The state-backed Russian group behind a massive hacking campaign revealed last year has re-emerged with a series of attacks on government agencies, think tanks, consultants and other organizations, Microsoft security researchers said.

A security update from Microsoft late Thursday said the group known as Nobelium has stepped up attacks, notably targeting government agencies involved in foreign policy as part of intelligence gathering efforts.

Microsoft said it detected a "sophisticated" and large-scale campaign that delivered phishing emails delivering malicious software and enabling the hackers to get protected data from victims.

"This wave of attacks targeted approximately 3,000 email accounts at more than 150 different organizations," Microsoft vice president Tom Burt said in a blog post.

The news comes a month after Washington imposed sanctions and expelled Russian diplomats in response to Moscow's involvement in the massive attacks last year on SolarWinds, a security software firm, election interference and other hostile activity.

"When coupled with the attack on SolarWinds, it's clear that part of Nobelium's playbook is to gain access to trusted technology providers and infect their customers," wrote Burt. "By piggybacking on software updates and now mass email providers, Nobelium increases the chances of collateral damage in espionage operations and undermines trust in the technology ecosystem."

Microsoft says it has detected a renewed wave of cyberattacks from the same state-backed group behind the massive SolarWinds hack
Microsoft says it has detected a renewed wave of cyberattacks from the same state-backed group behind the massive SolarWinds hack AFP / NICOLAS ASFOURI

The new attacks enabled the hackers were able to gain access to email servers to be able spoof the US Agency for International Development and send out mass emails with disinformation, according to the update.

In one example, emails appearing to be from USAID showed a "special alert" stating that "Donald Trump has published new documents on election fraud."

Users who clicked on the link were directed to a site delivering malicious software and enabling the hackers to exfiltrate data, according to Microsoft.

"This attack is still active, so these indicators should not be considered exhaustive for this observed activity," Microsoft said in its update.

SolarWinds last year disclosed that as many as 18,000 customers and more than 100 US companies were affected by the hack. Its roster of clients includes government agencies and companies among the top 500 in the United States.

Washington has accused Russia of orchestrating the online assault, explicitly citing its Foreign Intelligence Service (SVR).