Security News > 2021 > May > Russian gang behind SolarWinds hack returns with phishing attack disguised as mail from US aid agency
Nobelium, the Russia-aligned gang identified as the perpetrators of the supply chain attack on SolarWinds' Orion software, has struck again, Microsoft vice president Tom Burt in a blogpost Thursday.
Burt's post says the attacks saw Nobelium gain access to accounts on the email marketing service "Constant Contact" operated by The United States Agency for International Development.
The attack is global, although most victims were in the US. The attacks targeted around 3,000 email accounts and 150 different organization, at least a quarter of which were in international development, humanitarian, and the human rights sphere.
Microsoft has detailed the attack in a separate post that explains its Threat Intelligence Center has observed the attack since January 2021 and spotted "Significant experimentation" but little impact.
That changed on May 25th when Nobelium started using Constant Contact and unleashed "Several iterations" of a phishing attack.
News of the new Russian action comes in the week that US president Biden announced a planned mid-June meeting with Russian president Vladimir Putin.
News URL
Related news
- Microsoft: Hackers steal emails in device code phishing attacks (source)
- A PostgreSQL zero-day was also exploited in US Treasury hack (CVE-2025-1094) (source)
- Russian phishing campaigns exploit Signal's device-linking feature (source)
- Darktrace: 96% of Phishing Attacks in 2024 Exploited Trusted Domains Including SharePoint & Zoom Docs (source)
- Phishing attack hides JavaScript using invisible Unicode trick (source)
- Week in review: PostgreSQL 0-day exploited in US Treasury hack, top OSINT books to learn from (source)
- FatalRAT Phishing Attacks Target APAC Industries Using Chinese Cloud Services (source)
- Bybit Hack Traced to Safe{Wallet} Supply Chain Attack Exploited by North Korean Hackers (source)
- 2024 phishing trends tell us what to expect in 2025 (source)
- Hackers Exploit AWS Misconfigurations to Launch Phishing Attacks via SES and WorkMail (source)