Russian hackers launch major cyberattack through U.S. aid agency’s email system, Microsoft says

The Russian hackers thought to be behind the catastrophic SolarWinds attack last year have launched another major cyberattack

The Russian hackers thought to be behind the catastrophic SolarWinds attack last year have launched another major cyberattack, Microsoft warned three weeks before President Joe Biden is to meet with Russian President Vladimir Putin.

Microsoft said in a blog post-Thursday that the hacking group, known as Nobelium, had targeted over 150 organizations worldwide in the last week, including government agencies, think tanks, consultants, and non-governmental organizations.

The US plans a combination of moves towards Russia over SolarWinds cyberattack

They sent phishing emails — spoof messages designed to trick people into handing over sensitive information or downloading harmful software — to more than 3,000 email accounts, the tech giant said.

At least 25% of the targeted organizations are involved in international development, humanitarian, and human rights work, said Tom Burt, Microsoft’s corporate vice president of customer security and trust.

 “These attacks appear to be a continuation of multiple efforts by Nobelium to target government agencies involved in foreign policy as part of intelligence gathering efforts,” Burt said.

The US expels Russian diplomats in reaction to SolarWinds hack

Organizations in at least 24 countries were targeted, Microsoft said, with the U.S. receiving the largest share of attacks.

The breach has been discovered three weeks before the Biden-Putin summit in Geneva on June 16.

It also comes a month after the U.S. government explicitly said that the SolarWinds hack was carried out by Russia’s SVR, a successor to the foreign spying operations of the Soviet KGB.

The Kremlin said Friday it does not have any information on the cyberattack and that Microsoft needs to answer more questions, including how the attack is linked to Russia, Reuters reported. The Kremlin did not immediately respond to CNBC’s request for comment.

Russian, Chinese hackers can also additionally have stolen European vaccine facts

Microsoft said Nobelium gained access to an email marketing account used by the U.S Agency for International Development, the federal government’s aid agency. The account is held on a platform called Constant Contact.

Burt said Nobelium used the account to “distribute phishing emails that looked authentic but included a link that, when clicked, inserted a malicious file.”

The file contains a backdoor that Microsoft calls NativeZone, which can “enable a wide range of activities from stealing data to infecting other computers on a network,” according to Burt, who said Microsoft is in the process of notifying customers who have been targeted.

A spokesperson for Constant Contact told CNBC the company is aware that the account credentials of one of its customers were compromised and used by a malicious actor to access the customer’s Constant Contact accounts.

“This is an isolated incident, and we have temporarily disabled the impacted accounts while we work in cooperation with our customer, who is working with law enforcement,” they said.

Steve Forbes, a government cybersecurity expert at domain name manager Nominet, outlined the dangers of these types of hacks.

“Phishing attacks are essentially a numbers game and the attackers are playing the odds,” he said in a statement. “If they target 3,000 accounts, it only takes one employee to click on the link to establish a backdoor for the hackers in a government organization.”

The SolarWinds attack, uncovered in December, turned out to be much worse than first expected. It gave the hackers access to thousands of companies and government offices that used SolarWinds IT software.

Microsoft President Brad Smith described that attack as “the largest and most sophisticated attack the world has ever seen.”

Earlier this month, Russia’s spy chief denied responsibility for the SolarWinds cyberattack but said he was “flattered” by the accusations from the U.S and the U.K. that Russian foreign intelligence was behind such a sophisticated hack.