Push Admin

Suspected Russian hackers used Microsoft vendors to breach customers

Article (news)

Joseph Menn and Raphael Satter, Reuters

<div class="embed-wrap"><figure data-feedback="fb:likes,fb:comments"><img src="https://sa.kapamilya.com/absnews/abscbnnews/media/2020/reuters/12/14/hack.jpg"/></figure></div>WASHINGTON - The suspected Russian hackers behind the worst U.S. cyber attack in years leveraged reseller access to Microsoft Corp services to penetrate targets that had no compromised network software from SolarWinds Corp , investigators said.While updates to SolarWinds&#x27; Orion software was previously the only known point of entry, security company CrowdStrike Holdings Inc said Thursday hackers had won access to the vendor that sold it Office licenses and used that to try to read CrowdStrike&#x27;s email. It did not specifically identify the hackers as being the ones that compromised SolarWinds, but two people familiar with CrowdStrike&#x27;s investigation said they were.<ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/overseas/12/19/20/nato-checking-systems-after-us-cyberattack">NATO checking systems after US cyberattack</a></li>	<li><a href="https://news.abs-cbn.com/overseas/12/19/20/hackers-broad-attack-sets-cyber-experts-worldwide-scrambling-to-defend-networks">Hackers&#x27; broad attack sets cyber experts worldwide scrambling to defend networks</a></li></ul>CrowdStrike uses Office programs for word processing but not email. The failed attempt, made months ago, was pointed out to CrowdStrike by Microsoft on Dec. 15.CrowdStrike, which does not use SolarWinds, said it had found no impact from the intrusion attempt and declined to name the reseller.&quot;They got in through the reseller&#x27;s access and tried to enable mail &#x27;read&#x27; privileges,&quot; one of the people familiar with the investigation told Reuters. &quot;If it had been using Office 365 for email, it would have been game over.&quot;Many Microsoft software licenses are sold through third parties, and those companies can have near-constant access to clients&#x27; systems as the customers add products or employees.Microsoft said Thursday that those customers need to be vigilant.&quot;Our investigation of recent attacks has found incidents involving abuse of credentials to gain access, which can come in several forms,&quot; said Microsoft senior Director Jeff Jones. &quot;We have not identified any vulnerabilities or compromise of Microsoft product or cloud services.&quot;The use of a Microsoft reseller to try to break into a top digital defense company raises new questions about how many avenues the hackers, whom U.S. officials have alleged are operating on behalf of the Russian government, have at their disposal.The known victims so far include CrowdStrike security rival FireEye Inc and the U.S. Departments of Defense, State, Commerce, Treasury, and Homeland Security. Other big companies, including Microsoft and Cisco Systems Inc, said they found tainted SolarWinds software internally but had not found signs that the hackers used it to range widely on their networks.Until now, Texas-based SolarWinds was the only publicly confirmed channel for the initial break-ins, although officials have been warning for days that the hackers had other ways in.Reuters <a href="https://www.reuters.com/article/idUSKBN28R2ZJ" target="_blank">reported</a> a week ago that Microsoft products were used in attacks. But federal officials said they had not seen it as an initial vector, and the software giant said its systems were not utilized in the campaign.Microsoft then hinted that its customers should still be wary. At the end of a long, technical blog post on Tuesday, it used one sentence to mention seeing hackers reach Microsoft 365 Cloud &quot;from trusted vendor accounts where the attacker had compromised the vendor environment.&quot;Microsoft requires its vendors to have access to client systems in order to install products and allow new users. But discovering which vendors still have access rights at any given time is so hard that CrowdStrike developed and released an auditing tool to do that.After a series of other breaches through cloud providers, including a major set of attacks attributed to Chinese government-backed hackers and known as CloudHopper, Microsoft this year imposed new controls on its resellers, including requirements for multifactor authentication.The Cybersecurity and Infrastructure Security Agency and the National Security Agency had no immediate comment.Also Thursday, SolarWinds released an update to fix the vulnerabilities in its flagship network management software Orion following the discovery of a second set of hackers that had targeted the company&#x27;s products.That followed a separate Microsoft blog post on Friday saying that SolarWinds had its software targeted by a second and unrelated group of hackers in addition to those linked to Russia.The identity of the second set of hackers, or the degree to which they may have successfully broken in anywhere, remains unclear.Russia has denied having any role in the hacking. (Reporting by Joseph Menn and Raphael Satter. Additonal reporting by Munsif Vengattil Editing by Chizu Nomiyama, Alistair Bell and Richard Chang)<figure class="op-interactive"><iframe src="https://www.youtube.com/embed/0Kth6jjkVPs?enablejsapi=1"></iframe></figure><div class="iwantbar">Watch more in <a href="//www.iwantv.com.ph/">iWantv</a> or <a href="//tfc.tv/">TFC.tv</a></div>

WASHINGTON - The suspected Russian hackers behind the worst U.S. cyber attack in years leveraged reseller access to Microsoft Corp services to penetrate targets that had no compromised network software from SolarWinds Corp , investigators said.

WASHINGTON - The suspected Russian hackers behind the worst U.S. cyber attack in years leveraged reseller access to Microsoft Corp services to penetrate targets that had no compromised network software from SolarWinds Corp , investigators said.

Suspected Russian hackers used Microsoft vendors to breach customers

News

Entertainment

Lifestyle

Sports

Metro.Style

More

Traffic

Manila

Horoscope

Business

Suspected Russian hackers used Microsoft vendors to breach customers

Joseph Menn and Raphael Satter,

Reuters

Published Dec 25, 2020 10:43 AM PHT

Read More:

microsoft

russia

russian hacking

cybercrime

solarwinds

crowdstrike

ms office

ANC

ABS-CBN is the leading media and entertainment company in the Philippines, offering quality content across TV, radio, digital, and film. Committed to public service and promoting Filipino values, ABS-CBN continues to inspire and connect audiences worldwide.

Corporate

Investors

Governance

International Distribution

Corporate

Governance

Investors

International Distribution

NPC Seal of Registration

Privacy Policy

AI Policy

Terms of Service

Advertise with Us

© 2026 ABS-CBN Corporation. All Rights Reserved.

NPC Seal of Registration

Privacy Policy

Terms of Service

AI Policy

Advertise with Us

© 2026 ABS-CBN Corporation. All Rights Reserved.

NPC Seal of Registration

Privacy Policy

Terms of Service

AI Policy

Advertise with Us

© 2026 ABS-CBN Corporation. All Rights Reserved.