Security News > 2021 > May > SolarWinds Hackers Impersonate U.S. Government Agency in New Attacks
The Russia-linked threat group believed to be behind the SolarWinds attack has been observed launching a new campaign this week.
The attacks have targeted the United States and other countries, and involve a legitimate mass mailing service and impersonation of a government agency.
The latest attacks were analyzed by Microsoft, which tracks the threat actor as Nobelium, and by incident response firm Volexity, which has found some links to APT29, a notorious cyberspy group previously linked to Russia.
For this attack, Nobelium managed to compromise the Constant Contact account of the United States Agency for International Development, which is responsible for civilian foreign aid and development assistance.
Constant Contact is an email marketing service, and by compromising the Constant Contact account of USAID the attackers were able to send out legitimate-looking emails containing malicious links.
Microsoft said its security solutions blocked many of the attacks aimed at its customers and the tech giant has started notifying targets.
News URL
Related news
- CISA warns critical SolarWinds RCE bug is exploited in attacks (source)
- Unpatched AVTECH IP Camera Flaw Exploited by Hackers for Botnet Attacks (source)
- Hackers Use Fake GlobalProtect VPN Software in New WikiLoader Malware Attack (source)
- Russian military hackers linked to critical infrastructure attacks (source)
- U.S. Offers $10 Million for Info on Russian Cadet Blizzard Hackers Behind Major Attacks (source)
- Chinese hackers use new data theft malware in govt attacks (source)
- SolarWinds Issues Patch for Critical ARM Vulnerability Enabling RCE Attacks (source)
- Hackers deploy AI-written malware in targeted attacks (source)
- N. Korean Hackers Deploy New KLogEXE and FPSpy Malware in Targeted Attacks (source)