Microsoft ‘senior management’ emails accessed by Russian SolarWinds hackers

Microsoft is revealing in the present day that it has found a nation-state assault on its company methods from the identical Russian state-sponsored group of hackers that had been liable for the subtle SolarWinds assault. Microsoft says the hackers, often called Nobelium, had been capable of entry e mail accounts of some members of its senior management staff late final 12 months.

“Starting in late November 2023, the risk actor used a password spray assault to compromise a legacy non-production take a look at tenant account and achieve a foothold, after which used the account’s permissions to entry a really small share of Microsoft company e mail accounts, together with members of our senior management staff and staff in our cybersecurity, authorized, and different features, and exfiltrated some emails and hooked up paperwork,” says the Microsoft Safety Response Middle in a weblog publish filed late on Friday.

Microsoft says the group was “initially concentrating on e mail accounts” for details about themselves, however it’s not clear what different emails and paperwork have been stolen within the course of. Microsoft solely found the assault final week on January twelfth, and the corporate hasn’t disclosed how lengthy the attackers had been capable of entry its methods.

“The assault was not the results of a vulnerability in Microsoft services or products. Thus far, there isn’t any proof that the risk actor had any entry to buyer environments, manufacturing methods, supply code, or AI methods,” says Microsoft.

The assault passed off simply days after Microsoft introduced its plan to overtake its software program safety following main Azure cloud assaults. Whereas Microsoft clients don’t seem to have been impacted on this new incident and this wasn’t the results of a Microsoft vulnerability, that is nonetheless the most recent in a line of cybersecurity incidents for Microsoft. It discovered itself on the heart of the SolarWinds assault practically three years in the past, then 30,000 organizations’ e mail servers had been hacked in 2021 resulting from a Microsoft Change Server flaw, and Chinese language hackers breached US authorities emails by way of a Microsoft cloud exploit final 12 months.

Microsoft is now altering the best way it designs, builds, checks, and operates its software program and providers. It’s the largest change to its safety strategy for the reason that firm introduced its Safety Growth Lifecycle (SDL) in 2004 after large Home windows XP flaws knocked PCs offline.