Nobelium Again for a Supply Chain ! Microsoft Warns
Share this:
Microsoft has warned that the Russia-based cyber criminals, behind the massive SolarWinds software attack last year, are on the prowl again, this time targeting atleast 140 organisations integral to the global IT supply chain.
Nobelium was behind the cyberattacks targeting SolarWinds customers in 2020, and which the US government and others have identified as being part of Russia’s foreign intelligence service known as the SVR.
Since May, we have notified more than 140 resellers and technology service providers that have been targeted by Nobelium. We continue to investigate, but to date we believe as many as 14 of these resellers and service providers have been compromised.
This time, it is attacking a different part of the supply chain: resellers and other technology service providers that customise, deploy and manage cloud services and other technologies on behalf of their customers.
Nobelium ultimately hopes to piggyback on any direct access that resellers may have to their customers’ IT systems and more easily impersonate an organisation’s trusted technology partner to gain access to their downstream customers.
Between July 1 and October 19 this year, we informed 609 customers that they had been attacked 22,868 times by Nobelium, with a success rate in the low single digits,”
By comparison, prior to July 1, 2021, Microsoft had notified customers about attacks from all nation-state actors 20,500 times over the past three years.
This recent activity is another indicator that Russia is trying to gain long-term, systematic access to a variety of points in the technology supply chain and establish a mechanism for surveilling now or in the future targets of interest to the Russian government.
Nation state actors, cybercriminals and other malicious actors continue to target weaknesses in software supply chains and many vendors don’t have the tools or expertise to stop them.
Microsoft has said it would invest $20 billion in the next five years on cyber security
