxplore.com ^ | 25 OCTOBER 2021 | Staff

[Red Badger]

Microsoft says the same Russia-backed hackers responsible for the 2020 SolarWinds breach continue to attack the global technology supply chain and have been relentlessly targeting cloud service companies and others since summer.

The group, which Microsoft calls Nobelium, has employed a new strategy to piggyback on the direct access that cloud service resellers have to their customers' IT systems, hoping to "more easily impersonate an organization's trusted technology partner to gain access to their downstream customers." Resellers act as intermediaries between software and hardware makers and product users.

"Fortunately, we have discovered this campaign during its early stages, and we are sharing these developments to help cloud service resellers, technology providers, and their customers take timely steps to help ensure Nobelium is not more successful," the company said in a blog post.

The Biden administration downplayed the impact of the Russian efforts. A U.S. government official who requested anonymity due to not being authorized to speak on the record, noted that "the activities described were unsophisticated password spray and phishing, run-of-the mill operations for the purpose of surveillance that we already know are attempted every day by Russia and other foreign governments."

Microsoft has been observing Nobelium's latest campaign since May and has notified more than 140 companies targeted by the group, with as many as 14 believed to have been compromised. The attacks have been increasingly relentless since July, with Microsoft noting that it had informed 609 customers that they had been attacked 22,868 times by Nobelium, with a success rate in the low single digits. That's more attacks than Microsoft had flagged rom all nation-state actors in the previous three years.

Earlier this month, Microsoft reported that Russia accounted for the majority of state-sponsored hacking detected by the Seattle-based software and internet giant during the past year. Most of the attacks targeted government agencies and think tanks in the United States, followed by Ukraine, Britain and European NATO members.

The U.S. government has previously blamed Russia's SVR foreign intelligence agency for the SolarWinds hack, which went undetected for most of 2020, compromised several federal agencies and badly embarrassing Washington. The Russian government has denied any wrongdoing.

Microsoft said the recent activity "is another indicator that Russia is trying to gain long-term, systematic access to a variety of points in the technology supply chain and establish a mechanism for surveilling—now or in the future—targets of interest to the Russian government."

[Red Badger]

Ping!...................

[rktman]

DOD: “Hey guys, I got a great idea. We can farm all our data storage out to this Amazon cloud thing. It’ll be awesome.”

[Erik Latranyi]

Thank you Microsoft....you are doing more to safeguard the public than our federal gov’t who is in denial over Russia.

[Fai Mao]

Honestly, having hackers get into a cloud system, and scaring people away from using them, would benefit society.

[T.B. Yoits]

If been in meetings that went sideways when the digital Kool-Aid drinkers promoted the "better security of putting the files (including backups) in The Cloud".

Once you recognize that it's not their files they're talking about, you realize they're promoting something incredibly dangerous in order to facilitate their own minimal convenience.

[Harpotoo]

The cloud? The cloud is safe and secure just like blockchain so why not put EVERYTHING on it and into it$-)

[ProudGOP]

For the most part, the cloud providers are more safe than individual servers. It is very difficult to stay up date security patches. People who maintain their own servers really need full time people devoted to it.

Just ask Hillary since her self maintained email server was compromised by just about everyone

[jimjohn]

You are correct.

But after the Wikileaks dump (and Snowden) about technology that can make it look like it came from anywhere, who says is REALLY has to be Russians?

[Harpotoo]

If the entire US Gov has been hacked how safe is the cloud?
Apr 22, 2021 — We here at GAO are currently conducting a comprehensive review of the breach with plans to issue a public report later this year.

[WKUHilltopper]

Bull sh!t, Microcrap.

[Seruzawa]

Russia Russia Russia.

Could be Russia. Could be the CIA pretending to be Russia.

[Red Badger]

Could be the Russia pretending to be CIA pretending to be Russia..........................