Microsoft has announced that a Russian intelligence group hacked into the email accounts of some of the company's top executives.
The attack was carried out by Nobelium or Midnight blizzard, the same group that violated him SolarWinds government vendor in 2020. Microsoft detected it last week, according to the company, and the announcement comes after new US regulations for the immediate disclosure of cybersecurity incidents went into effect. A Microsoft spokesperson said that while the company does not believe the attack had a material impact, it still wants to honor the regulations.
In late November, the team was able to gain access to “a legacy non-production test tenant account,” says Microsoft on its blog.
After gaining access, the team “used account privileges to gain access to a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions, and obtained certain emails and attached documents,” the company says.
Microsoft's "senior leadership team" includes chief financial officer Amy Hood and chairman Brad Smith, who meets regularly with CEO Satya Nadella. Microsoft said it has found no evidence that Nobelium had access to customer data, production systems or proprietary source code.
The US government and Microsoft consider the Nobelium group part of the Russian foreign intelligence service SVR.
The hacking group was responsible for one of the most prolific breaches in US history when it added malicious code to updates to SolarWinds' Orion software, which was used by some US government agencies.
Microsoft itself was caught in this particular hack.
Nobelium, also known as APT29 or Cozy Bear, is a sophisticated hacking group that has attempted to breach the systems of US allies and the Department of Defense.
