NOBELIUM hackers' phishing attack

The Microsoft Threat Intelligence Center uncovered a malicious email campaign operated by NOBELIUM, the threat actor behind the SUNBURST backdoor, TEARDROP malware, GoldMax malware, and other related components. Initially observed in January 2021, this attack escalated on May 25, 2021 as NOBELIUM leveraged the legitimate mass-mailing service Constant Contact. The attackers masqueraded as a US-based development organization to distribute malicious URLs to various organizations.

Key takeaways

• An introduction to NOBELIUM.
• Mail delivery techniques used by the attackers.
• Indicators of compromise for this attack.
• Mitigation techniques to protect Microsoft 365.