Microsoft has revealed that the nation state group behind the recent SolarWinds cyberattack managed to view source code repositories for some of the company’s products.

The tech giant said it detected malicious SolarWinds applications in its environment, which the company isolated and removed.

“Having investigated further, we can now report that we have not found evidence of the common TTPs (tools, techniques and procedures) related to the abuse of forged SAML tokens against our corporate domains,” the company said.

Microsoft’s investigation has, however, revealed attempted activities beyond just the presence of malicious SolarWinds code in its environment.

“This activity has not put at risk the security of our services or any customer data, but we want to be transparent and share what we’re learning as we combat what we believe is a very sophisticated nation-state actor,” Microsoft added.

The company detected unusual activity with a small number of internal accounts. “Upon review, we discovered one account had been used to view source code in a number of source code repositories. The account did not have permissions to modify any code or engineering systems and our investigation further confirmed no changes were made. These accounts were investigated and remediated,” the company explained.