Microsoft has warned that Russian nation-state hacking group Nobelium has been targeting global IT supply chains less than a year after its devastating cyberattack on IT vendor SolarWinds.
The tech giant said Nobelium was specifically targeting IT “resellers and other technology service providers that customise, deploy and manage cloud services and other technologies on behalf of their customers”.
Go deeper with GlobalData
Such companies are a lucrative target for cybercriminals and nation-state hacking groups because they can gain access to multiple organisations with one successful cyberattack.
“We believe Nobelium ultimately hopes to piggyback on any direct access that resellers may have to their customers’ IT systems and more easily impersonate an organisation’s trusted technology partner to gain access to their downstream customers,” Microsoft said in a blog post.
Between 1 July and 19 October this year, Microsoft said it notified 609 of its customers that they had been attacked a total of 22,868 times by Nobelium. For context, Microsoft said total attempted nation-state attacks totalled 20,500 in the three years prior to 1 July.
However, the success rate in the latest campaign was in the “low single digits”, Microsoft said.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalData“If successful, lateral movement across the compromised organisation’s network would be the next stage, allowing for data theft, reconnaissance, compromise of customer systems and more,” said Glasswall CEO Danny Lopez.
Nobelium, which has been officially designated as part of Russia’s foreign intelligence service the SVR, did not use any new vulnerabilities to conduct its attack. Instead, it utilised techniques such as phishing and password spray in an attempt to steal credentials.
Alicia Townsend, technology Evangelist at OneLogin, said the low success rate was an encouraging sign that suggested targeted organisations “implemented some basic defences such as security training for their employees and requiring multi-factor authentication when users log on”.
But for organisations successfully targeted in a supply chain attack, the results can be highly damaging – as discovered by US firm SolarWinds at the end of 2020.
Nobelium injected a security backdoor into network management software made by SolarWinds. Roughly 18,000 entities installed the malicious update, allowing the attacking group to gain access to numerous companies and government agencies.
A recent report suggested the SolarWinds hackers sought access to US counter-intelligence policy, Covid-19 information and details on sanctions against Russia.
More recently Miami-based IT vendor Kaseya was targeted in a supply chain attack, which saw up to 1,500 businesses affected by a weaponised software update that delivered a ransomware payload.
“Nobelium’s ongoing supply chain attacks show the importance of closing loopholes to trusted relationships that cause downstream impacts,” said Saket Modi, co-founder and CEO at Safe Security. “Social engineering, cloud misconfigurations relating to unverified delegated administrative privileges, password sprays, API theft, supply chain attacks – are all threat actor techniques that businesses are actively monitoring, but in a siloed and disjointed fashion.”
In June, Microsoft warned that the Kremlin-backed hacking group had been conducting password spray and brute-force attacks to gain entry into corporate systems.
Microsoft added the latest efforts from Nobelium are “another indicator that Russia is trying to gain long-term, systematic access to a variety of points on the technology supply chain and establish a mechanism for surveilling targets of interest to the Russian government”.
