Loading story…
Microsoft said the Russian state-linked actor Nobelium targeted cloud resellers and technology service providers as a route into the global IT supply chain, relying on password spraying, phishing, and credential theft rather than software exploits. The company said it had notified more than 140 resellers and service providers since May 2021 and believed up to 14 were compromised, while between July 1 and October 19 it alerted 609 customers to 22,868 attacks. Microsoft responded by tightening partner-access protections, including stronger MFA requirements, expanded Azure Active Directory security offerings, and new detections across its security tools.
France’s ANSSI/CERT-FR separately reported multiple Nobelium-linked phishing campaigns beginning in February 2021 that compromised email accounts at French organizations and then used those accounts to send weaponized phishing emails to foreign institutions. French public-sector entities also received spoofed messages masquerading as compromised foreign organizations, and ANSSI said the activity shared tactics, techniques, and procedures with the SolarWinds intrusion set. The combined reporting shows a sustained campaign to abuse trusted service-provider and email relationships to reach downstream victims across national and organizational boundaries.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
CERT-FR issued report CERTFR-2021-CTI-011 detailing phishing campaigns attributed to the Nobelium intrusion set, including associated TTPs, infrastructure, recommendations, and indicators of compromise. ANSSI said the activity showed overlaps with the 2020 SolarWinds supply-chain attack.
Microsoft publicly reported that it had notified more than 140 resellers and technology service providers targeted by Nobelium since May 2021 and believed up to 14 had been compromised. It assessed that the Russian state-linked actor was seeking long-term access through trusted technology partners into downstream customer environments.
Between July 1 and October 19, 2021, Microsoft said it notified 609 customers that they had been attacked 22,868 times by Nobelium. Microsoft described this as part of a broader summer 2021 wave of activity, with a low-single-digit success rate.
Microsoft said that on October 15 it launched a program offering two years of Azure Active Directory Premium for free to strengthen partner security controls amid the Nobelium activity.
Microsoft said it began observing a 2021 Nobelium campaign in May 2021 that targeted cloud resellers and technology service providers as a route into customer environments. The company said the actor used password spraying and phishing rather than exploiting software vulnerabilities.
ANSSI reported that phishing campaigns attributed to the Nobelium intrusion set had targeted French entities since February 2021. The campaigns compromised email accounts at French organizations and used them to send weaponized emails to foreign institutions, while French public organizations also received spoofed emails.
Microsoft said that in September 2020 it rolled out multi-factor authentication for access to Partner Center and for use of delegated administrative privilege to manage customer environments, and updated reseller contracts to expand its rights to address reseller security incidents.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
microsoft.com
Open sourcecert.ssi.gouv.fr
Open sourceblogs.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft and U.S. authorities said **Nobelium**, the Russia-linked espionage group associated with the SolarWinds intrusion, used a compromised USAID account at a mass email marketing provider to send phishing emails masquerading as **USAID** alerts. The campaign began around May 25 and targeted thousands of accounts across more than 100 organizations, with reporting indicating the activity reached civil society, diplomatic, election-related, and human-rights groups in at least 24 countries. Identified targets included anti-corruption activists in Ukraine, an employee of the **OSCE**, **EU DisinfoLab**, and former U.S. ambassador to Russia Alexander Vershbow. According to the Justice Department, victims who clicked the malicious link were directed to malware hosted on a subdomain of `theyardservice[.]com`, after which the attackers deployed **Cobalt Strike** for persistence and potential follow-on operations. The DOJ obtained court-authorized seizures of `theyardservice[.]com` and `worldhomeoutlet[.]com`, describing them as infrastructure used for malware delivery and command-and-control, while Microsoft and DHS said they had not yet observed large-scale compromise. U.S. officials said the disruption was intended to cut off the phishing operation and help identify victims, while cautioning that some organizations may already have been backdoored.
Aug 14, 2026
The UK National Cyber Security Centre, FBI, NSA, and CISA warned that Russia’s Foreign Intelligence Service (**SVR**), also tracked as **APT29** and **Nobelium**, is running a broad cyber-espionage campaign that combines mass exploitation of known vulnerabilities with targeted intrusions against governments, diplomats, think tanks, technology firms, financial institutions, and cloud environments. Officials said the group scans the internet for unpatched systems and exploits long-known perimeter flaws including `CVE-2019-19781`, `CVE-2019-11510`, `CVE-2018-13379`, and `CVE-2020-5902`, then uses compromised accounts to move deeper into victim networks and, in some cases, into connected supply chains. The campaign builds on tradecraft previously tied to the **SolarWinds Orion** compromise and later phishing and cloud-focused operations attributed to the SVR. U.S. and allied advisories said the service has shifted toward stealthier methods such as password spraying, abuse of mailbox and cloud permissions, temporary email infrastructure, and reduced reliance on custom malware, though earlier operations also used tools such as **SUNBURST**, **TEARDROP**, **Cobalt Strike Beacon**, and **WELLMESS**. Microsoft separately reported that Nobelium targeted thousands of accounts across hundreds of organizations in a focused espionage effort, while defenders were urged to prioritize patching internet-facing systems, enforce multi-factor authentication, audit identity and mailbox permissions, and investigate signs of lateral movement and account abuse.
Aug 15, 2026
Multiple reports highlight active campaigns using *phishing* and *software supply-chain abuse* to steal credentials and establish persistence. eSentire described an espionage-focused operation targeting residents of India with emails impersonating the Income Tax Department, leading victims to a malicious archive that uses DLL side-loading with a legitimate signed Microsoft application, extensive anti-analysis checks, in-memory shellcode unpacking, UAC bypass, and process masquerading; the payload was identified as a **Blackmoon**-family variant that specifically attempts to disable **Avast Free Antivirus** by automating UI interactions to add exclusions. Separately, Aikido reported a malicious npm package (`ansi-universal-ui`) that deploys a multi-stage infostealer (“**G_Wagon**”) by abusing `postinstall` execution, downloading a Python runtime, running an obfuscated payload, and exfiltrating browser credentials, cloud credentials, Discord tokens, and data from 100+ cryptocurrency wallets to an Appwrite storage bucket; it also includes a Windows DLL used for browser-process injection via NT native APIs. In parallel, network-edge exploitation remains a key access vector: Risky Business reported a renewed wave of attacks against **Fortinet FortiGate** devices via a vulnerability Fortinet allegedly “patched” in December but which attackers can still exploit, enabling SSO authentication bypass (via crafted SAML), creation of new admin accounts, and theft of device configuration; mitigations include disabling the FortiCloud SSO feature (not enabled by default). Several other items are general awareness or roundup content rather than specific incident reporting: TechTarget and other blogs emphasized ongoing phishing/email risk (including relay spam abusing legitimate Zendesk instances) and password hygiene, while The Hacker News published a multi-story bulletin that includes (among other items) a spear-phishing campaign in Afghanistan delivering a FALSECUB backdoor via a GitHub-hosted ISO and LNK execution chain; Risky Business also covered Iran’s internet blackout and Starlink jamming/spoofing as a communications-control issue rather than an enterprise cyber incident.
Jun 29, 2026