Thread by @jseldin

#Russia|n hackers behind the massive #SolarWinds hack are at it again - targeting +140 tech service providers since May, per @Microsoft's @TomBurt45

"To date we believe as many as 14 of these resellers & service providers have been compromised"
blogs.microsoft.com/on-the-issues/…

The #Russia|n hackers are "attempting to replicate the approach it has used in past attacks by targeting organizations integral to the global IT supply chain" per @Microsoft's @TomBurt45

The #Russia|n group, aka #Nobelium, "ultimately hopes to piggyback on any direct access that resellers may have to their customers’ IT systems & more easily impersonate an organization’s trusted technology partner to gain access to their downstream customers" per @Microsoft

"This recent activity is another indicator that #Russia is trying to gain long-term, systematic access to a variety of points in the technology supply chain & establish a mechanism for surveilling–now or in the future–targets of interest" per @Microsoft's @TomBurt45

"These attacks have been a part of a larger wave of #Nobelium activities" per @Microsoft's @TomBurt45 "Btw July 1 & October 19 this year, we informed 609 customers that they had been attacked 22,868 times by Nobelium, with a success rate in the low single digits"

More on #Russia #cyber from @Mandiant

"While the SolarWinds supply chain attack involved malicious code...this recent intrusion activity has involved leveraging stolen identities & the networks of technology solutions, services & reseller companies" per SVP Charles Carmakal

"This attack path makes it very difficult for victim organizations to discover they were compromised & investigate the actions taken by the threat actor" per @Mandiant's Carmakal in statement

re #Russia #cyber

"Similar to the victimology observed in the 2020 campaign, the targets of this intrusion activity appear to ultimately be gvt organizations & other organizations that deal in matters of interest to #Russia" per @Mandiant's Carmakal