Late October 2021 brought the sequel nobody wanted to SolarWinds: Microsoft and Microsoft’s Threat Intelligence Center (MSTIC) disclosed that NOBELIUM — the Russia-state actor behind the 2020 SolarWinds supply-chain compromise — had resumed operations through a different front door: password spraying and token-replay against weak-credential accounts, harvesting access to cloud resellers and technology-service providers that sit between Microsoft and its government customers. The campaign’s signature moved from bespoke supply-chain implant to commodity-credential abuse — a deliberate downshift in sophistication that proved more durable: why implant a build pipeline when a password-sprayed administrative account at an indirect channel partner yields the keys to hundreds of downstream tenants? The disclosure named the emerging defensive doctrine for the cloud-management era: the vendor’s channel is the attack surface, delegated partner permissions are tier-zero, and “sophisticated” adversaries default to the cheapest credential that works.
The October 2021 NOBELIUM campaign (publicly detailed 25 October 2021 by Microsoft/MSTIC, with partner-facing written advisories to follow) targeted 609 named companies through cloud-solution-provider (CSP)/reseller intermediaries in the IT channel — password-spraying accounts and abusing delegated-administrator relationships plus token theft/replay to pivot from partner tenants into customer environments, with a reported ~22 of the 609 confirmed compromised at disclosure time. The techniques (in ATT&CK flavour): password spray against dormant/legacy-Auth accounts, OAuth token theft/replay (including via compromised hybrid token-signing paths in related activity), abuse of Microsoft’s own partner-ecosystem delegation model (GDAP-predecessor DAP relationships granting broad tenant-wide admin), and living-off-the-land cloud operations (consent-phishing, e-mail collection via Graph). Defences that blunted it — and remain the 2026 standard: phishing-resistant MFA (FIDO2) on all accounts including partner/service ones, conditional-access invariants (device compliance, IP/risk gating) that make replayed tokens worthless, elimination of legacy-Auth protocols, tighter DAP-to-GDAP least-privilege migration (Microsoft accelerated this ecosystem-wide post-NOBELIUM), service-provider hygiene (dedicated partner tenants, no shared admin identities, monitoring of Graph-API anomalous reads), and threat-hunting for the signature: a partner-tenant context issuing cross-tenant administrative operations it never performs legitimately. The campaign’s permanent lesson — credentials are the new supply chain — anchors the continuous identity-attack coverage we maintain.
What happened
The disclosure arc: Microsoft’s 25 October blog (MSTIC) described NOBELIUM (also tracked as APT29/Cozy Bear/The Dukes lineage, the SVR-attributed SolarWinds actor) conducting a broad campaign against the IT channel itself — the resellers and CSP intermediaries that manage Microsoft environments for small governments and enterprises (the reported emphasis: international government customers reached through their local service providers). The initial vector was unglamorous: password spraying — one password tried against many accounts, low-and-slow to evade lockout — against accounts without MFA, plus token-replay abuse where credentials had already leaked. With partner-admin rights gained, the actor operated inside customer tenants using delegated privileges: mail collection, data access, and persistence via additional consent grants — activity that largely looks legitimate to tenant-side logging because the partner relationship already granted it.
Why the channel target made strategic sense: concentrated blast radius. One CSP admin account can administer hundreds of downstream tenants; compromising 22 resellers potentially reaches thousands of end customers, including government agencies that the adversary apparently struggles to reach directly post-SolarWinds hardening. The arbitrage was explicit — end customers had hardened after 2020, but their outsourced IT management had not.
Microsoft, CISA, and the channel responded in the weeks following: emergency advisories on legacy-Auth disablement (CISA’s subsequent Emergency Directive lineage and AA-series advisories pushed MFA everywhere), the DAP-to-GDAP migration (granular delegated admin permissions replacing blanket partner-admin rights) accelerating through 2022–2023, and MSTIC’s continuous tracking of NOBELIUM infrastructure turnover (the actor’s operational tempo continuing into the Yammer/scoped-token incidents, MagicWeb research lineage, and 2023-era cloud-targeting).
How it worked
The campaign’s cheap-key escalation chain:
(1) target selection: IT channel (CSPs/resellers
managing many downstream tenants)
-> concentrated blast radius per credential
(2) access: password spray (low/slow, evade
lockouts) against non-MFA/dormant accounts
+ replay of already-leaked creds/tokens
+ legacy-Auth endpoints (no MFA enforcement)
(3) privilege: DAP delegated-admin partner rights
-> broad cross-tenant administration "for free"
(4) operations: Graph-API mail/data collection,
consent-grant persistence, tool accounts
in customer tenants (legit-looking context)
(5) persistence: OAuth app consents + additional
partner accounts; token-signing abuse where
hybrid paths allowed it
(6) cover: operations inside delegated context
look like normal partner activity to tenant
logs -> detection requires cross-tenant
baseliningThe structural insight for defenders: the escalation chain has no exploit step — every hop is an authorised mechanism used adversarially, which is exactly why identity-centric detection (cross-tenant anomaly, impossible-travel, consent-grant auditing) is the only layer that fires, a discipline our identity-attack coverage treats as the modern perimeter.
Impact and numbers
| Metric | Value | Source |
|---|---|---|
| Disclosure | 2021-10-25 (MSTIC blog) | Microsoft |
| Named targeted companies | 609 (channel intermediaries) | Microsoft disclosure/press |
| Confirmed compromised at disclosure | ~22 | Microsoft |
| Attribution | NOBELIUM / APT29 (SVR lineage, SolarWinds actor) | Microsoft/USG consensus |
| Primary techniques | Password spray, token theft/replay, DAP partner abuse | MSTIC |
| Ecosystem response | Legacy-Auth disablement, MFA mandates, DAP→GDAP migration | Microsoft/CISA advisories |
Timeline
| Date | Event |
|---|---|
| 2020-12 | SolarWinds disclosures; NOBELIUM named; direct-customer hardening wave |
| 2021-01–09 | NOBELIUM re-tooling: credential/token-focused operations against softer channel targets |
| 2021-10-25 | MSTIC discloses 609-company channel campaign; 22 confirmed compromised |
| 2021-10/11 | CISA/Microsoft advisories: MFA, legacy-Auth off, partner-tenant hygiene |
| 2022–2023 | GDAP migration ecosystem-wide; DAP sunset (Oct 2022 deadline lineage) |
| 2023–2026 | NOBELIUM continues cloud-focused tempo; channel-risk doctrine standard |
Why it still matters in 2026
Three permanences. First, the channel-as-attack-surface model became generalised: every major platform’s partner/delegate ecosystem (MSPs, CSPs, GSIs, agencies’ outsourced admins) now carries explicit compromise-tempo risk, with security questionnaires and contractual SOC-2/responder clauses treating partner-tenant compromise as a named scenario — NOBELIUM wrote that clause. Second, the cheap-key lesson: the most-resourced state actor on earth defaulted to password spraying and token replay when it was cost-effective; every subsequent “unsophisticated technique, sophisticated actor” campaign (MFA-fatigue APTs, AiTM reverse-proxy phishing kits, 2024-25 snowflake-credential waves) re-confirmed that attackers spend sophistication only where defences force it. Third, the identity-control stack that matured in response — phishing-resistant MFA, conditional-access invariants, token-binding/replay resistance, GDAP least-privilege, continuous access evaluation — is now the core defensive curriculum, and NOBELIUM’s October 2021 campaign is its origin case study. The residual gap our era confronts: inter-tenant visibility remains fragmented — no single party sees the whole partner mesh — which is why cross-tenant anomaly-sharing (the Microsoft 365 Defender lineage, ISAC partner intel loops) evolved into a distinct operational discipline.
Detection and hardening takeaways
- Enforce phishing-resistant MFA on every identity, including partner and service accounts. The sprayed accounts of October 2021 were the ones without it; FIDO2/WebAuthn eliminates the password-spray and replay classes structurally rather than detectively.
- Kill legacy authentication now. Legacy-Auth protocols bypass MFA enforcement and were the campaign’s favourite ingress; conditional-access baseline “block legacy auth” is table stakes, and exceptions should carry expiry dates.
- Migrate delegated partner rights to least-privilege granular models. Blanket DAP-style admin relationships are a blast-radius multiplier (one credential, many tenants, no per-relationship boundary); GDAP-class scoping with time-bound assignments default-deny applies.
- Hunt the cross-tenant signature. Partner-tenant contexts issuing tenant-wide administrative operations (mass Graph reads, consent grants, new app registrations) outside their historical baseline are the campaign’s fingerprint; cross-tenant audit-log baselining catches what tenant-local rules miss.
- Gate conditional access on context, not just credential. Device compliance, sign-in risk, and location invariants survive credential theft — the replayed token from a “legitimate” partner account still fails a compliant-device requirement, closing the cheap-key window.
FAQ
How is this connected to SolarWinds?
Same actor, opposite sophistication curve. SolarWinds (2020) was a bespoke supply-chain implant — a trojanised build pipeline distributing backdoored updates to 18,000 organisations. October 2021’s campaign used no custom implant at all: password spraying, replayed tokens, and the partner-delegation model as-is. Both target the same strategic prize (broad access to government/enterprise victims through trusted intermediaries), which is why the actor’s name continuity (NOBELIUM/APT29/SVR attribution) matters for understanding intent.
What are cloud solution providers and delegated admin in plain terms?
CSPs/resellers are IT firms that manage Microsoft (or other vendor) environments on behalf of customers. Delegated administration lets their staff administer customer tenants without per-customer credentials. It is a convenience and a liability: the delegation itself was the lynchpin of privileges NOBELIUM weaponised — and it’s why the post-NOBELIUM reforms (granular, time-boxed permissions) prioritised least-privilege over operational convenience.
Did the campaign succeed in the end?
The attacker achieved footholds in ~22 named intermediaries and operated inside some downstream tenants (mail collection and data access documented); the full downstream-reach tally was never definitively published. Structurally, though, the campaign succeeded at its strategic goal — proving the channel remains a viable route to hardened targets — which is precisely why the channel is now audited, least-privileged, and monitored as the standing risk surface our identity-threat coverage tracks.
