Hackers linked to Russian intelligence services stole the emails and documents of several Microsoft executives as part of a hacking campaign, the American company announced on Friday, January 19.
In a brief stock market press release, Microsoft explained that it had discovered on January 12 that a state actor had managed to access the emails of some of the company’s employees (without specifying the exact number) as part of the attack. Started in November 2023. Microsoft claimed on January 13 that it had managed to cut off the hackers’ access.
To date, it is unclear how the hackers managed to gain entry. According to Microsoft, the perpetrators of the operation began by doing what is known as “password spraying,” that is, they tested commonly used or previously used passwords. A large number of email addresses related to Microsoft’s infrastructure were stolen, before being compromised. Old test account.
An actor linked to the SolarWinds hack
It is not clear how the hackers managed to control other electronic mailboxes from there. But, according to the company, they had access “A very small percentage of Microsoft accounts”including company officials or employees of the security or legal teams.
The attack was attributed by Microsoft to Nobelium (also called Midnight Blizzard in the company’s typology). This is an actor alleged to have ties to the Russian Federation’s foreign intelligence service, the SVR. According to the American company, the hackers may have specifically sought information about themselves in compromised emails and internal documents, in order to learn what Microsoft knew about their activities.
Nobelium is specifically accused of being behind the SolarWinds hack, one of the largest computer espionage operations attributed to Russia. In August 2023, Microsoft also reported another hacking campaign attributed to Nobelium, which used the compromised accounts of some of its customers to launch phishing attacks against other organizations.
