The cybercrime group behind the SolarWinds hack remains focused on the global IT supply chain, says Microsoft, with 140 resellers and service providers targeted since May. The Russian-backed hacking group responsible for the SolarWinds attack has been targeting more companies with the goal of disrupting the worldwide IT supply chain.
In a blog post published Monday, Microsoft cautioned of new attacks by Nobelium, revealing that it notified 140 resellers and technology service providers targeted by the group.
“These attacks have been a part of a larger wave of Nobelium activities this summer,” Microsoft said.
SEE: SolarWinds-related cyberattacks pose grave risk to government and private sector, says CISA. In another blog post published Monday, Microsoft issued warnings to cloud service providers, organizations that rely on elevated privileges and downstream customers, all of whom could be vulnerable to attacks from Nobelium.
Noting that Nobelium didn’t exploit a security vulnerability this time as it did in the SolarWinds hack, Microsoft said the group’s more recent tactics have included supply chain attacks, token theft, API abuse, and spear phishing.
“So it’s not surprising that the Nobelium threat group, which was responsible for the massive SolarWinds supply chain attack last year, is continuing to target downstream customers through their service providers in order to inflict maximum damage.”
