Microsoft posted a blog Thursday saying the hacking group behind last year’s SolarWinds cyber attack is back.

Russian group Nobelium now targeting government agencies, think tanks, consultants, and non-governmental organizations, according to Microsoft.

In the blog, Corporate Vice President of Customer Security & Trust Tom Burt said this wave of attacks targeted about 3,000 email accounts at more than 150 different organizations.

While the United States received the largest share of attacks, 24 different countries were targeted. At least a quarter of the organizations attacked were involved in international development, humanitarian issues and human rights work.

The attacks come just weeks after a ransomeware attack shut down the U.S’s largest fuel pipeline network for several days.