Microsoft Tells Affected Users SolarWinds Hacker Had Gained Access to Its Customer Service Tools

Microsoft identifies the group that was also behind SolarWinds breach as Nobelium.

By Reuters | Updated: 28 June 2021 11:05 IST

Photo Credit: Reuters

Microsoft has said the attacker behind SolarWinds attack had gained access to its customer-service tools

Highlights

Microsoft informed its affected customers about the incident
The hacker has been called a sophisticated Nation-State associated actor
Microsoft said the information was used to launch highly-targeted attacks

Microsoft said on Friday an attacker had won access to one of its customer-service agents and then used information from that to launch hacking attempts against customers.

The company said it had found the compromise during its response to hacks by a team it identifies as responsible for earlier major breaches at SolarWinds and Microsoft.

Microsoft said it had warned the affected customers. A copy of one warning seen by Reuters said the attacker belonged to the group Microsoft calls Nobelium and that it had access during the second half of May.

[Sponsored] Samsung Galaxy S24: The Ultimate Camera Phone With Smarter On-Device AI

"A sophisticated Nation-State associated actor that Microsoft identifies as NOBELLIUM accessed Microsoft customer support tools to review information regarding your Microsoft Services subscriptions," the warning reads in part. The US government has publicly attributed the earlier attacks to the Russian government, which denies involvement.

When Reuters asked about that warning, Microsoft announced the breach publicly.

After commenting on a broader phishing campaign it said had compromised a small number of entities, Microsoft said it had also found the breach of its own agent, who it said had limited powers.

SolarWinds Hackers Said to Have Accessed Emails of Top US Security Officials

The agent could see billing contact information and what services the customers pay for, among other things.

"The actor used this information in some cases to launch highly-targeted attacks as part of their broader campaign," Microsoft said.

Microsoft warned affected customers to be careful about communications to their billing contacts and consider changing those usernames and email addresses, as well as barring old usernames from logging in.

Microsoft Failed to Fix Problems That Could Limit SolarWinds Hack: US Senator

Microsoft said it was aware of three entities that had been compromised in the phishing campaign.

It did not immediately clarify whether any had been among those whose data was viewed through the support agent, or if the agent had been tricked by the broader campaign.

Microsoft did not say whether the agent was at a contractor or a direct employee.

SolarWinds Hack Was 'Largest and Most Sophisticated Attack' Ever: Microsoft

A spokesman said the latest breach by the threat actor was not part of Nobelium's previous successful attack on Microsoft, in which it obtained some source code.

In the SolarWinds attack, the group altered code at that company to access SolarWinds customers, including nine US federal agencies.

At the SolarWinds customers and others, the attackers also took advantage of weaknesses in the way Microsoft programmes were configured, according to the Department of Homeland Security.

Microsoft later said the group had compromised its own employee accounts and taken software instructions governing how Microsoft verifies user identities.

A White House official said the latest intrusion and phishing campaign was far less serious than the SolarWinds fiasco.

"This appears to be largely unsuccessful, run-of-the-mill espionage," the official said.

Scott McConnell, a spokesman for Homeland Security's Cybersecurity and Infrastructure Security Agency, said the defensive group “is working with Microsoft and our interagency partners to evaluate the impact. We stand ready to assist any affected entities.”

A SolarWinds spokesperson said, "The latest cyberattack reported by Microsoft does not involve our company or our customers in any way."

We discuss the return of PUBG Mobile, sorry, Battlegrounds Mobile India on Orbital, the Gadgets 360 podcast. Orbital is available on Apple Podcasts, Google Podcasts, Spotify, Amazon Music and wherever you get your podcasts.

Affiliate links may be automatically generated - see our ethics statement for details.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.