Microsoft (MSFT.O) said on Friday an attacker had won access to one of its customer-service agents and then used information from that to launch hacking attempts against customers.
The company said it had found the compromise during its response to hacks by a team it identifies as responsible for earlier major breaches at SolarWinds (SWI.N) and Microsoft.
Microsoft said it had warned the affected customers. A copy of one warning seen by Reuters said the attacker belonged to the group Microsoft calls Nobelium and that it had access during the second half of May.
[…]
Microsoft said it had also found the breach of its own agent, who it said had limited powers.
The agent could see billing contact information and what services the customers pay for, among other things.
“The actor used this information in some cases to launch highly-targeted attacks as part of their broader campaign,” Microsoft said.
Microsoft warned affected customers to be careful about communications to their billing contacts and consider changing those usernames and email addresses, as well as barring old usernames from logging in.
Microsoft said it was aware of three entities that had been compromised in the phishing campaign.
It did not immediately clarify whether any had been among those whose data was viewed through the support agent, or if the agent had been tricked by the broader campaign.
Microsoft did not say whether the agent was at a contractor or a direct employee.
A spokesman said the latest breach by the threat actor was not part of Nobelium’s previous successful attack on Microsoft, in which it obtained some source code.
In the SolarWinds attack, the group altered code at that company to access SolarWinds customers, including nine U.S. federal agencies.
[…]
A White House official said the latest intrusion and phishing campaign was far less serious than the SolarWinds fiasco.
“This appears to be largely unsuccessful, run-of-the-mill espionage,” the official said.
Source: Microsoft says new breach discovered in probe of suspected SolarWinds hackers | Reuters
Yup. Because espionage is “run-of-the-mill” nowadays. Nothing to see here. Boring. 😀
Robin Edgar
Organisational Structures | Technology and Science | Military, IT and Lifestyle consultancy | Social, Broadcast & Cross Media | Flying aircraft