What happened
Nobelium is the name Microsoft gave to the Russia-based group behind the 2020 SolarWinds attack. Microsoft now calls it Midnight Blizzard; others call it APT29. In early 2021 it gained access to an account that USAID, the US Agency for International Development, used on Constant Contact, a commercial mass-mailing service. Microsoft saw the first test emails from January. On 25 May 2021 the campaign grew sharply. Microsoft disclosed it on 27 May. The next day the US Cybersecurity and Infrastructure Security Agency and the FBI issued a joint alert.
Microsoft counted about 3,000 targeted accounts at more than 150 organisations in at least 24 countries, with the largest share in the United States. The CISA and FBI alert put it at over 7,000 accounts at 350 organisations. The two counts come from different vantage points, and both are on record.
The email
The messages came from a usaid.gov address and went out through Constant Contact, so they passed the checks that confirm a sender is who it claims to be. They were styled as a USAID Special Alert. NPR reported one lure that claimed Donald Trump had published new documents on election fraud.
The link was a Constant Contact tracking address. It redirected to usaid.theyardservice.com, a domain with no connection to USAID. That site delivered a disk-image file. Inside sat a shortcut, a decoy PDF and a hidden program that Microsoft named NativeZone, which installed Cobalt Strike, a tool attackers use to control a computer remotely. According to the joint alert, some waves served an iPhone exploit instead.
Why it worked
Every visible signal said the message was genuine. The sender was a real government agency. The address was real. The service was one that many organisations use for newsletters. The topic was current and political, which suits recipients in policy jobs. Link tracking by mailing services is normal, so a redirect did not look unusual. The disk-image file was chosen to slip past controls that inspect ordinary attachments and downloads.
What it cost
No loss figure has been published. The aim was intelligence collection, and the victims were not obliged to disclose what was taken. Constant Contact called it an isolated incident in which one customer's credentials were compromised, and temporarily disabled the affected accounts. USAID told NPR it was running a forensic investigation with CISA.
What would have helped
Sender checks alone could not help here, because the sender was real. What gave the message away was its destination: a domain that had nothing to do with the agency it named. Stronger sign-in protection on mailing-service accounts would have made the takeover harder. On the receiving side, blocking disk-image downloads for most staff removes a common way to deliver malware.
What a warning inside the message would have shown. Antilure's Details panel shows where a link really leads and flags a link that goes to a different domain than the sender's. Here the Special Alert came from usaid.gov and the link ended at usaid.theyardservice.com. That mismatch between sender and destination is the kind of fact the panel puts in plain view.
Sources
- New sophisticated email-based attack from NOBELIUM, Microsoft Threat Intelligence, 27 May 2021.
- What We Know About The Apparent Russian Hack Exploiting A U.S. Aid Agency, Bill Chappell, Dina Temple-Raston and Scott Detrow, NPR (via WUNC), 28 May 2021.
- CISA, FBI: 350 Organizations Targeted in Attack Abusing Email Marketing Service, Eduard Kovacs, SecurityWeek, 31 May 2021.