Last year a hacker group used a bit of malicious code it hid in a software update by the company SolarWinds to launch an immense cyberattack against U.S. government agencies and corporations—see Issues 7-27, 7-36, and 7-38.

The group behind the attack, Nobelium, is reportedly being directed by the Russian intelligence service. And they're at it again.

According to Microsoft, one victim of the SolarWinds hack, the group is targeting technology companies that resell and provide cloud services for customers.

"Nobelium has been attempting to replicate the approach it has used in past attacks by targeting organizations integral to the global IT supply chain," Tom Burt, Microsoft's Corporate Vice President of Customer Security & Trust, said in a blog post on the company's website.

"We believe Nobelium ultimately hopes to piggyback on any direct access that resellers may have to their customers' IT systems and more easily impersonate an organization's trusted technology partner to gain access to their downstream customers," he added.
​
The hacker group hasn't tried to ferret out vulnerabilities in software, Burt said, but has been using techniques like phishing and password spray to gain entry to the targeted networks.

With recent murmurings of chip shortages easing in 2022, one could be forgiven for imagining some sort of promised land where prices return to the lower levels once remembered.

Unfortunately, that idea will have to be consigned to the land of rainbows, pixie dust, and affordable housing in major cities, because while the situation may ease, that doesn't mean it will stop growing.

For Gartner senior analyst Ben Lee, the relief slated to arrive in the middle of 2022 is not a lowering of absolute prices, but a slowing in the rate of growth.

The semiconductor chip shortage that is hamstringing the production of products ranging from cars and computers to appliances and toothbrushes will extend into 2022 and potentially beyond that, according to Matt Murphy, CEO of Marvell Technology.

“We’ve always gone through cycles of ups and downs, where demand has exceeded supply or vice versa,” AMD CEO Lisa Su said at the recent Code Conference in Beverly Hills. “This time, it’s different.”
​
Su said that while she expects the first half of 2022 to be “likely tight,” the second half will be less severe as manufacturing capacity opens.

If you have an old phone, an alarm system or an ankle monitor, your tech could stop working properly next year.

In 2022, everything from your old phone to your alarm system could stop working as service providers turn off 3G networks in the United States.

Kami Griffiths has a perfectly fine phone. It’s your standard Samsung Galaxy smartphone with all the important apps, a decent camera, and a screen big enough to watch videos. It’s so fine, in fact, she’s had it since 2016 without ever feeling the need to drop hundreds of dollars on an upgrade.

Come next year, though, Griffiths won’t have a choice. That’s the current deadline for when the only cellular network her phone can use will shut down forever.

All the major cellphone carriers—AT&T, Verizon and T-Mobile—are planning to shut their older 3G networks in 2022. Like millions of people in the United States who use 3G phones and other 3G devices, she will have to buy a new device if she wants to text, make calls, or even reach 911.

When these deadlines roll around, Griffith’s own phone could be the least of her problems. Griffiths, who is an executive director and co-founder of Community Tech Network—a nonprofit that focuses on digital literacy in San Francisco—is worried that the group’s clients, a mix of mostly older adults and low-income residents, will find themselves either without a working phone, or could struggle to figure out how to use a new device.

“It’s going to be very difficult for them. They will not be happy,” said Griffiths, who notes older tech users have a harder time figuring out new devices. “If it works fine, they don’t want to change a thing.”

Why Is This Happening? 3G network technology has been around in the United States for two decades. Verizon launched the first 3G network in the nation in 2002, and 4G has been around since 2010. In 2019, carriers started slowly rolling out 5G networks and soon the big companies were launching 5G smartphones. Now they need to focus their resources on building out those newer networks, while saving money on maintaining the older ones.
​
“The reason the carriers would like to get rid of old legacy tech is to free up that wireless spectrum,” said Ian Fogg, vice president of analysis at mobile analytics firm Opensignal. “If you switch off older tech in most markets, most countries, your spectrum license allows you to use that with newer networks like 4G and 5G.”
When Do the Networks Shut Down? The shutdown dates start in January 2022 and are spread out throughout the year. At this time, the dates are all confirmed, and the carriers are proceeding as if they are set in stone. However, the Federal Communications Commission recently accepted comments from groups and people concerned about the shutdown, which could lead to a delay.

Office 365 users are now in cybercriminals' crosshairs in a new phishing campaign, according to a warning the Microsoft Security Intelligence (MSI) team issued via Twitter. Malicious actors are using email addresses that appear to be legitimate, with display names that mimic bona fide services to dodge email filters.
Microsoft cautioned cybercriminals are going above and beyond to use detection-evasion techniques that are convincing and authentic-looking.

"An active phishing campaign is using a crafty combination of legitimate-looking original sender email addresses, spoofed display sender addresses that contain the target usernames and domains, and display names that mimic legitimate services to slip through email filters," MSI explained on Twitter.

The deceptive phishing campaign targets Office 365 organizations with employees who often send attachments to co-workers. MSI found phishing emails that seemed as if they were sent from a trusted source. Many of these emails contained faux Microsoft SharePoint attachments with labels such as "Price Books," "Bonuses" and "Staff Reports."

The phishing emails use a tactic called "typosquatting," which involves registering deliberately misspelled domains that, at first glance, look close to a well-known brand. Most quick readers would overlook the subtle typo.

If users fall for the bait and click on the "Open" link, it will lead them to a page that lures them to type in their Microsoft or Google credentials. According to MSI, these sign-on pages look very convincing, making users believe that they're on a trustworthy path to a legitimate website.

MSI kept emphasizing how authentic these phishing emails looked. Employers may not be able to rely on their employees' good judgment to identify suspicious-looking emails. That's why MSI shamelessly plugged its Microsoft Defender for Office 365 program as a solution, adding that this software "detects and blocks" these emails.
​
Phishing attacks are a huge thorn in the side for many popular companies like Netflix and PayPal, but the Redmond-based tech giant should be particularly concerned. According to a CheckPoint Research study, Microsoft topped the list as being the most imitated brand for phishing attacks.

​Microsoft and Google have reportedly ended a six-year truce on legal battles. The Financial Times reports that Microsoft and Google formed an unusual truce in 2015, which expired in April. The pact was reportedly forged to avoid legal battles and complaints to regulators. It meant we haven’t seen Microsoft and Google complaining publicly about each other since the days of Scroogled, a campaign that attacked Google’s privacy policies.

Now the gloves appear to be off once again, and we’ve seen some evidence of that recently. Google slammed Microsoft for trying to “break the way the open web works” earlier this year, after Microsoft publicly supported a law in Australia that forced Google to pay news publishers for their content. Microsoft also criticized Google’s control of the ad market, claiming publishers are forced to use Google’s tools that feed Google’s revenues.

The rivalry between the two has been unusually quiet over the past five years, thanks to this legal truce. Microsoft was notably silent during the US government’s antitrust suit against Google last year, despite being the number two search engine.

The Financial Times reports that the agreement between Microsoft and Google was also supposed to improve cooperation between the two firms, and Microsoft was hoping to find a way to run Android apps on Windows. That obviously didn’t pan out, and Microsoft has turned to Amazon instead to get Android apps running on Windows 11.

Some battles between Microsoft and Google were intense before this agreement, and they’re likely to get heated once again. During the height of Windows Phone in 2013, there was a bitter battle between Microsoft and Google over YouTube. Months later, Microsoft was out selling anti-Google mugs and T-shirts, and acting rather nervous about Chromebooks.
​
A lot has changed for both Microsoft and Google since the days of Scroogled — including new leadership on both sides — but Google’s scathing attack on Microsoft earlier this year proves that these tech giants are ready to battle once more.

Zoom has announced that it’s acquiring a company known as Kites (short for Karlsruhe Information Technology Solutions), which has worked on creating real-time translation and transcription software. Zoom says the acquisition is a move to help it make communicating with people who speak different languages easier, and that it’s looking to add translation capabilities to its video conferencing app. 

According to its site, Kites began at the Karlsruhe Institute of Technology, and its technology was originally developed to act as in-classroom translation for students who needed help understanding the English or German their professors were lecturing in.
​
Zoom already has real-time transcriptions, but it’s limited to people who are talking in English. On a support page, Zoom also clarifies that its current live transcription feature may not meet certain accuracy requirements. The company says it’s considering opening a research center in Germany, where the Kites team will be staying.

Microsoft Corp. said the hackers behind the SolarWinds cyberattack recently compromised a new trio of victims using access to one of the company’s customer support agents.

The hacked portal used by the individual agent contained information for a “small number of customers,” which the attackers used to launch a “highly targeted attack,” Microsoft said Friday in a blog post. The company said it has since removed the attackers and secured the compromised device.

Microsoft didn’t identify the victims but said it had alerted the hacked entities through its nation-state notification process. Microsoft’s Threat Intelligence Center attributed the attack to a group called “Nobelium.” That’s the same group of state-sponsored Russian hackers who used sophisticated intrusion techniques in 2020 to infect with malware 18,000 customers of the Texas-based software company, SolarWinds Corp.
​
Microsoft said Nobelium targeted IT companies, governments, non-profits, think tanks and financial services entities across 36 countries during the recent attack. “The activity was largely focused on U.S. interests, about 45%, followed by 10% in the U.K., and smaller numbers from Germany and Canada,” the Redmond, Washington-based software maker said in the blog.

The biggest change to Microsoft’s Office documents in decades is coming to life soon, as the company’s Fluid framework arrives in Microsoft Teams, OneNote, Outlook, and Whiteboard. Microsoft first unveiled Fluid last year, showing how the framework allows blocks of Office content to live independently across the web. That idea is now becoming a reality, with collaborative content that can be copied, pasted, and shared with others.

Instead of tables, graphs, and lists that are static and bound to specific documents, Fluid components are collaborative modules that exist across different applications. They will begin showing up in Microsoft Teams first this summer, embeddable in meetings and chats. 

The launch of Fluid documents coincides with employees returning to their offices and the rise of a new hybrid work experience. “We were excited about going hard and fast with Fluid, and then the pandemic hit,” says Jared Spataro, head of Microsoft 365. “So we largely put a lot of our energy onto Teams, and we think of Teams as the scaffolding that creates the connection, but now as we move back to hybrid, we increasingly believe we need more innovation in what I call the canvas that gets collaboration done.”

What Microsoft has created with Fluid is the biggest change to Office in decades. While Fluid seemed like a great future-facing concept during its reveal last year, watching Microsoft demonstrate it recently has really highlighted how transformative this could be. 

Every Microsoft Teams meeting will soon come with a built-in notes experience that’s collaborative. Notes will show up within a Teams meeting or in an Outlook calendar, and anyone on the invite can just start typing away in real time. If you add a task, it immediately syncs to your other tasks across Microsoft 365, and the meeting notes are automatically synced to your Outlook calendar where you can also edit them in real time.

“We want collaboration to be able to start before the meeting starts, so as soon as the invite goes out,” explains Ron Pessner, a director of program management working on Fluid at Microsoft. As the meeting notes in this example are live and real time, you can even copy them into an app like OneNote and you’ll still see everyone making edits to them.

This living Fluid component has the potential to shift how everyone gets work done across Microsoft Teams and Office. It’s impressively quick, with no sync time, just like Google Docs. Microsoft has had similar collaboration tools in Office for a while now, but they’ve been restricted to static documents and nothing on this level of freedom.

“We’re going to be launching the components in Teams this summer,” says Pessner. The meeting notes experience will be available in preview later this year, alongside some tests integrating it into the desktop version of Outlook. It’s likely that as we see Fluid components roll out, they’ll appear first in Teams and on the web parts of Office before making their way to desktop.

Microsoft is also transforming its Whiteboard app into a canvas to host Fluid components. Whiteboard has long existed as Microsoft’s first big collaborative tool, and this summer it’s being overhauled with the help of Fluid.

New collaboration cursors will appear in Whiteboard, letting you see coworkers’ additions to a document in real time. There’s even a new virtual laser pointer that you can use to get people’s attention, or reaction stickers to make the Whiteboard canvas feel a little more alive.

Fluid components like tables or task lists can also be embedded into Whiteboard, and the entire app will now look and feel the same across all devices and platforms. With Whiteboard, you could almost use the app as a dashboard to watch colleagues editing Fluid components in real time.
​
This is just the start of Fluid making its way to Microsoft 365, and we expect to see more throughout this year and beyond. It will be interesting to see how Microsoft integrates Fluid more deeply into both Teams and Outlook, the main communications tools used by businesses that rely on the Office suite. If Microsoft gets the integration of Fluid right, it will forever change the way documents are created, shared, and, ultimately, how work gets done.

The group behind the massive SolarWinds hacks has also been running a sophisticated email-based spear-phishing campaign, according to Microsoft. In a blog post by company VP Tom Burt, he said the Microsoft Threat Intelligence Center (MSTIC) has detected a wave of cyberattacks by the group called Nobelium against government agencies, think tanks and non-governmental organizations. Nobelium apparently sent out 3,000 emails to 150 organizations after getting access to Constant Contact, the mass mailing service used by the United States Agency for International Development or USAID.

While most of the targets are in the United States, they're spread out in 24 countries overall. At least a quarter of the intended victims are involved in humanitarian and human rights work and, hence, may be the most vocal critics of Russian president Vladimir Putin. The SolarWinds attack is believed to be a Russian-backed campaign, and the United States government retaliated by expelling 10 Russian diplomats from Washington, DC. The Treasury Department also imposed sanctions on six Russian technology companies that were allegedly involved in creating malicious tools for cyberattacks.

According to Microsoft, it first detected the campaign on January 25th, though Nobelium wasn't leveraging USAID's Constant Contact account to phish targets back then. The campaign has evolved several ways since, and it was only on May 25th that MSTIC determined an escalation on the group's part when it sent out 3,000 emails with legitimate-looking USAID addresses through the mailing service. 

Thankfully, automated threat detection systems blocked most of the emails because of the high volume of emails that were sent out. Further, the contents were anything but subtle. The New York Times says one email blasted out highlighted a message claiming that "Donald Trump has published new emails on election fraud." It then linked to a URL that downloads malware into the victim's computer when clicked. Microsoft says some of the earliest emails that went out may have been successfully delivered, though, and the company is advising potential targets to make sure they're sufficiently protected. 

Burt wrote in his post:
​
"These attacks appear to be a continuation of multiple efforts by Nobelium to target government agencies involved in foreign policy as part of intelligence gathering efforts... when coupled with the attack on SolarWinds, it’s clear that part of Nobelium’s playbook is to gain access to trusted technology providers and infect their customers. By piggybacking on software updates and now mass email providers, Nobelium increases the chances of collateral damage in espionage operations and undermines trust in the technology ecosystem."

Amazon plans to expand its virtual health service benefit to all its U.S. employees this summer while also making it available to other companies.

Eighteen months ago, the tech giant announced it was piloting a new virtual health service benefit for employees and their families in the Seattle region called Amazon Care.

The service offers virtual visits, in-person primary care visits at patients' homes or offices and prescription delivery. The on-demand healthcare service enables employees to connect with medical professionals via chat or video conference, typically in less than 60 seconds, and eliminates lengthy wait and travel times to get medical attention, Amazon said in a press release.

Starting Wednesday, Amazon Care is available to serve other Washington-based companies. Beginning this summer, Amazon Care will expand its virtual care to companies and Amazon employees in all 50 states. Amazon Care’s in-person service will expand to Washington, D.C., Baltimore and other cities in the coming months, the company said.

Services include video care, in-app text chat with clinicians, mobile care visits, prescription delivery from a care courier and in-person care, where Amazon Care can dispatch a medical professional to a patient’s home for services ranging from routine blood draws to listening to a patient’s lungs.

Officials said Amazon Care will be able to help with urgent issues like colds, allergies, infections, minor injuries, preventive health consults, vaccines, lab work, sexual health services like contraception and sexually transmitted infection testing and general health questions. 

Patients also can access preventive care such as annual vaccinations, health screenings and lifestyle advice. The service also supports patients’ wellness needs including nutrition, pre-pregnancy planning, sexual health, help to quit smoking and more, the tech giant said.

Amazon and other companies are increasingly focused on the home as a site of care. The company joined with Intermountain Healthcare and Ascension along with other health systems and home care companies to form the Moving Health Home coalition, which aims to change the way policymakers think about the home as a site of clinical service. The group is lobbying Congress to make permanent changes to home health care reimbursement policies.

Amazon officials said the program has received positive feedback from employees as the service is uniquely focused on patients and their changing needs. During shutdowns forced by the COVID-19 pandemic, doctors’ offices were seeing fewer children for pediatric vaccines, so Amazon Care quickly adjusted its services to offer the vaccines in families’ homes, the company said.

Gina Baird, whose spouse works at Amazon, participated in the Amazon Care pilot program when her three-year-old daughter woke up at 2 a.m. with a terrible cough.

"Of course we were worried about COVID-19 and certainly did not want to go to an urgent care center or emergency room if we could avoid it,” said Baird in a statement in the Amazon press release. “Using Amazon Care, we were able to connect with a clinician in under a minute who provided medical advice that helped us get through the night. She also prescribed a medication that was delivered to our doorstep by 9 a.m. the next day. Thanks to Amazon Care, we were able to manage her illness without ever having to leave the house.”

Ashley Bennett, senior operations manager at Amazon’s fulfillment center in Kent, Washington, said the on-demand healthcare services offered by Amazon Care make her feel that she has more control over the system.

"It’s at my leisure. That’s power. I’m not waiting on someone else to show up on their schedule," Bennett said in a statement. 

Amazon has been rapidly expanding its reach in the healthcare space, most notably in 2018 with its acquisition of online pharmacy PillPack. In November, the tech giant launched Amazon Pharmacy, the long-anticipated online storefront that will enable customers to purchase prescription drugs online and have them shipped to their homes.

Amazon started an ambitious health tech startup, Haven, with JPMorgan Chase and Berkshire Hathaway in 2018, but that venture shuttered in January.
​
The tech giant has instead pivoted to address healthcare costs by focusing on employee healthcare through primary care models. Amazon teamed up with trendy tech-enabled primary care group Crossover Health to launch health centers in five major regions—Dallas-Fort Worth, Phoenix, Louisville, Detroit and two California metro areas—to serve Amazon employees and their families.