Microsoft Corp. said the hackers behind the SolarWinds cyberattack are engaged in a fresh campaign to compromise global networks by targeting the tech supply chain, including resellers and providers of cloud technology.

Microsoft attributes the coordinated attack, which was first observed in May, to a group called Nobelium, the same state-sponsored Russian hackers who used sophisticated intrusion techniques in 2020 to infect with malware as many as 18,000 customers of Texas-based software company SolarWinds Corp. More than 140 technology service providers and resellers have been notified as recent targets of the hackers and 14 of them are believed to have been compromised, Microsoft said in a blog on Monday.

Nobelium was also behind an attack on IT companies, governments, think tanks and financial service entities earlier this year that spanned 36 countries, Microsoft announced in June.

When they met in Geneva in the summer, U.S. President Joe Biden said he gave Russian President Vladimir Putin a list of 16 critical sectors that shouldn’t be hacked to deter a cyber response from the U.S. government, but the attacks have continued. The Kremlin, for its part, has repeatedly denied responsibility for any hacking attacks.

This time, between July and October this year, “we informed 609 customers that they had been attacked 22,868 times by Nobelium, with a success rate in the low single digits,” Microsoft Corporate Vice President of Customer Security and Trust Tom Burt wrote. 

The Redmond, Washington-based company said this activity was another indicator that “Russia is trying to gain long-term, systematic access to a variety of points in the technology supply chain, and establish a mechanism for surveilling — now or in the future — targets of interest to the Russian government.”

The White House, which issued an executive order in May this year urging the private sector to bolster its cyber defenses, said it was increasing its intelligence sharing and other measures to protect against cyber threats.

The attacks described in the Microsoft blog were unsophisticated operations attempted daily by Russia and other foreign governments. The attackers weren’t attempting to exploit any flaws or vulnerabilities in software but instead using “well-known” techniques to steal credentials, the blog said.