Microsoft said on Friday that the hackers behind the notorious SolarWinds cyberattack have launched a fresh campaign mostly focusing on U.S. interests that, while mostly unsuccessful, managed to compromise three entities.
The bulk of the attacks—45 percent—targeted entities within the United States, followed by 10 percent in the UK, and smaller numbers in Germany and Canada. The activity targeted specific customers, Microsoft said, mostly IT companies (57 percent), government agencies (20 percent), followed by smaller percentages for non-governmental organizations, think tanks, and financial services.
"This recent activity was mostly unsuccessful, and the majority of targets were not successfully compromised—we are aware of three compromised entities to date," Microsoft said. The company did not specify the entities that were breached or targeted, but said it was contacting all those affected by the cyberattack.
As part of its probe into the new campaign, Microsoft detected information-stealing malware on a computer belonging to one of its customer support agents who had access to account information for a "small number" of customers.
The threat actor, which Microsoft identified as Nobelium, "used this information in some cases to launch highly-targeted attacks as part of their broader campaign." Microsoft said it "responded quickly, removed the access, and secured the device."
In the SolarWinds attack, which has been attributed to Nobelium, the group altered code to access SolarWinds customers, including nine U.S. federal agencies.
Microsoft later said that the group had compromised its own employee accounts and taken software instructions governing how Microsoft verifies user identities.
U.S. authorities have linked Nobelium to Russia’s Foreign Intelligence Service, allegations Moscow denies.