APT29

New Delhi: Microsoft has admitted that the alleged Russian hackers behind the massive SolarWinds attack that affected several top-notch enterprises and government agencies, attempted activities beyond just the presence of malicious SolarWinds code in its environment. Microsoft has discovered that its systems were infiltrated "beyond just the presence of malicious SolarWinds code." In a Security Response Center update, the tech giant said that hackers were able to "view source code in a number of source code repositories". "We detected unusual activity with a small number of internal accounts and upon review, we discovered one account had been used to view source code in a number of source code repositories," the company said in the update late on Thursday. The account did not have permissions to modify any code or engineering systems and "our investigation further confirmed no changes were made. These accounts were investigated and remediated". At least 24 big companies including tech giants like Intel, Cisco, VMware and Nvidia suffered part of the SolarWinds hack allegedly orchestrated by Russia-backed cybercriminals. The suspected Russian hackers installed a malware in the Orion software sold by the IT management company SolarWinds and accessed sensitive data belonging to several US government agencies, at least one hospital and a university. According to Microsoft, it detected malicious SolarWinds applications in its environment, which were isolated and removed. "Having investigated further, we can now report that we have not found evidence of the common TTPs (tools, techniques and procedures) related to the abuse of forged SAML tokens against our corporate domains," the company informed. The SolarWings hacking "has not put at risk the security of our services or any customer data, but we want to be transparent and share what we're learning as we combat what we believe is a very sophisticated nation-state actor". Cybersecurity firms FireEye and CrowdStrike have admitted they were affected during the SolarWinds attack. Russia has denied having any role in the hacking. Microsoft President Brad Smith said last month that they have identified more than 40 customers who have been affected by nation-state hackers who installed malware in SolarWinds' Orion platform. The hacking group, known as APT29, or Cozy Bear, is behind the attack on FireEye, accessing its internal network and stealing hacking tools the company uses to test the networks belonging to its customers. Source: IANS

SolarWinds hackers saw some of our source code: Microsoft