MagicWeb From Nobelium APT

MagicWeb From Nobelium APT

Researchers at Microsoft observed the activity of Russia-backed Nobelium APT that uses the backdoor after gaining administrative privileges to an Active Directory Federated Services server. With that elevated privileged access,…
CEELoader added to Nobelium Arsenal
Posted inSecurity

CEELoader added to Nobelium Arsenal

Researchers have identified two distinct clusters of activity, tracked UNC3004 and UNC2652, that were associated with the Russia-linked Nobelium APT group (aka UNC2452). The NOBELIUM APT is the threat actor…
Tomiris backdoor linked to Nobelium

Tomiris backdoor linked to Nobelium

Researchers discovered new malware containing several attributes that potentially connect it to DarkHalo, the threat actor behind the Sunburst attack in connection with SolarWinds. The DarkHalo compromised a widely used…
Posted inSecurity

FoggyWeb Backdoored ADFS

Microsoft has published extensive information on new malware it calls FoggyWeb, deployed by Russia-linked threat actors Nobelium who are said to be behind the devastating SolarWinds supply chain attack on…
Nobelium again

Nobelium again

Hackers breached a computer used by one of its customer service agents and stole account data they then used to launch "highly-targeted" attacks on customers. The company identified the hacking…