Microsoft said Thursday that the far-reaching Russian cyberattack on U.S. government agencies and private enterprises went further into its network than the company had previously announced.
While the hackers, who allegedly work for the Russian SVR information agency, apparently did not use Microsoft’s systems to attack other victims, they were able to view some Microsoft source code by hacking into an employee account, the company said. .
Microsoft said earlier that it was not involved in the attack, which put dozens of federal agencies and corporations at risk. According to Microsoft, the subsequent investigation revealed that the hackers did not have access to email or products and services, and that they could not edit the source code they were viewing.
The Russian attack, which is possibly underway, apparently started as early as October 2019. When hackers first hacked a Texas company called SolarWinds that provides network monitoring services to government agencies and 425 of the Fortune 500 businesses. The departments of trade, treasury, state and energy were all violated in the attack, as well as FireEye, a top cyber security firm that unveiled the violation for the first time this month.
Investigators are still trying to understand what hackers stole, but investigations by FireEye, Microsoft, Amazon and other companies have revealed that the attack could be much larger than originally believed. In the past week, CrowdStrike, a competitor of FireEye, announced that these attackers also targeted unsuccessfully. In that case, the hackers used Microsoft resellers, companies that sell software on behalf of Microsoft, to try to gain access to systems.
The Department of Homeland Security confirmed that SolarWinds was one of several ways the Russians used to attack US agencies, technology and cyber security companies.
Elected President Joseph R. Biden Jr. has accused President Trump of disrespecting the hack. Mr. Trump called the attack a “fraud” in private. In public, he suggested that China, not Russia, may have been the culprit – a finding disputed by Foreign Minister Mike Pompeo.
This is an evolving story and will be updated.