Russian hackers still in action against IT companies

It becomes a very bad habit.

"Nobelium is trying to replicate the strategy used in past attacks by targeting organizations that are an integral part of the global IT industry supply chain," Tom Burt, vice president at Microsoft, wrote in a blog post on Sunday. in charge of customer safety.

The American company has spotted these cyber attacks in the form of infiltration since at least May.

Microsoft has warned more than 140 of its “resellers” of SaaS solutions and technology server suppliers that have been targeted.

Sadly, too late for the 14 companies whose IT systems have been compromised.

Suspected of being behind these sophisticated attacks, the Nobelium group became known to the general public in 2020 for the massive hacking of the computer management software publisher SolarWinds.

In a rare attribution exercise, the US government pointed the finger at the Russian secret services of Sluzhba Vneshney Razvedki (SVR).

Same techniques, same damage

"Those who thought that SolarWinds was a unique attack of its kind missed the obvious," said Amit Yoran, CEO of cybersecurity specialist Tenable and former director of cybersecurity at the Department of Defense.

"The cybercriminals behind this infamous breach have, unsurprisingly, put it back through an unsophisticated but large-scale attack," he explains.

As in their previous offensives, Nobelium hackers have resorted to phishing, sending e-mails aimed at recovering data but also "password spraying", a technique used to attempt to '' infiltrate user accounts by testing common passwords.

US President Joe Biden had imposed financial sanctions on Russia and expelled Russian diplomats following the SolarWinds hack.

A reaction from the White House in the same proportions is expected.