Microsoft claims Russian hackers compromised U.S. international aid agency

By Ian Miles Cheong
|
May 28, 2021

AP Photo/Thibault Camus, file

By David Menzies

The Truth About Springfield

Springfield, Ohio, a town of 50,000, saw 20,000 migrants from Haiti arrive, causing a culture shock. Locals reported pets like kittens and geese being stolen, cooked, and eaten. But is this true, or just Internet click-bait? We've sent David Menzies to find out.

Take Action

E-transfer (Canada):
[email protected] - password RebelNews if required

Cheques made out to Rebel News:
Rebel News Network Ltd.
PO Box 61056 Eglinton/Dufferin RO
Toronto, ON M6E 5B2

Crypto

Remove Ads

Hackers responsible for the intrusion on SolarWinds, which have been linked to Russia’s intelligence services, are now reported to have compromised an email system used by the U.S. State Department’s international aid agency, USAID. The breach in the email system is reported to have compromised the computer networks of human rights organizations and various U.S. government agencies.

Newsweek reports that Microsoft’s disclosure of the breach comes just weeks before President Joe Biden is set to meet Russian President Vladimir Putin in Geneva, Switzerland. In a blog post on Thursday, Microsoft said that it discovered a “wide-scale malicious email campaign” operated by Nobelium, a Russian hacking group responsible for the attack on SolarWinds and its customers last year.

Microsoft stated:

NOBELIUM has historically targeted government organizations, non-government organizations (NGOs), think tanks, military, IT service providers, health technology and research, and telecommunications providers. With this latest attack, NOBELIUM attempted to target approximately 3,000 individual accounts across more than 150 organizations, employing an established pattern of using unique infrastructure and tooling for each target, increasing their ability to remain undetected for a longer period of time.

The company states that it has been monitoring the hacking campaign since January, which has evolved over a series of waves “demonstrating significant experimentation” on part of the hackers. The campaign escalated on May 25, when Nobelium used a marketing account used by USAID to launch spear phishing attacks on numerous organizations to gain access to their data.

The latest attack targeted around 3,000 individual accounts across 150 organizations and originated from authentic USAID email addresses, Microsoft said.

Microsoft lists the attack as an “active incident” and urged organizations to investigate and monitor communications that match the characteristics of the attack described in the report. The company also prescribed a list of actions to help systems and network administrators deal with the ongoing issue.

The attack from Nobelium comes only weeks after a portion of the United States gas infrastructure was shut down when hackers from a group calling itself DarkSide hit Colonial Pipeline with a ransomware attack.

Spread the Word!