{"id":7439,"date":"2021-07-19T17:36:34","date_gmt":"2021-07-20T00:36:34","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7439"},"modified":"2023-04-20T02:31:16","modified_gmt":"2023-04-20T09:31:16","slug":"solarwinds-attackers-at-it-again-in-back-to-back-campaigns","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/solarwinds-attackers-at-it-again-in-back-to-back-campaigns\/","title":{"rendered":"SolarWinds\u2014Attackers at It Again in Back-to-Back Campaigns"},"content":{"rendered":"

Nobelium, the APT group behind the infamous attack on SolarWinds, has resurfaced in two recent campaigns against US-based IT companies and government organizations. Check out Securin\u2019s analysis of 18 vulnerabilities used by the group to exploit and infiltrate their targets.\u00a0<\/strong><\/p>\n

In the last week of June 2021<\/a>, the attackers behind the infamous SolarWinds supply chain incident were back again, targeting Microsoft’s corporate network. The group is said to have stolen credentials from one of its customer service agents and used the information to launch attacks against other Microsoft clients, compromising at least three customer accounts.<\/p>\n

Earlier, in May 2021<\/a>, the same group was identified impersonating a US government agency. The cyberattack piggybacked on a marketing email account of the US Agency for International Development (USAID) and managed to reach 3,000 email accounts across 150 different organizations. However, the White House claims that the intruding attempts were curbed, by and large, and the “noisy” campaign did not cause much damage.<\/p>\n

\n

Dubbed the Nobelium campaign, the attacks have been attributed to the Russian state-sponsored threat group Nobelium, which has been operational since 2008. The group is also known as APT29, Cozy Bear, The Dukes, and UNC2452 and has 11 other aliases.<\/p>\n<\/blockquote>\n

More recently, in early July, the APT29 group was deemed responsible<\/a> for an attack on the American Grand Old Party or the Republican Party.<\/p>\n

Vulnerabilities in APT 29\u2019s Radar<\/h2>\n

Securin\u2019s dynamic threat database has mapped 18 CVEs to APT29, popularly called the Nobelium group. Here is our analysis of these vulnerabilities:<\/p>\n

\"CVEs<\/p>\n

Exploits and Trends<\/h3>\n