Microsoft recently completed its internal investigation of the SolarWinds attack. The investigation concluded that the people behind the attack did not gain access to customer data. The hackers did, however, manage to download a portion of the source code for Microsoft’s Azure, Intune, and Exchange services.
Microsoft states in a blog post:
We have now completed our internal investigation into the activity of the actor and want to share our findings, which confirm that we found no evidence of access to production services or customer data. The investigation also found no indications that our systems at Microsoft were used to attack others. Because of our defense-in-depth protections, the actor was also not able to gain access to privileged credentials or leverage the SAML techniques against our corporate domains.
Microsoft also details that the attacks were able to download part of the source code of three of its products:
- A small subset of Azure components (subsets of service, security, identity)
- A small subset of Intune components
- A small subset of Exchange components
The attackers were likely seeking to find secrets based on the search terms that they used. Microsoft explains that it does not keep secrets in its code and that it uses automated tools to verify compliance with its rules related to this.
Microsoft President Brad Smith recently said that the SolarWinds attack was probably the “largest and most sophisticated attack the world has ever seen.” The attacks targeted government agencies, NVIDIA, Intel, Cisco, Belkin, and other organizations.
The US government believes that Russia was behind the attack, though that’s not confirmed at this point.
We may earn a commission for purchases using our links. Learn more.