Microsoft Says Russian Hackers Going After Govt Agencies, Think Tanks, NGOs

Microsoft said that the Russia-based hacker group designated Nobelium has this week targeted government agencies, think tanks, consultants, and non-governmental organisations. Nobelium is also blamed for the notorious SolarWinds cyberattacks that breached multiple departments of the US federal government last year.

In a blog post, the Redmond-based software giant revealed that the hackers went after 3,000 email accounts at over 150 different organisations in at least 24 countries – although the organisations in the US took the brunt of the cyberattacks. At least a quarter of the affected organisations worked on international development, humanitarian, and human rights issues.

The hackers apparently began their attacks by obtaining access to the Constant Contact account of USAID, the US government agency responsible for foreign aid and developmental assistance. Then they sent out phishing emails with a link that, when clicked, installs a backdoor that Microsoft calls NativeZone, which can be used for a variety of actions like stealing data or infecting other computers on a network.

Hackers backed by the Russian government have been blamed for quite a few high-profile breaches in the US. For example, they’re suspected to have stolen thousands of emails from the US State Department, and penetrating the National Nuclear Security Administration – which oversees the US nuclear weapons stockpile.

Earlier in the year, Microsoft blamed China-backed hackers for compromising its mail server software Microsoft Exchange in order to access email accounts. That breach was so serious that the FBI eventually decided to access private computers in the US to purge them of backdoors.

Google Denies Service Downtime Caused By Data Centre Fire In France; Russian Authorities Disagree

Google and Russia have provided conflicting reasons to why Google and YouTube services were briefly disrupted in the country, the BBC reported. The Russian government blamed a fire at cloud provider OVH data centres in Strasbourg, France. But Google disputes this.

Instead, the tech giant attributed the downtime to a router misconfiguration at a local third-party internet service provider.

“Following extensive investigation we have no evidence to indicate that the fire in OVHCloud’s data centre, or Google’s own infrastructure, was the root cause of this incident,” Google said, according to the BBC.

In contrast, Roskomnadzor, Russia’s media regulating authority, pointed fingers at the fire and said the service disruptions were “not connected to the agency’s actions on restriction of speed of access to the Twitter social platform”.

Roskomnadzor had recently slowed down the speed of Twitter in the country, claiming the platform failed to remove 3,000 posts related to suicide, drugs, and pornography. The authority said the move was aimed at protecting Russian citizens.

Incredibly popular in Russia, Twitter is frequently used by government opponents like Alexei Navalny, a fierce critic of Russian President Vladimir Putin.

OVH, which operates the affected data centre, boasts 1.6 million customers across 140 countries. But Google services in Russia are not believed to be routed through OVH, the BBC said.

The fire does have one confirmed victim – the multiplayer video game Rust. The game’s developers tweeted that some player progression data was gone for good.