9 ms·

"The targeted activity has been observed against organizations based in the United States and across Europe since May 2021. NOBELIUM is the same actor behind th

"The targeted activity has been observed against organizations based in the United States and across Europe since May 2021. NOBELIUM is the same actor behind the SolarWinds compromise in 2020, and this latest activity shares the hallmarks of the actor’s compromise-one-to-compromise-many approach." Just tell us which country.. It's probably one of two options.

schleck8 5y ago
Russia, Mitre profile is here: https://attack.mitre.org/groups/G0016/ https://attack.mitre.org/groups/G0016/
rvnx 5y ago
Russia according to the previous deductions of the US government about this group
- chrisseaton 5y ago
  Russia isn't a nation-state though.
  - deleted 5y ago
    [deleted]
  - cronix 5y ago
    Pedantic arguments don't change the substance.
  - ssklash 5y ago
    What do you mean by this? Is it because they didn't explicitly say "The Russian Federation"? Because we both know that's exactly what they meant, and that it is most certainly a nation-state.
    - chrisseaton 5y ago
      A nation-state is a state that perfectly aligns with a nationality. Hence nation-state. A nation that is also a state. The Russian Federation is a state with many nationalities within its borders. So it isn't a nation-state. Other classic examples of non-nation-states are the UK and the US. https://www.quora.com/Is-Russia-a-nation-state https://www.quora.com/Is-Russia-a-nation-state
      - ssklash 5y ago
        I think you misunderstand the use of nation-state in the context of threat actors then. It simply means government backed, as opposed to a private entity like a ransomware gang or NSO Group. Splitting hairs about nationalities is irrelevant when talking about who is behind a cyberattack.
        KoftaBob 5y ago
        > It simply means government backed, as opposed to a private entity like a ransomware gang or NSO Group. I would be incredibly surprised if Israel's intelligence didn't make use of NSO tech, especially since their founders came right out of Unit 8200, their military intelligence cyber warfare division.
        deleted 5y ago
        [deleted]
        chrisseaton 5y ago
        If you don't mean 'nation-state' then why use that very specific technical word instead of just saying 'country'? It's like saying 'I saw a 2019 Ford Focus in blue' and then when someone points out it was actually a green Dodge saying 'well I just meant any car why are you splitting hairs'.
        ssklash 5y ago
        In cybersecurity, and in the attribution of cyberattacks especially, nation-state actor is a very specific technical word. Words mean different things in different fields, and in this case the word is very clear and obvious in conveying what is intended, which is a government backed threat actor.
  - hdjjhhvvhga 5y ago
    In the context of cybersecurity this term has a specific meaning and refers to an adversary that has the highest level of resources usually attributed to a state.
devit 5y ago
The first link has this text: "Today, we’re sharing the latest activity we’ve observed from the Russian nation-state actor Nobelium. This is the same actor behind the cyberattacks targeting SolarWinds customers in 2020 and which the U.S. government and others have identified as being part of Russia’s foreign intelligence service known as the SVR."
decebalus1 5y ago
AFAIK the SolarWinds attack was found to be linked to the Russian government.
- emkoemko 5y ago
  was it? what if China is using the CIA "Marble" program as well? or even the US could be doing it. I don't doubt Russia is doing cyber warfare but how can anyone without seeing the hacker doing his thing really know for sure what state it came from?
  - decebalus1 5y ago
    > how can anyone without seeing the hacker doing his thing really know for sure what state it came from? IDK, maybe using the same type of reasoning which helps convict criminals in cases where there are no witnesses.
Keyframe 5y ago
They did a few days ago: https://blogs.microsoft.com/on-the-issues/2021/10/24/new-activity-from-russian-actor-nobelium/ https://blogs.microsoft.com/on-the-issues/2021/10/24/new-act...
- criddell 5y ago
  Russia. Saved you a click.
  - emkoemko 5y ago
    more likely its NSA/CIA... i mean how can anyone even know, look at NSA/CIA program "Marble" its designed to do this make their hacks look like Russians are doing it etc.
  - skjhhhhhhhnnn 5y ago
    >which the U.S. government and others have identified as being part of Russia Microsoft is not making their own determination of who the state actor is and is just letting the three letter agencies' finger pointing fly with no evidence. There is however significant evidence indicating a country other than Russia in the FBI's Solarwinds report that contradicts the headlines if you read the body of the report.
    - Ansil849 5y ago
      > There is however significant evidence indicating a country other than Russia Such as?
      - emkoemko 5y ago
        CIA? look at Vault 7 "Marble" program.... and you really think hackers don't do what the CIA does? could be anyone basically... China etc etc and are probably doing the same crap as the CIA with their "Marble" program attributing the hacks to another state.
        5y ago
capableweb 5y ago
I'd say there are more countries in the running for this than two. Possible options: China, US, Russia, Israel, North Korea and more
emkoemko 5y ago
probably CIA/NSA didn't we learn about this already how they do this type of stuff and leave fake evidence that it is some other nation doing it? its their "Marble" program, that was leaked in Vault 7 "Marble is used to hamper forensic investigators and anti-virus companies from attributing viruses, trojans and hacking attacks to the CIA," so how can anyone really say who did what when it comes to cyber crimes? unless you have a camera watching the person doing it?
- colechristensen 5y ago
  One would expect every intelligence group and sophisticated criminal to attempt to misdirect in exactly this way.
  - emkoemko 5y ago
    whats the misdirect? is it not true a state would not try to obfuscate the who is doing the attack? so Microsoft telling us its "X" without direct physical evidence is bs to me. Even the NSA intercepts network equipment orders and installs backdoor before sending them back to being delivered... now your hack is coming from "X" but it was done from "Y" using that hacked router etc, you get the picture? how can you know who did what?
  - raxxorrax 5y ago
    Yes, but that is almost as true for foreign groups as domestic ones.
- TheRealDunkirk 5y ago
  I would also expect Russian/Chinese hackers to get someone to come into such a discussion such as this, and deflect comments against them towards the CIA/NSA, as you have done 4 times already in this small thread. Who can believe anything any more, in the post-modern over-information age?
  - emkoemko 5y ago
    yea i could be, that's the point. I don't trust any government or "corporate" source on this type of stuff unless they show me physical evidence. I ain't defending those countries if that's what your suggesting, i am very anti CCP and Putin but i don't just attribute stuff to them because some "expert" says they did a hack.. based on what? something that could easily be made to look like any state did it like what the dump from the CIA shows... i use CIA because that's the only public state information we have about this type of program.

schleck8 5y ago

Russia, Mitre profile is here: https://attack.mitre.org/groups/G0016/ https://attack.mitre.org/groups/G0016/

rvnx 5y ago

Russia according to the previous deductions of the US government about this group

chrisseaton 5y ago
Russia isn't a nation-state though.
- deleted 5y ago
  [deleted]
- cronix 5y ago
  Pedantic arguments don't change the substance.
- ssklash 5y ago
  What do you mean by this? Is it because they didn't explicitly say "The Russian Federation"? Because we both know that's exactly what they meant, and that it is most certainly a nation-state.
  - chrisseaton 5y ago
    A nation-state is a state that perfectly aligns with a nationality. Hence nation-state. A nation that is also a state. The Russian Federation is a state with many nationalities within its borders. So it isn't a nation-state. Other classic examples of non-nation-states are the UK and the US. https://www.quora.com/Is-Russia-a-nation-state https://www.quora.com/Is-Russia-a-nation-state
    - ssklash 5y ago
      I think you misunderstand the use of nation-state in the context of threat actors then. It simply means government backed, as opposed to a private entity like a ransomware gang or NSO Group. Splitting hairs about nationalities is irrelevant when talking about who is behind a cyberattack.
      - KoftaBob 5y ago
        > It simply means government backed, as opposed to a private entity like a ransomware gang or NSO Group. I would be incredibly surprised if Israel's intelligence didn't make use of NSO tech, especially since their founders came right out of Unit 8200, their military intelligence cyber warfare division.
        deleted 5y ago
        [deleted]
      - chrisseaton 5y ago
        If you don't mean 'nation-state' then why use that very specific technical word instead of just saying 'country'? It's like saying 'I saw a 2019 Ford Focus in blue' and then when someone points out it was actually a green Dodge saying 'well I just meant any car why are you splitting hairs'.
        ssklash 5y ago
        In cybersecurity, and in the attribution of cyberattacks especially, nation-state actor is a very specific technical word. Words mean different things in different fields, and in this case the word is very clear and obvious in conveying what is intended, which is a government backed threat actor.
- hdjjhhvvhga 5y ago
  In the context of cybersecurity this term has a specific meaning and refers to an adversary that has the highest level of resources usually attributed to a state.

devit 5y ago

The first link has this text: "Today, we’re sharing the latest activity we’ve observed from the Russian nation-state actor Nobelium. This is the same actor behind the cyberattacks targeting SolarWinds customers in 2020 and which the U.S. government and others have identified as being part of Russia’s foreign intelligence service known as the SVR."

decebalus1 5y ago

AFAIK the SolarWinds attack was found to be linked to the Russian government.

emkoemko 5y ago
was it? what if China is using the CIA "Marble" program as well? or even the US could be doing it. I don't doubt Russia is doing cyber warfare but how can anyone without seeing the hacker doing his thing really know for sure what state it came from?
- decebalus1 5y ago
  > how can anyone without seeing the hacker doing his thing really know for sure what state it came from? IDK, maybe using the same type of reasoning which helps convict criminals in cases where there are no witnesses.

Keyframe 5y ago

They did a few days ago: https://blogs.microsoft.com/on-the-issues/2021/10/24/new-activity-from-russian-actor-nobelium/ https://blogs.microsoft.com/on-the-issues/2021/10/24/new-act...

criddell 5y ago
Russia. Saved you a click.
- emkoemko 5y ago
  more likely its NSA/CIA... i mean how can anyone even know, look at NSA/CIA program "Marble" its designed to do this make their hacks look like Russians are doing it etc.
- skjhhhhhhhnnn 5y ago
  >which the U.S. government and others have identified as being part of Russia Microsoft is not making their own determination of who the state actor is and is just letting the three letter agencies' finger pointing fly with no evidence. There is however significant evidence indicating a country other than Russia in the FBI's Solarwinds report that contradicts the headlines if you read the body of the report.
  - Ansil849 5y ago
    > There is however significant evidence indicating a country other than Russia Such as?
    - emkoemko 5y ago
      CIA? look at Vault 7 "Marble" program.... and you really think hackers don't do what the CIA does? could be anyone basically... China etc etc and are probably doing the same crap as the CIA with their "Marble" program attributing the hacks to another state.
      - 5y ago

capableweb 5y ago

I'd say there are more countries in the running for this than two. Possible options: China, US, Russia, Israel, North Korea and more

emkoemko 5y ago

probably CIA/NSA didn't we learn about this already how they do this type of stuff and leave fake evidence that it is some other nation doing it? its their "Marble" program, that was leaked in Vault 7 "Marble is used to hamper forensic investigators and anti-virus companies from attributing viruses, trojans and hacking attacks to the CIA," so how can anyone really say who did what when it comes to cyber crimes? unless you have a camera watching the person doing it?

colechristensen 5y ago
One would expect every intelligence group and sophisticated criminal to attempt to misdirect in exactly this way.
- emkoemko 5y ago
  whats the misdirect? is it not true a state would not try to obfuscate the who is doing the attack? so Microsoft telling us its "X" without direct physical evidence is bs to me. Even the NSA intercepts network equipment orders and installs backdoor before sending them back to being delivered... now your hack is coming from "X" but it was done from "Y" using that hacked router etc, you get the picture? how can you know who did what?
- raxxorrax 5y ago
  Yes, but that is almost as true for foreign groups as domestic ones.
TheRealDunkirk 5y ago
I would also expect Russian/Chinese hackers to get someone to come into such a discussion such as this, and deflect comments against them towards the CIA/NSA, as you have done 4 times already in this small thread. Who can believe anything any more, in the post-modern over-information age?
- emkoemko 5y ago
  yea i could be, that's the point. I don't trust any government or "corporate" source on this type of stuff unless they show me physical evidence. I ain't defending those countries if that's what your suggesting, i am very anti CCP and Putin but i don't just attribute stuff to them because some "expert" says they did a hack.. based on what? something that could easily be made to look like any state did it like what the dump from the CIA shows... i use CIA because that's the only public state information we have about this type of program.