Nobelium password spray campaign and Microsoft support agent compromise

On June 25, 2021 Microsoft reported Nobelium password spray and brute-force attacks against customers, mostly IT companies (57%) and government (20%) across 36 countries, with three compromised entities known. Microsoft also found information-stealing malware on a device belonging to one of its customer support agents, whose access to basic customer account information the actor used for targeted attacks.

Victim

Multiple: Microsoft customers, mainly IT companies and government

Industry

Cross-industry

Country

Global

Intrusion began

Not disclosed

First disclosed

Jun 25, 2021

Actor

Nobelium (APT29) (Nation-state)

Initial access

Password spraying

Identity control that failed

Authentication

MFA

Not disclosed

Abused identity

Human account

Records affected

3 (Microsoft said it was aware of three compromised entities.)

Disclosed cost

Not disclosed