Microsoft s Threat Intelligence Center (MSTIC) says it has been tracking this Nobelium-operated campaign since January 2021 and it has evolved as the group experiments with new tactics. The phishing attack has so far targeted some 3,000 accounts at more than 150 organizations across several industry verticals. The victims span 24 countries, though most attacks aimed at the US.
Nobelium, a group connected to Russia, has historically targeted organizations, non-governmental organizations, think tanks, military, IT service providers, health technology and research, and telecommunications providers. In this case, Microsoft reports at least a quarter of targets work with international development, humanitarian, and human rights work.
Its newest campaign leverages Constant Contact, a legitimate mass-mailing service used for email marketing. Due to a high volume of emails distributed in this campaign, automated email threat detection marked many of the malicious emails as spam. However, s