Loading story…
Microsoft and U.S. authorities said Nobelium, the Russia-linked espionage group associated with the SolarWinds intrusion, used a compromised USAID account at a mass email marketing provider to send phishing emails masquerading as USAID alerts. The campaign began around May 25 and targeted thousands of accounts across more than 100 organizations, with reporting indicating the activity reached civil society, diplomatic, election-related, and human-rights groups in at least 24 countries. Identified targets included anti-corruption activists in Ukraine, an employee of the OSCE, EU DisinfoLab, and former U.S. ambassador to Russia Alexander Vershbow.
According to the Justice Department, victims who clicked the malicious link were directed to malware hosted on a subdomain of theyardservice[.]com, after which the attackers deployed Cobalt Strike for persistence and potential follow-on operations. The DOJ obtained court-authorized seizures of theyardservice[.]com and worldhomeoutlet[.]com, describing them as infrastructure used for malware delivery and command-and-control, while Microsoft and DHS said they had not yet observed large-scale compromise. U.S. officials said the disruption was intended to cut off the phishing operation and help identify victims, while cautioning that some organizations may already have been backdoored.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
The Department of Homeland Security's cyber division said it had not seen significant impact on federal government agencies from the campaign. The statement reflected the U.S. government's early assessment of the incident's effects.
Microsoft said it had not seen evidence of any significant number of compromised organizations at that time. This was an early impact assessment following disclosure of the campaign.
The FBI and CISA issued a joint cybersecurity advisory regarding the spear-phishing activity. The advisory followed Microsoft's disclosure and accompanied broader U.S. government response efforts.
The United States seized theyardservice[.]com and worldhomeoutlet[.]com under court orders after determining they were used for malware delivery and command-and-control in the USAID-themed campaign. The Justice Department said the action was intended to disrupt follow-on exploitation and help identify compromised victims.
Microsoft published a security alert describing a sophisticated email-based attack attributed to Nobelium. It said the attackers used a breached USAID account to send phishing emails to about 3,000 accounts at 150 organizations in 24 countries.
On or about May 25, attackers began a wide-scale spear-phishing campaign using a compromised USAID account at a mass email marketing company. The operation targeted thousands of email accounts across more than 100 entities and delivered malware from attacker-controlled infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
cyberscoop.com
Open sourcejustice.gov
Open sourceblogs.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft said the Russian state-linked actor **Nobelium** targeted cloud resellers and technology service providers as a route into the global IT supply chain, relying on **password spraying**, phishing, and credential theft rather than software exploits. The company said it had notified more than **140** resellers and service providers since May 2021 and believed up to **14** were compromised, while between July 1 and October 19 it alerted **609 customers** to **22,868** attacks. Microsoft responded by tightening partner-access protections, including stronger MFA requirements, expanded Azure Active Directory security offerings, and new detections across its security tools. France’s **ANSSI/CERT-FR** separately reported multiple Nobelium-linked phishing campaigns beginning in February 2021 that compromised email accounts at French organizations and then used those accounts to send weaponized phishing emails to foreign institutions. French public-sector entities also received spoofed messages masquerading as compromised foreign organizations, and ANSSI said the activity shared tactics, techniques, and procedures with the **SolarWinds** intrusion set. The combined reporting shows a sustained campaign to abuse trusted service-provider and email relationships to reach downstream victims across national and organizational boundaries.
Aug 15, 2026
Researchers and U.S. authorities reported multiple spearphishing campaigns linked with moderate confidence to **APT29/Nobelium/Cozy Bear** that targeted government agencies, NGOs, research institutions, embassies, and other high-value organizations. In one campaign, emails impersonating **USAID** used **Constant Contact** links to deliver malicious ISO files containing a decoy PDF, a weaponized **`.lnk`** shortcut, and a DLL loader that launched **Cobalt Strike Beacon** through `rundll32.exe`; CISA said the beacon used HTTP traffic disguised as requests for **`.woff2`** files and embedded metadata in a `_cfuid` cookie while contacting infrastructure including **theyardservice.com** subdomains and **worldhomeoutlet.com**. Volexity also identified a second-stage malware family, **FRESHFIRE**, which retrieved encrypted payloads from Firebase and decrypted them with host-specific logic before deleting the remote content. The activity fit a broader pattern seen in earlier and later operations attributed to the same cluster. FireEye documented a separate campaign in which attackers impersonated the **U.S. Department of State**, delivered ZIP archives with malicious shortcuts, used PowerShell to drop a decoy document, and installed Cobalt Strike Beacon communicating with **pandorasong.com** via a modified malleable C2 profile. Fortinet later described embassy-focused phishing that used **HTML smuggling** to build an ISO on the victim system, then relied on shortcut-triggered DLL execution to deploy another beacon, showing continued reuse of ISO-based delivery, decoy documents, and staged loaders across politically themed intrusion attempts.
Aug 15, 2026
The U.S. Justice Department and Microsoft disrupted infrastructure used by **Star Blizzard**, a Russia-linked threat group tied to the FSB, by seizing more than 100 internet domains used in spear-phishing and credential-theft operations. Federal investigators obtained a warrant for **41 domains**, while Microsoft secured a civil court order covering **66 more**, targeting infrastructure allegedly operated by the group also known as **Callisto Group**, **COLDRIVER**, and **SEABORGIUM**. Authorities said the domains were used to impersonate trusted contacts and lure victims into surrendering credentials or granting access to email accounts and computers. U.S. officials said the campaign targeted government personnel, former intelligence officials, Department of Defense and State employees, defense contractors, Department of Energy staff, journalists, think tanks, NGOs, and other civil society organizations. The Justice Department said the operation sought sensitive information related to U.S. defense, foreign affairs, and nuclear energy research, while Microsoft reported that Star Blizzard had targeted at least **82 customers** and more than **30 civil society organizations** since 2023, at a pace of roughly one attack per week. The disruption was presented as part of a broader effort to blunt Russian intelligence collection and reduce the risk of interference affecting democratic institutions and public-interest groups.
Jun 29, 2026