[News](/news) Nobelium targets Microsoft customers [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Nobelium targets Microsoft customers ##### [Edward Kost](/team/edward-kost) June 28, 2021 Nobelium, the Russian hacking group believed to be responsible for the Solarwinds supply chain attack, has launched new attacks targeting Microsoft customers. In [an official statement](https://msrc-blog.microsoft.com/2021/06/25/new-nobelium-activity/) about the discovered activity, Microsoft said that the attackers were primarily focused on the IT and Government sectors. “This activity was targeted at specific customers, primarily IT companies (57%), followed by government (20%), and smaller percentages for non-governmental organizations and think tanks, as well as financial services.  The activity was largely focused on US interests, about 45%, followed by 10% in the UK.” Microsoft said in its statement. Microsoft assures that most of the attack attempts were unsuccessful. “This recent activity was mostly unsuccessful, and the majority of targets were not successfully compromised – we are aware of three compromised entities to date. All customers that were compromised or targeted are being contacted through our nation-state notification process.” The threat actors attempted to breach privileged accounts in two ways. The first was through a combination of password spraying and brute force attacks. [Brute force attacks](https://www.upguard.com/blog/brute-force-attack) infiltrate login portals with a barrage of different username and password combinations. Though this penetration method is simple and rather messy, it has a high success rate, accounting for 80% of cyber attacks on web applications. The other penetration tactic used was password spraying. This method is slightly more methodical, it involves the same password being used across different accounts simultaneously to minimize suspicious login attempts. In addition to the above, Nobelium (also known as APT29, Cozy Bear, and The Dukes) injected an information stealing trojan on a Microsoft Support agent’s computer to automate and scale the exfiltration of account details.  According to Microsoft, only ‘basic information’ was accessed and used in targeted [phishing attacks](https://www.upguard.com/blog/phishing). Though Nobelium’s breach attempts were thwarted in this instance, future attacks may prove more ruinous, especially if they mirror the complexity of the [Solarwinds disaster](https://www.upguard.com/news/u-s-government-data-breach). To best defend your [sensitive data](https://www.upguard.com/blog/sensitive-data) against such cyber attacks, the following control strategies should be implemented: * Multi-Factor Authentication * [Zero-Trust Architecture](https://www.upguard.com/blog/prevent-supply-chain-attacks-with-zero-trust-architecture) * [Secure Privileged Access Management](https://www.upguard.com/blog/prevent-supply-chain-attacks-by-securing-pam) ‍ *Are you at risk of a data breach? *[***Click here***](https://www.upguard.com/instant-security-score)* to get your free security score now!* ## How secure is Microsoft? Microsoft develops and licenses software products, devices, and services. The company's core offerings include the Windows operating system, Office productivity suite, Azure cloud computing platform, and Xbox gaming consoles. * View our free preliminary report on Microsoft’s security posture * 13 risk factors, including email security, SSL, DNS health, open ports and common vulnerabilities [View Microsoft's score](/security-report/microsoft) [View score](/security-report/microsoft) [https://www.microsoft.com](/security-report/microsoft) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ## Latest news Stay up-to-date with the latest news in cybersecurity. [](/news/hugging-face-data-breach-2026-07-20) #### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 20, 2026 [](/news/ey-data-breach-2026-07-19) #### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) #### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/park-west-psychology-data-breach-2026-07-16) #### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) #### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [](#) July 14, 2026 [](/news/npcil-data-breach-2026-07-16) #### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 14, 2026 [View all news](/news) ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)