Microsoft said it identified more than 40 of its customers that installed trojanized versions of the SolarWinds Orion platform and where hackers escalated intrusions with additional, second-stage payloads.
The OS maker said it was able to discover these intrusions using data collected by Microsoft Defender antivirus product, a free antivirus product built into all Windows installations.
Microsoft President Brad Smith said his company is now in the process of notifying all the impacted organizations, 80% of which are located in the United States, with the rest being spread across seven other countries —namely Canada, Mexico, Belgium, Spain, the UK, Israel, and the UAE.
While the current list of known victims of the SolarWinds hack mostly includes US government agencies, Smith said the government sector is only a small portion of the victim list, with 44% being IT companies, such as software firms and equipment providers.
The Microsoft President also said the attack is ongoing, with the hackers trying to compromise new companies still, despite the incident being public and actively investigated.
"It's certain that the number and location of victims will keep growing," Smith said.
The latest victim on this list is Microsoft itself[1], which, hours before Smith's analysis, admitted to having installed trojanized version of the SolarWinds app inside its own infrastructure.
Reuters reported that hackers accessed Microsoft's internal network, but Microsoft denied that they were able to reach production systems and impact its business customers and end-users.
SolarWinds hack summary and fallout
Five days later, the breadth of the SolarWinds hack continues to grow.
This entire incident began last week when security firm FireEye said that a state-sponsored hacking group accessed its internal network[2], stole pen-testing tools and tried to access documents on its