Microsoft urges action on health care cyber attacks

Microsoft on Friday urged a crackdown on cyber attacks perpetrated by states and "malign actors" after a spate of hacks disrupted health care organisations fighting the coronavirus.

"In recent months, we've detected cyberattacks from three nation-state actors targeting seven prominent companies directly involved in researching vaccines and treatments for Covid-19," said Microsoft's vice-president for security issues Tom Burt.

Burt said targets had included leading pharmaceutical companies and vaccine researchers in Canada, France, India, South Korea and the United States.

He said one was a clinical research organisation involved in trials while another one had developed a Covid-19 test.

"The attacks came from Strontium, an actor originating from Russia, and two actors originating from North Korea that we call Zinc and Cerium," Burt added.

"We think these attacks are unconscionable and should be condemned by all civilized society," Burt said in a blog post to coincide with this year's Paris Peace Forum, which ended Friday.

He urged governments to see legal norms are upheld in cyberspace, adding Microsoft had offered to assist firms affected.

By way of example, Burt said Cerium had used spear-phishing emails with Covid-19 themes while purporting to represent the World Health Organization.

"We believe the law should be enforced not just when attacks originate from government agencies but also when they originate from criminal groups that governments enable to operate -- or even facilitate -- within their borders," Burt stated.

"This is criminal activity that cannot be tolerated."

Microsoft has accused Strontium, also known as "Fancy Bear" or "APT28," of attacking more than 200 organisations, including campaign groups and political parties involved in last week's US presidential election.

The group was also accused of malfeasance during the 2016 US elections.