{"id":41501,"date":"2021-06-26T03:28:11","date_gmt":"2021-06-26T03:28:11","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/solarwinds-backdoor-gang-pwns-microsoft-support-agent-to-turn-sights-on-customers\/"},"modified":"2021-06-26T03:28:11","modified_gmt":"2021-06-26T03:28:11","slug":"solarwinds-backdoor-gang-pwns-microsoft-support-agent-to-turn-sights-on-customers","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/solarwinds-backdoor-gang-pwns-microsoft-support-agent-to-turn-sights-on-customers\/","title":{"rendered":"SolarWinds backdoor gang pwns Microsoft support agent to turn sights on customers"},"content":{"rendered":"

In brief<\/span> The SolarWinds backdoor gang last month infiltrated Microsoft’s support desk via a phishing attack to obtain information to use in cyber-attacks on some of the Windows giant’s own customers, it was reported.<\/p>\n

Redmond said it traced the intrusion to a member of a team it calls Nobelium<\/a>, the suspected Kremlin-run crew that used tainted SolarWinds Orion updates to snoop on organizations around the world. Russia insists it had nothing to do with that supply-chain attack. And SolarWinds told us this latest caper did not involve its products.<\/p>\n

It appears Microsoft was investigating a wider phishing campaign orchestrated by Nobelium when it discovered one of its own support agents had been hooked by the gang, handing the miscreants access to internal tools. That worker could view customers’ contact information, lists of their cloud subscriptions, and other records.<\/p>\n