Microsoft said on Thursday that it has completed its internal investigation into the activities conducted by the hackers that breached Texas-based IT management firm SolarWinds.
The tech giant previously admitted that the hackers had managed to access some internal source code, but said they did not compromise or modify its software.
The company on Thursday confirmed that some source code was accessed, but claimed impact was limited.
“There was no case where all repositories related to any single product or service was accessed. There was no access to the vast majority of source code. For nearly all of code repositories accessed, only a few individual files were viewed as a result of a repository search,” it said.
Microsoft said the attackers apparently first accessed source code in late November, but their attempts did not stop after the breach was discovered and resolved in December. They continued making attempts until January 2021, but none of these attempts were successful.
The company said the attackers downloaded source code from repositories storing “a small subset” of Azure (service, security and identity), Intune, and Exchange components.
Microsoft also determined — based on the search terms used by the hackers — that they were attempting to find “secrets” in the source code they accessed.
“Our development policy prohibits secrets in code and we run automated tools to verify compliance. Because of the detected activity, we immediately initiated a verification process for current and historical branches of the repositories. We have confirmed that the repositories complied and did not contain any live, production credentials,” the company said.
Microsoft also reiterated that it had found no evidence that production services or customer data were compromised, or that its own systems were used to attack others.
“Because of our defense-in-depth protections, the actor was also not able to gain access to privileged credentials or leverage the SAML techniques against our corporate domains,” Microsoft said.
Last month, Microsoft released a report detailing the methods and activities of the threat actor behind the SolarWinds attack, including operational security (OPSEC), anti-forensic behavior, and malware delivery methods.
Microsoft and others have claimed that more than 1,000 hackers may have been involved in the SolarWinds attack, but some cybersecurity professionals have questioned the claims.
SolarWinds was apparently targeted by two unrelated threat groups: one linked to Russia that compromised its systems and delivered trojanized updates to thousands of customers, and one linked to China that did not breach SolarWinds systems and instead exploited a zero-day vulnerability and delivered a piece of malware after gaining access to victims’ systems.
SolarWinds released patches in response to both attacks, but many of its customers have failed to secure their systems, according to a report from risk assessment firm RiskRecon.
Related: White House Names SolarWinds Response Leader Amid Criticism
Related: Hundreds of Industrial Organizations Received Sunburst Malware in SolarWinds Attack
Related: More Cybersecurity Firms Confirm Being Hit by SolarWinds Hack
