Microsoft warns of new supply chain attacks by Russian-backed Nobelium group

3 years ago 323

The cybercrime radical down the SolarWinds hack remains focused connected the planetary IT proviso chain, says Microsoft, with 140 resellers and work providers targeted since May.

russia-hacking-american-elections-data-2d-illustration-picture-id1048316356.jpg

The Russian-backed hacking radical liable for the SolarWinds onslaught has been targeting much companies with the extremity of disrupting the worldwide IT proviso chain. In a blog station published Monday, Microsoft cautioned of caller attacks by Nobelium, revealing that it notified 140 resellers and exertion work providers targeted by the group. As portion of an ongoing investigation, Microsoft said it believes arsenic galore arsenic 14 of these organizations person been compromised since May.

SEE: Incident effect policy (TechRepublic Premium)

Known for an attack past twelvemonth that exploited a information flaw successful web monitoring bundle from SolarWinds, Nobelium has lately been targeting a antithetic segment, specifically resellers and different work providers that negociate unreality services and different technologies for customers.

The group's apt extremity is to get nonstop entree that resellers person to the IT systems of their customers. If successful, Nobelium would past person a mode to impersonate a exertion supplier and onslaught its downstream customers.

"These attacks person been a portion of a larger question of Nobelium activities this summer," Microsoft said. "In fact, betwixt July 1 and October 19 this year, we informed 609 customers that they had been attacked 22,868 times by Nobelium, with a occurrence complaint successful the debased azygous digits. By comparison, anterior to July 1, 2021, we had notified customers astir attacks from each nation-state actors 20,500 times implicit the past 3 years."

SEE: SolarWinds attack: Cybersecurity experts stock lessons learned and however to support your business (TechRepublic)

Identified arsenic portion of Russia's SVR overseas quality service, Nobelium is conscionable 1 of the players successful the Kremlin's efforts to summation entree to organizations successful the exertion proviso concatenation to behaviour surveillance. The alleged cyber acold war has been heating up successful caller years arsenic federation states and groups operating connected their behalf person launched attacks designed to not lone spy connected but destabilize rival governments. The U.S. hasn't been shy astir pointing the digit astatine Russia and China arsenic 2 of the main perpetrators down respective cardinal incidents.

The 2020 SolarWinds hack took vantage of a information vulnerability successful the firm's Orion networking show platform. By exploiting this flaw, the attackers were capable to show interior emails astatine the U.S. Treasury and Commerce departments and compromise different authorities agencies and backstage assemblage companies astir the world, each of whom utilized the Orion product. Initially, the culprit was publically identified arsenic a Russian-backed group; yet the U.S. and different entities placed the blasted specifically connected Nobelium.

To transportation retired the latest incidents outlined by Microsoft connected Monday, Nobelium employed specified techniques arsenic phishing campaigns and password spraying, a brute-force maneuver done which hackers usage automated tools to effort to get the passwords of a ample fig of accounts successful 1 shot. This instrumentality relies connected the inclination of radical to usage anemic passwords oregon reuse their passwords crossed aggregate sites.

"Nobelium is simply a genuinely persistent adversary," said Jake Williams, co-founder and CTO astatine BreachQuest. "Often organizations neglect to afloat remediate incidents, leaving the menace histrion entree to the web aft the remediation is considered complete. Nobelium is 1 of the champion successful the menace histrion ecosystem astatine remaining undetected aft a remediation attempt. This is not a DIY task for astir organizations and volition apt necessitate nonrecreational assistance to beryllium palmy owed to the assortment of tools and tradecraft used."

SEE: SolarWinds-related cyberattacks airs sedate hazard to authorities and backstage sector, says CISA (TechRepublic)

In another blog station published Monday, Microsoft issued warnings to unreality work providers, organizations that trust connected elevated privileges and downstream customers, each of whom could beryllium susceptible to attacks from Nobelium.

The institution said that it discovered the radical targeting privileged accounts of work providers to determination laterally successful unreality environments and summation entree to downstream customers. Noting that Nobelium didn't exploit a information vulnerability this clip arsenic it did successful the SolarWinds hack, Microsoft said the group's much caller tactics person included proviso concatenation attacks, token theft, API abuse, and spear phishing.

"When cybercriminals find an onslaught method that works, they instrumentality with it," said Panorays CTO and co-founder Demi Ben-Ari. "So it's not astonishing that the Nobelium menace group, which was liable for the monolithic SolarWinds proviso concatenation onslaught past year, is continuing to people downstream customers done their work providers successful bid to inflict maximum damage."

In its blog post, Microsoft issued respective circumstantial recommendations for unreality providers and their customers, specified arsenic enabling multi-factor authentication, checking enactment logs and removing delegated administrative privileges erstwhile nary longer needed. Microsoft's recommendations are thorough but besides time-consuming to implement. That benignant of effort poses challenges for galore organizations.

"Implementation of immoderate of the recommended mitigation measures, specified arsenic reviewing, hardening and monitoring each tenant head accounts, reviewing work supplier permissions and reviewing auditing logs, should beryllium array stakes for information successful immoderate larger organization," Williams said. "However, the world is that astir organizations are assets strapped. This makes complying with these recommendations hard for much organizations."

But adjacent organizations lacking successful time, resources oregon unit tin amended unafraid and support themselves with immoderate halfway cyber hygiene practices.

"The bully quality is that organizations tin assistance forestall these kinds of attacks by implementing information champion practices including enabling MFA and minimizing entree privileges," Ben-Ari said. "To execute this rapidly and effectively, however, it's important to person a robust and automated third-party information absorption programme successful spot to measure proviso concatenation partners, adjacent cyber gaps and continuously show for immoderate issues."

Cybersecurity Insider Newsletter

Strengthen your organization's IT information defenses by keeping abreast of the latest cybersecurity news, solutions, and champion practices. Delivered Tuesdays and Thursdays