From Swiss Cyber-Sleuths, New Light On SolarWinds Hack

A report from a Swiss cybersecurity firm reveals new information about what may have been the most extensive hack to date, anywhere: the attack on management software provider SolarWinds. That attack in turn compromised networks in at least 4,720 companies, government institutions and IT providers, according to the report. Among other findings: the attack has continued into this month (March), and the hackers generally work regular hours, 8 a.m. to 8 p.m., Monday through Friday, and take weekends off. The Swiss company, called PRODAFT (Proactive Defense Against Future Threats) also said the group shared servers with a known Russian criminal group and that the servers were in Russia and Ukraine. However, PRODAFT told Bloomberg News that it could not conclude the attack was state-sponsored and that more analysis would be required to make any such determination. This puts PRODAFT at odds with U.S. cybersecurity researchers, who haven’t been reluctant to point the finger at the Russian Federation.