What Microsoft Officials Know About Russia's Phishing Hack Targeting USAID

https://www.npr.org/2021/05/28/ [login to see] /russian-hackers-launched-a-new-supply-chain-hack-this-time-they-phished
Microsoft officials say hackers linked to the Russian intelligence service, SVR, appear to have launched another supply chain attack — this time on a company that allowed the intruders to slip into the computer networks of a roster of human rights groups and think tanks.

Microsoft said it discovered the breach this week and believes it began with hackers breaking into an email marketing company called Constant Contact, which provides services to, among others, the United States Agency for International Development.

Once they had broken in, the hackers sent out emails that looked like they came from USAID. Those emails contained links, and when the recipients clicked on them, quietly loaded malware into their systems, allowing the hackers full access. They could read emails, steal information and even plant additional malware for use later.

Tom Burt, vice president of customer security and trust at Microsoft, told NPR in an interview that the hackers appeared to be learning as they went along, customizing their malware packages depending on the target. "Even before the malware gets installed," he said, "they're doing some things to help them understand the environment that they are going to try to install the malware into, so they can pick the right malware package."