Microsoft update on brute force and password spraying activity

On Friday 25th June Microsoft revealed that it had identified new activity from an Advanced Persistent Threat (APT) known as NOBELIUM targeting organisations globally.

The Microsoft Threat Intelligence Center says that this activity was mostly unsuccessful.

The NCSC has observed an increase in activity as part of malicious email and password spraying campaigns against a limited number of UK organisations. We are supporting those affected and would urge all organisations to familiarise themselves with our guidance on mitigating phishing attacks, including how to block phishing emails and how to implement two-factor/multi-factor authentication:

• Phishing attacks: defending your organisation
• Multi-factor authentication for online services
• Identity and access management (part of the 10 steps to cyber security collection)
• Home working: preparing your organisation and staff

The following blog posts from Microsoft provide further details, including IoCs, detection and mitigation advice:

• New Nobelium activity – Microsoft Security Response Center
• Investigating and Mitigating Malicious Drivers – Microsoft Security Response Center
• Nobelium Resource Center – updated March 4, 2021 – Microsoft Security Response Center