Tech giant Microsoft had revealed that an attacker had won access to one of its customer-service agents and later used information from that to unleash hacking attempts against customers.
The company had found the compromise during its response to hacks by a team it identifies as responsible for earlier major breaches at SolarWinds and Microsoft. Microsoft said it had warned the affected customers.
“A sophisticated Nation-State associated actor that Microsoft identifies as NOBELLIUM accessed Microsoft customer support tools to review information regarding your Microsoft Services subscriptions,” the warning reads in part.
The US government has blamed the Russian government for the earlier attacks. Microsoft announced the breach publicly.
On a broader phishing campaign, the tech giant said that it had compromised a small number of entities, Microsoft said it had also found the breach of its own agent, who it said had limited powers.
The agent could see billing contact information and what services the customers pay for, among other things.
“The actor used this information in some cases to launch highly-targeted attacks as part of their broader campaign,” Microsoft said.
Microsoft warned customers to remain extra careful about communications to their billing contacts and consider changing those usernames and email addresses, as well as barring old usernames from logging in.
Microsoft said it was aware of three entities that had been compromised in the phishing campaign.
Microsoft did not say whether the agent was a contractor or a direct employee.
In the SolarWinds attack, the group altered code at that company to access SolarWinds customers, including nine US federal agencies.
At the SolarWinds customers and others, the attackers also took advantage of weaknesses in the way Microsoft programs were configured, according to the Department of Homeland Security.
Microsoft later said the group had compromised its own employee accounts and taken software instructions governing how Microsoft verifies user identities.