Russian spies compromised 14 tech providers, aiming to 'piggyback' on customer access, Microsoft says

Investigators say they caught the apparent intelligence-gathering operation relatively early.

Suspected Russian spies who exploited a federal contractor to breach nine U.S. government agencies last year have continued targeting technology supply chains, aiming to compromise 140 technology service providers in recent months, according to Microsoft.

The Russian nation-state hacking group Nobelium — also known as Cozy Bear — has since May 2021 sought to infiltrate technology resellers, cloud software companies and managed services providers in an attempt to “piggyback” on those firms’ access to other customers, Tom Burt, corporate vice president of customer security and trust, said in an Oct. 24 advisory. The group’s goal, Burt suggested, is to more effectively impersonate an organization in order to breach its clients and partners, a similar tactic that the spies used when they breached U.S. agencies in 2020 by masquerading as SolarWinds.

“We continue to investigate, but to date we believe as many as 14 of these resellers and service providers have been compromised,” Burt said. “Fortunately, we have discovered this campaign during its early stages, and we are sharing these developments to help cloud service resellers, technology providers and their customers take timely steps to help ensure Nobelium is not more successful.”

Investigators did not identify the targeted organizations by name, or suggest whether attackers appeared to be carrying out the campaign with an ultimate goal.

The 2020 SolarWinds breach, in which attackers infected U.S. networks by spreading malware in what appeared to be a software update from the tech firm, granted intruders access to a range of sensitive information. A hack at the Justice Department, for instance, resulted in the compromise of email inboxes belonging to potentially thousands of employees. Attackers also breached the Treasury Department, accessing information about U.S. sanctions policy toward Russian individuals.

The latest apparent intelligence-gathering operation represents one facet of how the Russian group has been more active in recent months. Microsoft said it informed 609 customers they had been targeted on 22,868 occasions “with a success rate in the low single digits.” In the three years prior to July 1, 2021, Microsoft notified customers about 20,500 hacking attempts from all nation-state groups combined.

“The recent activity is another indicator that Russia is trying to gain long-term, systematic access to a variety of points in the technology supply chain and establish a mechanism for surveilling — now or in the future — targets of interest to the Russian government,” the Microsoft advisory stated.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure