{"id":25496,"date":"2021-10-25T22:33:08","date_gmt":"2021-10-25T21:33:08","guid":{"rendered":"https:\/\/www.n-able.com\/?p=25496"},"modified":"2021-10-26T13:26:28","modified_gmt":"2021-10-26T12:26:28","slug":"update-on-the-nobelium-apt-attack-group","status":"publish","type":"post","link":"https:\/\/www.n-able.com\/es\/blog\/update-on-the-nobelium-apt-attack-group","title":{"rendered":"Update on the Nobelium APT Attack Group"},"content":{"rendered":"

If you\u2019re like me, you started your week by reading the Microsoft blog about Nobelium, an advanced-persistent-threat (APT) group that was actively targeting cloud service providers (CSPs) and managed services provider (MSPs) in a recent wave of supply chain attacks. Personally, I wasn\u2019t terribly surprised. We all know by now that MSPs have a bullseye on them for adversaries wishing to target the supply chain. What\u2019s different about this attack is the motive.<\/p>\n

Without getting into the details of Nobelium\u2019s previous activities, what you must realize is that their attacks are extremely strategic\u2014and they play the long game. They\u2019re not trying to break in and cause immediate harm; they want to establish persistence in an environment and begin to learn what\u2014and more importantly whom\u2014they have access to. They\u2019ll then utilize this information to continue their attack towards their ultimate objective.<\/p>\n

Microsoft has provided a wealth of information about these attacks, for which I thank them. They have proactively contacted targeted entities in an attempt to quickly contain these attacks. As an MSP, you may think you\u2019re safe if you weren\u2019t in the 600+ organizations notified by Microsoft as being targets over the last few months. However, I would encourage you to use this information as an opportunity to review your policies and configurations, as well as those of your customers, to understand how much risk you have based upon those elements.<\/p>\n

For starters, I\u2019d suggest you review your M365 environment:<\/p>\n