Microsoft said it discovered malware on one of its customer support agent's computers that was collecting information on customers. This was discovered during a wider investigation into hacking activity connected to Nobelium, the suspected group behind the SolarWinds attack last year.
Microsoft said the "information-stealing malware" was on a machine with access to basic account information for a small number of customers. The hacker used this information in some cases to launch highly-targeted attacks as part of their broader campaign. Microsoft said it quickly removed the access and secured the device, and the customers are being informed.
The activity otherwise uncovered by the investigation was "mostly unsuccessful, and the majority of targets were not successfully compromised", Microsoft said. It found only three compromised entities to date, and they are being notified.
In a blog post, Microsoft stressed that "this type of activity is not new" and underlines the need for multi-factor authentication and zero-trust security environment. The hacking was targeted at specific customers, primarily IT companies (57%), followed by government (20%), and smaller percentages for non-governmental organizations and think tanks, as well as financial services. The activity was largely focused on US interests, about 45 percent, followed by 10 percent in the UK, and smaller numbers from Germany and Canada. In all, 36 countries were targeted.
