Security Experts:

Connect with us

Hi, what are you looking for?



Microsoft: SolarWinds Hackers Attempted to Access Our Systems Until January 2021

Microsoft said on Thursday that it has completed its internal investigation into the activities conducted by the hackers that breached Texas-based IT management firm SolarWinds.

Microsoft said on Thursday that it has completed its internal investigation into the activities conducted by the hackers that breached Texas-based IT management firm SolarWinds.

The tech giant previously admitted that the hackers had managed to access some internal source code, but said they did not compromise or modify its software.

The company on Thursday confirmed that some source code was accessed, but claimed impact was limited.

“There was no case where all repositories related to any single product or service was accessed. There was no access to the vast majority of source code. For nearly all of code repositories accessed, only a few individual files were viewed as a result of a repository search,” it said.

Microsoft said the attackers apparently first accessed source code in late November, but their attempts did not stop after the breach was discovered and resolved in December. They continued making attempts until January 2021, but none of these attempts were successful.

The company said the attackers downloaded source code from repositories storing “a small subset” of Azure (service, security and identity), Intune, and Exchange components.

Microsoft also determined — based on the search terms used by the hackers — that they were attempting to find “secrets” in the source code they accessed.

“Our development policy prohibits secrets in code and we run automated tools to verify compliance. Because of the detected activity, we immediately initiated a verification process for current and historical branches of the repositories. We have confirmed that the repositories complied and did not contain any live, production credentials,” the company said.

Microsoft also reiterated that it had found no evidence that production services or customer data were compromised, or that its own systems were used to attack others.

“Because of our defense-in-depth protections, the actor was also not able to gain access to privileged credentials or leverage the SAML techniques against our corporate domains,” Microsoft said.

Last month, Microsoft released a report detailing the methods and activities of the threat actor behind the SolarWinds attack, including operational security (OPSEC), anti-forensic behavior, and malware delivery methods.

Microsoft and others have claimed that more than 1,000 hackers may have been involved in the SolarWinds attack, but some cybersecurity professionals have questioned the claims.

SolarWinds was apparently targeted by two unrelated threat groups: one linked to Russia that compromised its systems and delivered trojanized updates to thousands of customers, and one linked to China that did not breach SolarWinds systems and instead exploited a zero-day vulnerability and delivered a piece of malware after gaining access to victims’ systems.

SolarWinds released patches in response to both attacks, but many of its customers have failed to secure their systems, according to a report from risk assessment firm RiskRecon.

Related: White House Names SolarWinds Response Leader Amid Criticism

Related: Hundreds of Industrial Organizations Received Sunburst Malware in SolarWinds Attack

Related: More Cybersecurity Firms Confirm Being Hit by SolarWinds Hack

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...


The FBI dismantled the network of the prolific Hive ransomware gang and seized infrastructure in Los Angeles that was used for the operation.

Management & Strategy

Industry professionals comment on the recent disruption of the Hive ransomware operation and its hacking by law enforcement.

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.