Winter storm warnings continue in northern Minnesota 

MPR News helps you turn down the noise and build shared understanding. Turn up your support for this public resource and keep trusted journalism accessible to all. 

Turn Up Your Support

The same Russian hackers who carried out the SolarWinds attack and other malicious campaigns have now attacked groups involved in international development, human rights and other issues, according to Microsoft. The company says the breach began with a takeover of an email marketing account used by the U.S. Agency for International Development.

News of the attack comes less than three weeks before President Biden is slated to 

 with Russian President Vladimir Putin. The White House said earlier this week that Biden wants to "restore predictability and stability" in the two countries' relationship. Press Secretary Jen Psaki issued that statement on May 25 — the same day the hackers escalated their attack, according to Microsoft.

Russian presidential press secretary Dmitry Peskov denied his country is involved, saying Microsoft was making an "unfounded accusation," according to the 

Here's what we know about the new hacking campaign:

The new cyber campaign was orchestrated by a group 

, though it may be better known as Cozy Bear or APT29. The group is thought to be run out of the Russian intelligence service, or SVR. 

The tech company says recipients were sent emails that looked to be from USAID — but which contained links that could install malicious code, giving hackers wide-ranging access.

The messages were sent from USAID's account with Constant Contact, a large email marketing and branding company. Microsoft says emails containing malicious URLs were sent to roughly 3,000 accounts at more than 150 organizations.

"Nobelium, originating from Russia, is the same actor behind the attacks on SolarWinds customers in 2020," 

. "These attacks appear to be a continuation of multiple efforts by Nobelium to target government agencies involved in foreign policy as part of intelligence gathering efforts."

exploiting government agencies' relationship 

with a private company. The U.S. hit Russia with sanctions over SolarWinds last month, 

 of an attack that breached elements of the U.S. Homeland Security and Treasury departments.

USAID carries out missions worldwide that range from promoting democracy and human rights to backing economic development and helping populations in crisis.

Acknowledging the attack in a statement sent to NPR, USAID Acting Spokesperson Pooja Jhunjhunwala confirmed that the hack originated in a compromised email marketing account.

"The forensic investigation into this security incident is ongoing," she said. USAID is now working with the Cybersecurity and Infrastructure Security Agency, along with DHS (CISA's parent agency) and other agencies, Jhunjhunwala added.

Constant Contact, a Massachusetts company that has more than 600,000 customers worldwide, says the attack is an isolated incident.

"We are aware that the account credentials of one of our customers were compromised and used by a malicious actor to access the customer's Constant Contact accounts," a company spokesperson tells NPR. The company says it has temporarily disabled the affected accounts, adding that it's "working with our customer, who is working with law enforcement."

Note: Both Microsoft and Constant Contact are financial supporters of NPR.

The initial phases of the attack began in January, Microsoft says. After a period of probing and experimentation, the company says, the hackers used a spear-phishing campaign to launch a large-scale attack on May 25.

Like many similar hacks, the campaign includes several essential elements.

Using Constant Contact's emailing tools, the hackers send legitimate-looking messages from spoofed email addresses that include a link. People who click that link are sent to a legitimate related service — but they're also redirected to malicious infrastructure controlled by Nobelium, Microsoft says.

A payload of malware is delivered to target computers, is installed, and then executes, giving the hackers access.

 Upon being engrained in users' computers, the malware activates a beacon that sends attackers a notice to alert them to a successful intrusion. The hackers can then extract data and deliver additional malware.

The high-volume email campaign prompted automatic systems to block many of the emails and mark them as spam, Microsoft says. But the company adds that the earliest emails that were sent might have been successfully delivered.

The full scope of the attack — the compromised systems, and affected accounts — is not yet known.

The Biden administration has not yet laid blame for the attack. The White House National Security Council says it's monitoring the incident, an NSC spokesperson said Friday.

So far, the impact of the new phishing incident seemed to be limited, the NSC spokesperson said, noting that Microsoft had said that many of the phishing emails sent through the service used by USAID had likely been blocked by automated systems.

The spokesperson spoke on condition of anonymity about the incident, noting that the U.S. intelligence community has not said who they believe is responsible.

The White House had no immediate comment on Friday on whether the new hack might affect plans for the upcoming summit between Biden and Putin.

The Biden administration says it's pushing forward on a plan to improve federal agencies' security in computer networks and software — part of an executive order issued after the SolarWinds hack.


In a statement on the latest attack, Sen. Mark R. Warner, D-Va., chairman of the Senate Select Committee on Intelligence, said, "We have to step up our cyber defenses, and we must make clear to Russia – and any other adversaries – that they will face consequences for this and any other malicious cyber activity."


Politics and Government News

Bill Chappell

Author

Dina Temple-Raston

Scott Detrow

News of the attack, which targets emails made to look like they came from USAID, comes less than three weeks before President Joe Biden is slated to hold a summit with President Vladimir Putin.

What we know about the apparent Russian hack exploiting a U.S. Aid agency

Go Deeper.

Like this?

News you can use in your inbox