Loading story…
The UK National Cyber Security Centre, FBI, NSA, and CISA warned that Russia’s Foreign Intelligence Service (SVR), also tracked as APT29 and Nobelium, is running a broad cyber-espionage campaign that combines mass exploitation of known vulnerabilities with targeted intrusions against governments, diplomats, think tanks, technology firms, financial institutions, and cloud environments. Officials said the group scans the internet for unpatched systems and exploits long-known perimeter flaws including CVE-2019-19781, CVE-2019-11510, CVE-2018-13379, and CVE-2020-5902, then uses compromised accounts to move deeper into victim networks and, in some cases, into connected supply chains.
The campaign builds on tradecraft previously tied to the SolarWinds Orion compromise and later phishing and cloud-focused operations attributed to the SVR. U.S. and allied advisories said the service has shifted toward stealthier methods such as password spraying, abuse of mailbox and cloud permissions, temporary email infrastructure, and reduced reliance on custom malware, though earlier operations also used tools such as SUNBURST, TEARDROP, Cobalt Strike Beacon, and WELLMESS. Microsoft separately reported that Nobelium targeted thousands of accounts across hundreds of organizations in a focused espionage effort, while defenders were urged to prioritize patching internet-facing systems, enforce multi-factor authentication, audit identity and mailbox permissions, and investigate signs of lateral movement and account abuse.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
The UK NCSC, together with the FBI and NSA, warned that Russia's SVR was conducting a continued global campaign exploiting established vulnerabilities at scale. The advisory said the actors targeted governments, diplomatic entities, think tanks, technology firms, and financial institutions, while also scanning broadly for opportunistic victims with unpatched internet-facing systems.
CISA, ACSC, NCSC, and the FBI issued a joint advisory identifying the top routinely exploited vulnerabilities in 2020 and widely exploited flaws in 2021. The guidance emphasized that nation-state and criminal actors continued to rely on older, publicly known vulnerabilities in internet-facing systems such as VPNs, Exchange, Citrix, Fortinet, F5, and MobileIron.
Microsoft reported that Nobelium, which it linked to Russia's SVR, targeted thousands of accounts across hundreds of government and human rights organizations in a phishing campaign. Microsoft said it had notified affected customers and had not seen evidence of a significant number of successful compromises at that time.
The UK NCSC, together with CISA, the FBI, and the NSA, published a joint advisory detailing additional tactics, techniques, and procedures associated with SVR cyber actors. The notice followed public attribution of the 2020 SolarWinds compromise to the SVR and included mitigation guidance, detection rules, and reporting instructions for suspected compromises.
The FBI, DHS, and CISA published a joint report on Russian Foreign Intelligence Service cyber operations, describing targets, tactics, and defensive guidance. The report documented SolarWinds-enabled intrusions, password spraying, exploitation of CVE-2019-19781, and the use of false identities, cryptocurrencies, temporary email, and VoIP services.
The White House released a statement attributing the SolarWinds compromise to Russia's Foreign Intelligence Service. U.S. government reporting later cited this attribution as a key reference point in describing SVR tradecraft and ongoing risk.
A state-sponsored actor began a supply-chain campaign in March 2020 by embedding backdoor code into SolarWinds Orion software and distributing it through the product's update mechanism. The operation created remote access opportunities across potentially thousands of public and private organizations.
In 2020, the governments of the United Kingdom, Canada, and the United States attributed WELLMESS malware intrusions to APT29. The activity focused on organizations involved in COVID-19 vaccine development and followed exploitation of unpatched public vulnerabilities.
During the spring and summer of 2020, SVR operators used modified SolarWinds network monitoring software as an initial intrusion vector to expand access to numerous victim networks. After entry, they moved laterally to reach email accounts, including those of IT staff, to support espionage and evade defenders.
The FBI observed that beginning in 2018, SVR actors moved away from malware-heavy intrusions on victim networks and increasingly targeted cloud resources, especially email accounts. This shift included low-and-slow password spraying, abuse of MFA exemptions, and mailbox permission changes.
SolarWinds announced that its Orion Platform had been modified by a state-sponsored threat actor, revealing the supply-chain compromise tied to the broader FireEye breach investigation. Analysis identified the trojanized Orion component as SUNBURST and documented follow-on tooling such as TEARDROP and Cobalt Strike Beacon.
In a separate incident described by U.S. agencies, SVR actors exploited CVE-2019-19781 against a VPN appliance to gain network access, steal credentials, and re-enter the environment until the vulnerable appliance was removed. The case illustrated the group's use of known perimeter-device flaws for persistent access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
ncsc.gov.uk
Open sourceus-cert.cisa.gov
Open sourceblogs.microsoft.com
Open sourcencsc.gov.uk
Open sourcevice.com
Open sourceus-cert.cisa.gov
Open sourcepicussecurity.com
Open sourcemedia.defense.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The United States, United Kingdom, and Poland publicly attributed the **SolarWinds Orion** supply-chain compromise to Russia’s **SVR** intelligence service, describing it as part of a broader campaign of malicious cyber activity. The White House announced measures to impose costs on the Russian government, while the UK said a low single-digit number of its public-sector organizations were targeted and Poland warned that the fallout extended beyond the United States into Europe, aligning its response with **NATO** and **EU** statements. The campaign stemmed from trojanized Orion updates distributed in 2020 that deployed the **Sunburst** backdoor to fewer than 18,000 customers, with a smaller subset selected for follow-on exploitation. Subsequent disclosures showed the intrusion reached deep into U.S. government and enterprise cloud environments. The U.S. Department of Justice said attackers accessed Microsoft 365 email accounts at **27 U.S. Attorneys’ offices**, including severe exposure in multiple New York districts, while reports also identified breaches at **NASA** and the **FAA**. Technical analysis found the operators abused **Azure AD**, OAuth application permissions, and **Microsoft Graph API** access to impersonate trusted applications, escalate privileges, and exfiltrate email and tenant data. Industrial organizations were also exposed: Kaspersky estimated that **32.4%** of attributable domains tied to the malware belonged to industrial entities, with more than 20 such organizations found running backdoored Orion software across several countries.
Aug 15, 2026
SolarWinds disclosed that the **SUNBURST** compromise of its Orion platform led to actual follow-on intrusions at fewer than 100 customers, despite roughly 18,000 organizations downloading tainted updates. Investigators said the attackers, widely attributed by the U.S. government to Russia’s **SVR** and tracked as **NOBELIUM/UNC2452/Dark Halo**, inserted a backdoor into signed Orion updates and used delayed activation, DNS-based victim profiling, and selective second-stage deployment to focus on high-value targets. Victims included U.S. government agencies and private-sector organizations, while related activity also reached Mimecast, where the same actor accessed encrypted customer service account credentials and compromised certain authentication certificates affecting a small number of Microsoft 365 tenants. Incident response findings showed the campaign extended well beyond the initial Orion malware, with attackers stealing email, moving laterally through on-premises networks, bypassing MFA in some cases, forging SAML tokens, and abusing Azure AD and Microsoft 365 to access cloud resources. Research from Volexity, Symantec, Microsoft, and others detailed command-and-control through `avsvmcloud[.]com`, HTTP-based second-stage operations, mailbox theft, and stealthy use of legitimate identity infrastructure. In response, **CISA** issued an emergency directive, released the **CHIRP** detection tool, and published eviction guidance warning that full remediation may require rebuilding identity systems, rotating credentials, and isolating affected networks to remove long-term adversary access.
Aug 15, 2026
A joint government advisory says Russia’s GRU Unit 26165, also tracked as **APT28** or **Fancy Bear**, has run a sustained cyberespionage campaign against Western logistics providers, technology companies, and defense supply-chain organizations supporting aid flows to Ukraine. The activity has affected entities in the United States, Germany, Poland, France, and Ukraine, with intrusions aimed at transportation networks, IT services, and military-related logistics. Officials said the operators also sought visibility into aid movements by compromising internet-connected IP cameras positioned near border crossings, rail hubs, and military facilities. Authorities linked the campaign to long-running GRU tradecraft previously used against governments, militaries, defense contractors, and cloud and email environments including Microsoft Office 365 and on-premises Exchange. Reported access methods include password spraying, brute-force and credential-guessing attacks, spearphishing, exploitation of known vulnerabilities including `CVE-2020-0688` and `CVE-2020-17144`, and the use of malware such as **HEADLACE** and **MASEPIE**, alongside web shells, Tor, VPNs, and living-off-the-land techniques to persist and exfiltrate data. Agencies warned the espionage effort remains active and urged organizations to enforce MFA, patch exposed systems, tighten access controls, monitor for lateral movement, and review supply-chain risk.
Jun 29, 2026