Microsoft identifies second hacking group affecting SolarWinds software

The discovery underscores the extent to which SolarWinds, whose customers include Fortune 500 companies, is a valuable target for hackers.

Microsoft revealed that a second hacking group had deployed malicious code that affects software made by SolarWinds, the federal contractor at the center of a suspected Russian espionage campaign against multiple U.S. government agencies.

“[T]he investigation of the whole SolarWinds compromise led to the discovery of an additional malware that also affects the SolarWinds Orion product but has been determined to be likely unrelated to this compromise and used by a different threat actor,” a Microsoft research team said in a blog post on Friday.

The discovery underscores the extent to which Texas-based SolarWinds, whose software is used throughout Fortune 500 companies, is a valuable target for hackers.

The newly revealed malware, known to researchers as Supernova, differs from the alleged Russian tampering because it does not appear to involve a compromise of the supply chain, Microsoft said. The Supernova code does, however, allow an attacker to send and execute a malicious program on the victim’s device, Microsoft said.

While Russian hackers are suspected in the compromise of the Orion software updates, it is unclear who is responsible for the additional malware discovered by Microsoft. A spokesperson for Microsoft declined to comment.

Researchers from cybersecurity firm Palo Alto Networks described Supernova as using “in-memory execution,” meaning the malicious code is loaded within a computer’s memory rather than on its disk. This suggests the code is designed to evade certain cybersecurity software that covers more external parts of a computer.

U.S. lawmakers have announced investigations into the alleged Russian supply-chain compromise of SolarWinds, and victims are still coming forward.

Treasury Secretary Steven Mnuchin confirmed on Monday that his department had been breached via “third-party software.” Treasury had stayed quiet compared to some other government agencies that acknowledged they had been hit. Mnuchin said on CNBC that the hackers didn’t break in to the department’s classified systems, a subject that drew interest from Capitol Hill.

Moscow has denied involvement in the hacking campaign.

Any investigation into the second hacking group that targeted SolarWinds software will likely be overshadowed by the probe into alleged Russian espionage. But in the meantime, security researchers have a new lead to explore.

Tim Starks contributed reporting.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure