Microsoft warns of ‘sophisticated’ Russian email attack targeting government agencies

[CyberTech]

Content source

https://www.theverge.com/2021/5/28/22458202/microsoft-nobelium-hack-usaid-email-phishing-hacking-target-solarwinds

Microsoft has raised the alarm over a “sophisticated” ongoing cyberattack believed to be from the same Russia-linked hackers behind the SolarWinds hack. In a blog post, Tom Burt, Microsoft’s corporate vice president for customer security and trust, said the attack appears to be targeting government agencies, think tanks, consultants, and NGOs. In total, around 3,000 email accounts are believed to have been targeted across 150 organizations. Victims are spread across upward of 24 countries, but the majority are believed to be in the US.

According to Microsoft, hackers from a threat actor called Nobelium were able to compromise the US Agency for International Development’s account on a marketing service called Constant Contact, allowing them to send authentic-looking phishing emails. Microsoft’s post contains a screenshot of one of these emails, which claimed to contain a link to “documents on election fraud” from Donald Trump. However, when clicked, this link would install a backdoor that let the attackers steal data or infect other computers on the same network.

 

[Andy Ful]

An example of the attack:



More about HTML smuggling (good and well known technique):

Ways of phishing 2 - HTML smuggling

As a sequel of my previous post, I’m going to talk a little bit about another technique used in phishing that I encountered recently. This technique is HTML smuggling. This method is not new, but it definitely appears in more and more attacks, including phishing scenarios. This is why it is so...

forensixchange.com

The article shows also a difference between downloading and smuggling.

The malicious shortcut file (slip.lnk) can use LOLBins to execute the malicious code.
Other even more sophisticated attacks are noted here:

Breaking down NOBELIUM’s latest early-stage toolset | Microsoft Security Blog

In this blog, we highlight four tools representing a unique infection chain utilized by NOBELIUM: EnvyScout, BoomBox, NativeZone, and VaporRage. These tools have been observed being used in the wild as early as February 2021 attempting to gain a foothold on a variety of sensitive diplomatic and...

www.microsoft.com