Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Application Security

Microsoft Says Its Services Not Used as Entry Point by SolarWinds Hackers

In response to speculation that its services may have been leveraged as an initial entry point by the hackers who breached IT management firm SolarWinds, Microsoft said on Thursday there was no evidence to back those claims.

In response to speculation that its services may have been leveraged as an initial entry point by the hackers who breached IT management firm SolarWinds, Microsoft said on Thursday there was no evidence to back those claims.

Reports, including from several mainstream media publications, have speculated about the role of Microsoft services in the SolarWinds attack and other operations conducted by the same threat group. The Wall Street Journal reported on February 2 that even SolarWinds’ new CEO, Sudhakar Ramakrishna, said one of the several theories was that the attackers may have compromised his company’s Office 365 accounts and then used that as an initial point of entry.

However, in a blog post published on the SolarWinds website on February 3, Ramakrishna said that while the attackers did leverage Microsoft services as part of the attack, the investigation so far leads them to believe that “the most likely attack vectors came through a compromise of credentials and/or access through a third-party application via an at the time zero-day vulnerability.”

He clarified, “While we’ve confirmed suspicious activity related to our Office 365 environment, our investigation has not identified a specific vulnerability in Office 365 that would have allowed the threat actor to enter our environment through Office 365.

“We’ve confirmed that a SolarWinds email account was compromised and used to programmatically access accounts of targeted SolarWinds personnel in business and technical roles. By compromising credentials of SolarWinds employees, the threat actors were able to gain access to and exploit our Orion development environment,” Ramakrishna added.

In a blog post on Thursday, Microsoft, which dubbed the attack “Solorigate,” also said there was no indication that SolarWinds was attacked via Office 365.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) revealed recently that many of the organizations targeted by the SolarWinds hackers were breached through attack vectors that did not involve the SolarWinds supply chain attack, leaving many to speculate that Microsoft services may have been abused.

Microsoft said on Thursday that while data hosted in Microsoft email and other services was targeted by the hackers “post compromise,” it had found no evidence that its services were used as an initial entry point into the systems of organizations, claiming that the attackers apparently gained privileged credentials “in some other way.”

Advertisement. Scroll to continue reading.

“From the beginning, we have said that we believe this is a sophisticated actor that has many tools in its toolkit, so it is not a surprise that a sophisticated actor would also use other methods to gain access to targets. In our investigations and through collaboration with our industry peers, we have confirmed several additional compromise techniques leveraged by the actor, including password spraying, spearphishing, use of webshell, through a web server, and delegated credentials,” Microsoft said.

After the SolarWinds supply chain attack came to light, Microsoft said it had notified some customers about suspicious activity related to their Azure and Microsoft 365 accounts. The list of organizations alerted by Microsoft includes cybersecurity firms CrowdStrike, which said the attackers attempted to read emails but failed, and Malwarebytes, which admitted that the hackers did gain access to “a limited subset of internal company emails.”

Related: Microsoft Details OPSEC, Anti-Forensic Techniques Used by SolarWinds Hackers

Related: China-Linked Hackers Exploited SolarWinds Flaw in U.S. Government Attack: Report

Related: Biden Orders Intelligence Agencies to Assess SolarWinds Hack

Related: Hundreds of Industrial Organizations Received Sunburst Malware in SolarWinds Attack

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Identity & Access

Zero trust is not a replacement for identity and access management (IAM), but is the extension of IAM principles from people to everyone and...

CISO Strategy

SecurityWeek spoke with more than 300 cybersecurity experts to see what is bubbling beneath the surface, and examine how those evolving threats will present...

Cybercrime

Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

CISO Conversations

Joanna Burkey, CISO at HP, and Kevin Cross, CISO at Dell, discuss how the role of a CISO is different for a multinational corporation...