Nobelium abuse of reseller delegated administrative privileges
Microsoft disclosed on October 24, 2021 that since May 2021 Nobelium had targeted more than 140 cloud resellers and technology service providers, compromising as many as 14, to use their delegated administrative privileges into downstream customer tenants. Between July 1 and October 19, 2021 Microsoft saw 22,868 attack attempts against 609 customers, using password spraying, phishing and token theft.
- Victim
- Multiple: cloud resellers and managed service providers and their customers
- Industry
- Technology
- Country
- Global
- Intrusion began
- May 2021
- First disclosed
- Oct 24, 2021
- Actor
- Nobelium (APT29) (Nation-state)
- Initial access
- Third-party access
- Identity control that failed
- Authorization
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- 14 (As many as 14 resellers and service providers compromised out of more than 140 targeted, per Microsoft.)
- Disclosed cost
- Not disclosed
The identity lesson
Delegated admin rights held by partners are standing privileged access into your tenant; removing unused delegations and moving to granular, time-bound partner roles shrinks this path.
Go deeper on SWI
- Technique: Password spraying
- Product involved: Microsoft Entra ID
Sources
- New activity from Russian actor Nobelium, Microsoft On the Issues, Oct 24, 2021
- NOBELIUM targeting delegated administrative privileges to facilitate broader attacks, Microsoft Security Blog, Oct 25, 2021
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- LAPSUS$ access to Okta support via Sitel engineer workstation 2022 · Third-party access
- Nobelium password spray campaign and Microsoft support agent compromise 2021 · Password spraying
- Commvault Metallic breach exposes Microsoft 365 app secrets 2025 · Third-party access
- Cisco Duo SMS MFA logs stolen from a phished telephony provider 2024 · Third-party access
Cite this record
SWI Community Team. (2026). Nobelium abuse of reseller delegated administrative privileges. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2021-nobelium-delegated-admin-privileges/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.