New SolarWinds Related Breaches Reported…


June 28, 2021

New SolarWinds Related Breaches Reported...

Chalk another one up for the bad guys…

Microsoft announced late Friday afternoon that Nobelium (the same nation-state hackers who organized and carried out the SolarWinds hack) has struck again, this time using the Redmond, WA-based company directly to aide them in their nefarious schemes.

Yes, you read that right the attackers compromised Microsoft directly. How do you ask? Well, they targeted a Microsoft employee via malware, which infected the employee’s computer.

The computer in question belonged to Microsoft’s Customer Support team. Using the information gathered on the employee’s machine, Nobelium was able to compromise Microsoft customers directly via a Phishing campaign. 


Microsoft’s statement (which you can read here) stressed the activity was mostly unsuccessful but honestly, would they tell us if it had been? I think not.

Anywho, this seems like a good opportunity to freshen up those anti-phishing skills, dear reader! 

What is Phishing?

Phishing is the fraudulent attempt to obtain sensitive information or data, such as usernames, passwords, and credit card details, by disguising oneself as a trustworthy entity in an electronic communication.

Typically carried out by email spoofing, instant messaging, and text messaging, phishing often directs users to enter personal information at a fake website that matches the look and feel of the legitimate site.

Phishing is an example of social engineering techniques used to deceive users. Users are lured by communications purporting to be from trusted parties such as social websites, auction sites, banks, colleagues/executives, online payment processors, or IT administrators.

Attempts to deal with phishing incidents include legislation, user training, public awareness, and technical security measures (the latter being due to phishing attacks frequently exploiting weaknesses in current web security).

How to Stop a Phishing Attack:

Slow Down and Control Your Emotions

Remember the attacker is trying to manipulate your emotions into making a quick reaction. The more time you take to think about the situation the more likely you’ll start to realize something’s up.

We might be animals when it comes to our emotions, but we’re also brilliant. By slowing down, our rational brain allows us to overcome our feelings.

Think About What You’re Reading, Seeing, or Hearing

The more time you give yourself for rational thought, the better off you are when it comes to seeing through the attacker’s ruse.

Look for things like strange word choices or misspellings. Look for visual clues like off-brand graphics (if it comes from someplace like your bank or a store you frequent).

You’re more astute than you might give yourself credit for. If something seems off, it probably is.

Check to See Who Sent the Message

Email masking is incredibly prominent in today’s world. Most email clients format the sender’s address so that it’s easier to discern who it’s from. The problem is attackers leverage this.

If you’ve got the feeling the message you’re reading isn’t on the level check to see who sent it. If the name is familiar, but the email address isn’t there’s a good chance you’re experiencing a social engineering attack.

Don’t Follow Blind Links

 Links are easy to hide, just like email addresses. If you can’t discern where a web link is going to send you don’t click on it.

Always make sure to hover or right-click on an email link (whatever your email client is set up for) to see where it might send you.

Be Wary of Attachments

If you’ve gone through the steps mentioned above, you probably know what I’m going to say here. Don’t download attachments from people you don’t know.

Sometimes it’s a bad idea to download attachments from people that you do. Be on the lookout for e-mail attachments that appear to be Microsoft Word or Excel files. They might contain pretty nasty surprises.


If you’re looking for more information regarding Phishing or other types of social engineering attacks please read our FREE Social Engineering Guide!

Like our blog? Subscribe using the CTA in the upper right-hand corner of this page. Feel like sharing your thoughts with us? Use the comment section below.

Carl Keyser is the Content Manager at Integris.

Keep reading

Bridging the Gap between Automation and Innovation

Bridging the Gap between Automation and Innovation

Automation and Innovation. Some people might say those two words cancel each other out. Yet, I believe these two concepts can create capacity for each other—if your business leverages the free time automation creates to foster innovation. Automation can be...

Why Is My Laptop Draining So Fast?

Why Is My Laptop Draining So Fast?

Before You Replace Your Laptop Battery, Try These Fixes First Stuck with a laptop that’s running out way before it’s standard 8-10 hours of run time? Don't throw it out just yet.  Try these quick fixes to extend its life: Reduce your screen brightness If possible,...