The state-backed Russian group behind a massive hacking campaign revealed last year, has reemerged with a series of attacks on government agencies, think tanks, consultants and other organizations, Microsoft security researchers said.
A security update from Microsoft late Thursday said the group known as Nobelium has stepped up attacks, notably targeting government agencies involved in foreign policy as part of intelligence gathering efforts.
Microsoft said it detected a "sophisticated" and large-scale campaign that delivered phishing emails delivering malicious software and enabling the hackers to get protected data from victims.
"This wave of attacks targeted approximately 3,000 email accounts at more than 150 different organizations," Microsoft vice president Tom Burt said in a blog post.
The news comes a month after Washington imposed sanctions and expelled Russian diplomats in response to Moscow's involvement in the massive attacks last year on SolarWinds, a security software firm, election interference and other hostile activity.
"When coupled with the attack on SolarWinds, it's clear that part of Nobelium's playbook is to gain access to trusted technology providers and infect their customers," wrote Burt. "By piggybacking on software updates and now mass email providers, Nobelium increases the chances of collateral damage in espionage operations and undermines trust in the technology ecosystem."
The new attacks enabled the hackers to gain access to email servers which allowed them to spoof the United States Agency for International Development and send out mass emails with disinformation, according to the update.
In one example, emails appearing to be from USAID showed a "special alert" stating that "Donald Trump has published new documents on election fraud."
Users who clicked on the link were directed to a site delivering malicious software and enabling the hackers to exfiltrate data, according to Microsoft.
"This attack is still active, so these indicators should not be considered exhaustive for this observed activity," Microsoft said in its update.
SolarWinds last year disclosed that as many as 18,000 customers and more than 100 U.S. companies were affected by the hack. Its roster of clients includes government agencies and companies among the top 500 in the United States.
Washington has accused Russia of orchestrating the online assault, explicitly citing its Foreign Intelligence Service (SVR).
