Russian hackers launch major cyberattack on U.S. agencies, weeks before Biden-Putin summit

The Russian hackers thought to be behind the catastrophic SolarWinds attack last year have launched another major cyberattack, Microsoft warned three weeks before President Joe Biden is to meet with Russian President Vladimir Putin.

Microsoft said in a blog post Thursday that the hacking group, known as Nobelium, had targeted over 150 organizations worldwide in the last week, including government agencies, think tanks, consultants and nongovernmental organizations.

They sent phishing emails — spoof messages designed to trick people into handing over sensitive information or downloading harmful software — to more than 3,000 email accounts, the tech giant said.

At least 25% of the targeted organizations are involved in international development, humanitarian and human rights work, said Tom Burt, Microsoft’s corporate vice president of customer security and trust.

“These attacks appear to be a continuation of multiple efforts by Nobelium to target government agencies involved in foreign policy as part of intelligence gathering efforts,” Burt said.

Organizations in at least 24 countries were targeted, Microsoft said, with the U.S. receiving the largest share of attacks.

The breach has been discovered three weeks before the Biden-Putin summit in Geneva on June 16.

It also comes a month after the U.S. government explicitly said that the SolarWinds hack was carried out by Russia’s SVR, a successor to the foreign spying operations of the Soviet KGB.

The Kremlin said Friday it does not have any information on the cyberattack and that Microsoft needs to answer more questions, including how the attack is linked to Russia, Reuters reported. The Kremlin did not immediately respond to CNBC’s request for comment.

The hack explained

Microsoft said Nobelium gained access to an email marketing account used by the U.S Agency for International Development, the federal government’s aid agency. The account is held on a platform called Constant Contact.

Burt said Nobelium used the account to “distribute phishing emails that looked authentic but included a link that, when clicked, inserted a malicious file.”

The file contains a backdoor that Microsoft calls NativeZone, which can “enable a wide range of activities from stealing data to infecting other computers on a network,” according to Burt, who said Microsoft is in the process of notifying customers who have been targeted.

USAID said a forensic investigation into the breach is ongoing.

“The U.S. Agency for International Development became aware of potentially malicious email activity from a compromised Constant Contact email marketing account,” a USAID spokesperson said in a statement shared with CNBC. “The forensic investigation into this security incident is ongoing. USAID has notified and is working with all appropriate Federal authorities, including the U.S. Department of Homeland Security and the Cybersecurity and Infrastructure Security Agency.”

A spokesperson for Constant Contact told CNBC the company is aware that the account credentials of one its customers were compromised and used by a malicious actor to access the customer’s Constant Contact accounts.

“This is an isolated incident, and we have temporarily disabled the impacted accounts while we work in cooperation with our customer, who is working with law enforcement,” they said.

A CISA spokesperson told CNBC the agency is aware of the the potential compromise and that it was working with the FBI and USAID to better understand the extent of what’s happened.

Turn to CNBC TV for the latest stock market news and analysis. From market futures to live price updates CNBC is the leader in business news worldwide.


Connect with CNBC News Online

#CNBC
#CNBCTV

[MarkSmith-huyf]

The USA need to show strong against Russia - if not it became a laughing stock of the word.

[privatepilot]

Strange that JBS and Colonial Pipeline owners are members of the World Economic Forum? Probably just a coincidence. I’m sure a real reporter will pick up on this.

[T.K.P.]

One thing i know, they weren't Russian

[Jake]

This is embarrassing! Why can't the US do a better job?

[amvorv]

I want justice and punish them all and pay me big and imprison them all and lose everything all that is what they have and be able to block listed each of their names one by one !! Paybacks penalties

[RogerM]

They could try to hack Biden's teleprompter. Would an ultimate meme.

[met]

Bad behavior from Russia??? How about horrible behavior from United States?
Always interfere with other countries politics . Mind your own business and make a piece in your country first!

[charlessmith]

Yeah, yeah, yeah, Covid, Covid, Covid, Russia, Russia, Russia! Come on man!

[dennisvenable]

Putin himself said a while back the next war would be a cyber war remember

[bbranett]

Where is Jim Browning when you need him?

[whackyscripts]

Those damm russians, should we set them free boys?

[warequalsnofuture]

*OPERATION CYBERPOLYGON ! ! !* (WEF / Schwab / Interpol) > like Event201

[donard]

US MARINES SHOULD TRAIN IN COPUTERS AND WORLDWIDE WEB 😃 🤣😅😂😂😂

[wokedawg]

I’m blessed to met you *Fundsauce* on telegram!!! You made me a man of myself with your best sauce dawg