San Francisco, July 15 (SocialNews.XYZ) Microsoft has revealed that the massive SolarWinds cyber attack was operated by a group of hackers from China.
Microsoft Threat Intelligence Centre (MSTIC) team detected a zero-day remote code execution exploit, being used to attack SolarWinds Serv-U FTP software in limited and targeted attacks.
"MSTIC attributes this campaign with high confidence to DEV-0322, a group operating out of China, based on observed victimology, tactics, and procedures," the company said in an update on Wednesday.
To carry out the attack, hackers installed a malware in the Orion software sold by the IT management company SolarWinds. Reports suggested that the hackers compromised at least 250 federal agencies and top enterprises in the US.
The zero-day attack was first spotted in a routine Microsoft 365 Defender scan.
"The vulnerability being exploited is CVE-2021-35211, which was recently patched by SolarWinds. We strongly urge all customers to update their instances of Serv-U to the latest available version," Microsoft advised.
According to Microsoft, the hackers compromised 'SolarWinds' software allowing them to "impersonate any of the organisation's existing users and accounts, including highly privileged accounts."
The company said it had discovered its systems were infiltrated "beyond just the presence of malicious 'SolarWinds' code."
It may take several months for the US government to complete the investigation into the SolarWinds hack.
Alarmed at repeated cyber-attacks on the country especially after at a key fuel pipeline, US President Joe Biden has signed an executive order, implementing new policies to improve national cybersecurity.
Source: IANS
About Gopi
Gopi Adusumilli is a Programmer. He is the editor of SocialNews.XYZ and President of AGK Fire Inc.
He enjoys designing websites, developing mobile applications and publishing news articles on current events from various authenticated news sources.
When it comes to writing he likes to write about current world politics and Indian Movies. His future plans include developing SocialNews.XYZ into a News website that has no bias or judgment towards any.
He can be reached at gopi@socialnews.xyz