Russian hackers who are blamed for the massive SolarWinds attack on the US last year seem to be running what the White House calls “unsophisticated, run-of-the-mill operations.”
With coordinated attacks targeting companies and organisations in the US and Europe since May, it would appear the hackers are using “residential IP proxies” to gain access through the home networks of thousands of unsuspecting Americans.
In a blog post Sunday, Microsoft said Nobelium — the Russian-based agency behind last year’s widespread SolarWinds attack — uses cloud service providers to obtain the data.
Microsoft revealed these attacks in a blog post.
“Nobelium has been attempting to replicate the approach it has used in past attacks by targeting organisations integral to the global IT supply chain,” Microsoft said in its blog post.
“This time, it is attacking a different part of the supply chain: resellers and other technology service providers that customise, deploy and manage cloud services and other technologies on behalf of their customers.
“We believe Nobelium ultimately hopes to piggyback on any direct access that resellers may have to their customers’ IT systems and more easily impersonate an organization’s trusted technology partner to gain access to their downstream customers.”
Microsoft said it notified “609 customers that they had been attacked 22,868 times” since May.
The company claims that only a small percentage of attempts were successful.
“This recent activity is another indicator that Russia is trying to gain long-term, systematic access to a variety of points in the technology supply chain and establish a mechanism for surveilling — now or in the future — targets of interest to the Russian government,” Microsoft said.
“The attacks we’ve observed in the recent campaign against resellers and service providers have not attempted to exploit any flaw or vulnerability in software but rather used well-known techniques, like password spray and phishing, to steal legitimate credentials and gain privileged access.”
A Biden administration called the attacks “unsophisticated, run-of-the-mill operations that could have been prevented if the cloud service providers had implemented baseline cybersecurity practices.”
“We can do a lot of things,” the administration told the New York Times, “but the responsibility to implement simple cybersecurity practices to lock their — and by extension, our — digital doors rests with the private sector.”
