List of global firms hit by SolarWinds hackers grows beyond Microsoft

Network management software made by SolarWinds, which has its European head offices based in Cork, was hijacked.

File image.

Suspected Russian hackers accessed the systems of a US internet provider and a county government in Arizona as part of a sprawling cyber-espionage campaign disclosed this week, according to an analysis of publicly-available web records.

The hack, which hijacked ubiquitous network management software made by SolarWinds to compromise a raft of US government agencies, is one of the biggest ever uncovered and has sent security teams around the world scrambling to contain the damage. 

SolarWinds has its European head offices based in Cork.  

The intrusions into networks at Cox Communications and the local government in Pima County, Arizona, show that alongside victims including the US departments of defence, state, and homeland security, the hackers also spied on less high-profile organisations. 

Pima County chief information officer Dan Hunt said his team had followed US government advice to immediately take SolarWinds software offline after the hack was discovered. He said investigators had not found any evidence of a further breach.

Reuters identified the victims by running a coding script released on Friday here by researchers at Moscow-based cybersecurity firm Kaspersky to decrypt online web records left behind by the attackers. 

The type of web record, known as a Cname, includes an encoded unique identifier for each victim and shows which of the thousands of “backdoors” available to them the hackers chose to open, said Kaspersky researcher Igor Kuznetsov.

SolarWinds, which disclosed its unwitting role at the centre of the global hack on Monday, has said that up to 18,000 users of its Orion software downloaded a compromised update containing malicious code planted by the attackers. As the fallout continued to roil Washington, with a breach confirmed at the US energy department, US officials warned that the hackers had used other attack methods, and urged organisations not to assume they were protected just because they did not use recent versions of the SolarWinds software.

Microsoft, which was one of the thousands of companies to receive the malicious update, said it had currently notified more than 40 customers whose networks were further infiltrated by the hackers. 

Around 30 of those customers were in the US, it said, with the remaining victims found in Canada, Mexico, Belgium, Spain, Britain, Israel, and the United Arab Emirates. 

Reuters