Unbelievable... these guys are so good! They find things out, they find out everything...Russians spying against NATO and USA?
What will they find out next? Isn't it amazing ???? They really find out everything !
1
Russia accuses NATO of launching 5,000 cyberattacks since 2022
Bill Toulas
- April 14, 2023
- 12:19 PM
- 3
"The Federal Security Service of the Russian Federation (FSB) has accused the United States and other NATO countries of launching over 5,000 cyberattacks against critical infrastructure in the country since the beginning of 2022.
The agency says it has taken timely measures to prevent these attacks from causing any negative consequences to Russia.
Furthermore, the FSB claims that these attacks originate from Ukrainian territories, which are used for masking the true origin and identity of the perpetrators. At the same time, the attacks also involve the deployment of "new types of cyber-weapons."
"In the analysis of identified computer threats, data were obtained indicating the use of Ukrainian territory by the United States and NATO countries for conducting massive computer attacks on civilian objects in Russia," reads the machine-translated FSB statement.
"Currently, the network infrastructure of Ukraine is used by units of offensive cyber operations of Western countries, allowing them to secretly use new types of cyber weapons."
The FSB claims that despite many of the attacks being presented as activities by the "IT Army of Ukraine," it was able to discern the involvement of pro-west hacker groups such as "Anonymous," "Sailens," "Goast clan," "Ji-En-Ji," "SquadZOZ," and others.
The timing of this statement from FSB is suspicious, as Poland's Military Counterintelligence Service and its Computer Emergency Response Team linked APT29 state-backed Russian hackers to widespread attacks against several EU and NATO countries just yesterday.
Detections point to Chinese APTs
Meanwhile, Rostelecom's CERT team has also published a report about cyberattacks targeting Russian infrastructure between March 2022 and March 2023.
In that report, Rostelecom claims that 20% of all detected attacks can be attributed to sophisticated APT groups, 38% are cases of hacktivism, and another 38% are ransomware attacks.
In 72% of the detected cases, the network intruders leveraged known vulnerabilities for initial access, while the time for reaching their ultimate goal has now been reduced to an average of seven days.
"The activity of state-owned APT groups has grown, which since the beginning of the special military operation have become more active in infrastructure, expanding the range of goals," reads machine-translated Rostelecom's report.
Interestingly, the four hacking groups reported by Rostelecom's analysts as having the most significant activity against Russian entities during the mentioned period are APT27, APT41, APT10, all three believed to be of Chinese origin, and the Lazarus Group, who are North Koreans.
This directly contradicts FSB's statement about a massive wave of thousands of attacks launched by NATO-backed hacking collectives.
Rather, the country's largest telecommunications provider reports that the most significant volume of cyberespionage attacks comes from Russia's own alleged allies."
2
Russian hackers linked to widespread attacks targeting NATO and EU
- April 13, 2023
- 10:27 AM
- 2
"Poland's Military Counterintelligence Service and its Computer Emergency Response Team have linked APT29 state-sponsored hackers, part of the Russian government's Foreign Intelligence Service (SVR), to widespread attacks targeting NATO and European Union countries.
As part of this campaign, the cyberespionage group (also tracked as Cozy Bear and Nobelium) aimed to harvest information from diplomatic entities and foreign ministries.
"At the time of publication of the report, the campaign is still ongoing and in development," an advisory published today warns.
"The Military Counterintelligence Service and CERT.PL recommend all entities which may be in the area of interest of the actor to implement mechanisms aimed at improving the security of IT Security systems in use and increasing the detection of attacks."
The attackers have targeted diplomatic personnel using spear phishing emails impersonating European countries' embassies with links to malicious websites or attachments designed to deploy malware via ISO, IMG, and ZIP files.
Websites controlled by APT29 infected victims with the EnvyScout dropper via HTML smuggling, which helped deploy downloaders known as SNOWYAMBER and QUARTERRIG and designed to deliver additional malware, as well as a CobaltStrike Beacon stager named HALFRIG.
SNOWYAMBER and QUARTERRIG were used for reconnaissance to help the attackers evaluate each target's relevance and determine whether they compromised honeypots or VMs used for malware analysis.
"If the infected workstation passed manual verification, the aforementioned downloaders were used to deliver and start-up the commercial tools COBALT STRIKE or BRUTE RATEL," a separate malware analysis report released today reads.
"HALFRIG, on the other hand, works as a so-called loader – it contains the COBALT STRIKE payload and runs it automatically."
APT29 is the Russian Foreign Intelligence Service (SVR) hacking division which was also linked to the SolarWinds supply-chain attack that led to the compromise of multiple U.S. federal agencies three years ago.
Since then, the hacking group has breached other organizations' networks using stealthy malware that remained undetected for years, including a new malware tracked as TrailBlazer and a variant of the GoldMax Linux backdoor.
> Unit 42 has also observed the Brute Ratel adversarial attack simulation tool being used in attacks suspected to be linked to the Russian SVR cyber spies.
> More recently, Microsoft reported that the APT29 hackers are using new malware capable of hijacking Active Directory Federation Services (ADFS) to log in as anyone in Windows systems.
> They've also targeted Microsoft 365 accounts in NATO countries in attempts to access foreign policy information and orchestrated a wave of phishing campaigns targeting governments, embassies, and high-ranking officials across Europe."
.jpg)
.jpg)
.jpg)
.jpg)
naoEntendo (profile) says: 
