News

Executive Summary

This joint cybersecurity advisory (CSA) highlights a Russian state-sponsored cyber campaign targeting Western logistics entities and technology companies. This includes those involved in the coordination, transport, and delivery of foreign assistance to Ukraine. Since 2022, Western logistics entities and IT companies have faced an elevated risk of targeting by the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (85th GTsSS), military unit 26165—tracked in the cybersecurity community under several names (see “Cybersecurity Industry Tracking”). The actors’ cyber espionage-oriented campaign, targeting technology companies and logistics entities, uses a mix of previously disclosed tactics, techniques, and procedures (TTPs). The authoring agencies expect similar targeting and TTP use to continue.

Executives and network defenders at logistics entities and technology companies should recognize the elevated threat of unit 26165 targeting, increase monitoring and threat hunting for known TTPs and indicators of compromise (IOCs), and posture network defenses with a presumption of targeting.

This cyber espionage-oriented campaign targeting logistics entities and technology companies uses a mix of previously disclosed TTPs and is likely connected to these actors’ wide scale targeting of IP cameras in Ukraine and bordering NATO nations.

The following authors and co-sealers are releasing this CSA:

• United States National Security Agency (NSA)
• United States Federal Bureau of Investigation (FBI)
• United Kingdom National Cyber Security Centre (NCSC-UK)
• Germany Federal Intelligence Service (BND) Bundesnachrichtendienst
• Germany Federal Office for Information Security (BSI) Bundesamt für Sicherheit in der Informationstechnik
• Germany Federal Office for the Protect "

  Autosummary: *.000[.]pe *.1cooldns[.]com *.42web[.]io *.4cloud[.]click *.accesscan[.]org *.bumbleshrimp[.]com *.camdvr[.]org *.casacam[.]net *.ddnsfree[.]com *.ddnsgeek[.]com *.ddnsguru[.]com *.dynuddns[.]com *.dynuddns[.]net *.free[.]nf *.freeddns[.]org *.frge[.]io *.glize[.]com *.great-site[.]net *.infinityfreeapp[.]com *.kesug[.]com *.loseyourip[.]com *.lovestoblog[.]com *.mockbin[.]io *.mockbin[.]org *.mocky[.]io *.mybiolink[.]io *.mysynology[.]net *.mywire[.]org *.ngrok[.]io *.ooguy[.]com *.pipedream[.]net *.rf[.]gd Outlook CVE Exploitation IOCs md-shoeb@alfathdoor[.]com[.]sa jayam@wizzsolutions[.]com accounts@regencyservice[.]in m.salim@tsc-me[.]com vikram.anand@4ginfosource[.]com mdelafuente@ukwwfze[.]com sarah@cosmicgold469[.]co[.]za franch1.lanka@bplanka[.]com commerical@vanadrink[.]com maint@goldenloaduae[.]com karina@bhpcapital[.]com tv@coastalareabank[.]com ashoke.kumar@hbclife[.]in 213[.]32[.]252[.]221 124[.]168[.]91[.]178 194[.]126[.]178[.]8 159[.]196[.]128[.]120 Commonly Used Webmail Providers portugalmail[.]pt mail-online[.]dk email[.]cz seznam[.]cz Malicious Archive Filenames Involving CVE-2023-38831 calc.war.zip news_week_6.zip Roadmap.zip SEDE-PV-2023-10-09-1_EN.zip war.zip Zeyilname.zip Brute Forcing IP Addresses Disclaimer: These IP addresses date June 2024 through August 2024. Utilities and scripts Legitimate utilities Unauthorized or unusual use of the following legitimate utilities can be an indication of a potential compromise: ntdsutil – A legitimate Windows executable used by threat actors to export contents of Active Directory wevtutil – A legitimate Windows executable used by threat actors to delete event logs vssadmin – A legitimate Windows executable possibly used by threat actors to make a copy of the server’s C: drive ADexplorer – A legitimate window executable to view, edit, and backup Active Directory Certificate Services OpenSSH – The Windows version of a legitimate open source SSH client schtasks – A legitimate Windows executable used to create persistence using scheduled tasks whoami – A legitimate Windows executable used to retrieve the name of the current user tasklist – A legitimate Windows executable used to retrieve the list of running processes hostname – A legitimate Windows executable used to retrieve the device name arp – A legitimate Windows executable used to retrieve the ARP table for mapping the network environment systeminfo – A legitimate Windows executable used to retrieve a comprehensive summary of device and operating system information net – A legitimate Windows executable used to retrieve detailed user information wmic – A legitimate Windows executable used to interact with Windows Management Instrumentation (WMI), such as to retrieve letters assigned to logical partitions on storage drives cacls – A legitimate Windows executable used to modify permissions on files icacls – A legitimate Windows executable used to modify permissions to files and handle integrity levels and ownership ssh – A legitimate Windows executable used to establish network shell connections reg – A legitimate Windows executable used to add to or modify the system registry Note: Additional heuristics are needed for effective hunting for these and other living off the land (LOTL) binaries to avoid being overwhelmed by false positives if these legitimate management tools are used regularly. The countries with targeted entities include the following, as illustrated in Figure 1: Bulgaria Czech Republic France Germany Greece Italy Moldova Netherlands Poland Romania Slovakia Ukraine United States Figure 1: Countries with Targeted Entities Initial Access TTPs To gain initial access to targeted entities, unit 26165 actors used several techniques to gain initial access to targeted entities, including (but not limited to): Credential guessing [T1110.001] / brute forceIPAddressToString" $command_7 = "@(0x4e,0x54,0x4c,0x4d, 0x53,0x53,0x50,0x00,0x02,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x28,0x00,0x00,0x01,0x82,0x00,0x00,0x11,0x22,0x33,0x44,0x55,0x66,0x77,0x88,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00)" $command_8 = ".AllKeys" $variable_1 = "$NTLMAuthentication" nocase $variable_2 = "$NTLMType2" nocase $variable_3 = "$listener" nocase $variable_4 = "$hostip" nocase $variable_5 = "$request" nocase $variable_6 = "$ntlmt2" nocase $variable_7 = "$NTLMType2Response" nocase $variable_8 = "$buffer" nocase condition: 5 of ($command_*) or all of ($variable_*) } HEADLACE shortcut rule APT28_HEADLACE_SHORTCUT { meta: description = "Detects the HEADLACE backdoor shortcut dropper.These accounts contained information on aid shipments to Ukraine, including: sender, recipient, train/plane/ship numbers, point of departure, destination, container registration numbers, travel route, and cargo contents.Militaire Inlichtingen- en Veiligheidsdienst Download the PDF version of this report: For a downloadable list of IOCs, visit: Introduction For over two years, the Russian GRU 85th GTsSS, military unit 26165—commonly known in the cybersecurity community as APT28, Fancy Bear, Forest Blizzard, BlueDelta, and a variety of other identifiers—has conducted this campaign using a mix of known tactics, techniques, and procedures (TTPs), including reconstituted password spraying capabilities, spearphishing, and modification of Microsoft Exchange mailbox permissions.An open source python script for finding insecure passwords stored in Group Policy Preferences ldap-dump.py – A script for enumerating user accounts and other information in Active Directory Hikvision backdoor string: “YWRtaW46MTEK” Suspicious command lines While the following utilities are legitimate, and using them with the command lines shown may also be legitimate, these command lines are often used during malicious activities and could be an indication of a compromise: edge.exe “-headless-new -disable-gpu” ntdsutil.exe "activate instance ntds" ifm "create full C:\temp\[a-z]{3}" quit quit ssh -Nf schtasks /create /xml[T1021.001] to access additional hosts and attempt to dump Active Directory NTDS.dit domain databases [T1003.003] using native Active Directory Domain Services commands, such as in Figure 2: Example Active Directory Domain Services command: C:\Windows\system32 tdsutil.exe "activate instance ntds" ifm "create full C:\temp\[a-z]{3}" quit quit Figure 2: Example Active Directory Domain Services command Additionally, GRU unit 26165 actors used the tools Certipy and ADExplorer.exe to exfiltrate information from the Active Directory.From a sample available to the authoring agencies of over 10,000 cameras targeted via this effort, the geographic distribution of victims showed a strong focus on cameras in Ukraine and border countries, as shown in Table 1: Table 1: Geographic distribution of targeted IP cameras Country Percentage of Total Attempts Ukraine 81.0% Romania 9.9% Poland 4.0% Hungary 2.8% Slovakia 1.7% Others 0.6% Mitigation Actions General Security Mitigations Architecture and Configuration Employ appropriate network segmentation [D3-NI] and restrictions to limit access and utilize additional attributes (such as device information, environment, and access path) when making access decisionsThere were a number of known malware variants tied to this campaign against logistics sector victims, including: HEADLACE [7] MASEPIE [8] While other malware variants, such as OCEANMAP and STEELHOOK, [8] were not directly observed targeting logistics or IT entities, their deployment against victims in other sectors in Ukraine and other Western countries suggest that they could be deployed against logistics and IT entities should the need arise.Bezpečnostní informační služba Poland Internal Security Agency (ABW) Agencja Bezpieczeństwa Wewnętrznego Poland Military Counterintelligence Service (SKW) Służba Kontrwywiadu Wojskowego United States Cybersecurity and Infrastructure Security Agency (CISA) United States Department of Defense Cyber Crime Center (DC3) United States Cyber Command (USCYBERCOM) Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)Redirector services used include: Webhook[.]site FrgeIO InfinityFree Dynu Mocky Pipedream Mockbin[.]org The actors also used spearphishing to deliver malware (including HEADLACE and MASEPIE) executablesCSeq: 2 Authorization: Digest username="admin", realm="[a-f0-9]{12}", algorithm="MD5", nonce="[a-f0-9]{32}", uri="", response="[a-f0-9]{32}" User-Agent: "

  ---

  Russian Hackers Using ClickFix Fake CAPTCHA to Deploy New LOSTKEYS Malware

  exploits rusia-ucrania
  2025-05-08 https://thehackernews.com/2025/05/russian-hackers-using-clickfix-fake.html
  The Russia-linked threat actor known as COLDRIVER has been observed distributing a new malware called LOSTKEYS as part of an espionage-focused campaign using ClickFix-like social engineering lures. "LOSTKEYS is capable of stealing files from a hard-coded list of extensions and directories, along with sending system information and running processes to the attacker," the Google Threat "

  Autosummary: "Clicking "I"m not a robot" triggers a Binance Smart Contract, using an EtherHiding technique, to deliver a Base64-encoded command to the clipboard, which users are prompted to run in Terminal via macOS-specific shortcuts (⌘ + Space, ⌘ + V)," an independent researcher who goes by the alias Badbyte said. "

  ---

  Google links new LostKeys data theft malware to Russian cyberspies

  exploits rusia-ucrania
  2025-05-08 https://www.bleepingcomputer.com/news/security/google-links-new-lostkeys-data-theft-malware-to-russian-cyberspies/
  Since the start of the year, the Russian state-backed ColdRiver hacking group has been using new LostKeys malware to steal files in espionage attacks targeting Western governments, journalists, think tanks, and non-governmental organizations. [...] "

  Autosummary: "

  ---

  Hive0117 group targets Russian firms with new variant of DarkWatchman malware

  exploits rusia-ucrania
  2025-05-01 https://securityaffairs.com/177268/cyber-crime/hive0117-targets-russian-firms-with-darkwatchman-malware.html
  Hive0117 targets Russian firms in multiple sectors with phishing attacks using a modified version of the DarkWatchman malware. A cybercrime group named Hive0117 is behind a fresh phishing campaign that targeted Russian organizations with a new version of the DarkWatchman malware, according to Russian cybersecurity firm F6. The financially-motivated group targeted organizations in the media, […] "

  Autosummary: The financially-motivated group targeted organizations in the media, tourism, finance, insurance, manufacturing, energy, telecommunications, biotechnology and retail sectors. "

  ---

  France links Russian APT28 to attacks on dozen French entities

  rusia-ucrania
  2025-04-30 https://securityaffairs.com/177238/apt/france-links-russian-apt28-to-attacks-on-dozen-french-entities.html
  France blames Russia-linked APT28 for cyberattacks targeting or compromising a dozen French government bodies and other entities. The Russia-linked APT28 group has targeted or compromised a dozen government organizations and other French entities, the French Government states. In 2024, it was observed attacking OT organizations and linked to cyberattacks on 60 entities in Asia and […] "

  Autosummary: Since 2021, APT28 has targeted or compromised French ministerial bodies, local governments, DTIB, aerospace, research, think-tanks, and financial entities. "

  ---

  France ties Russian APT28 hackers to 12 cyberattacks on French orgs

  rusia-ucrania ciber
  2025-04-29 https://www.bleepingcomputer.com/news/security/france-ties-russian-apt28-hackers-to-12-cyberattacks-on-french-orgs/
  Today, the French foreign ministry blamed the APT28 hacking group linked to Russia"s military intelligence service (GRU) for targeting or breaching a dozen French entities over the last four years. [...] "

  Autosummary: " According to NATO, these recent incidents include "sabotage, acts of violence, cyber and electronic interference, disinformation campaigns, and other hybrid operations" that have impacted Czechia, Estonia, Germany, Latvia, Lithuania, Poland, as well as the United Kingdom. "

  ---

  Android spyware hidden in mapping software targets Russian soldiers

  rusia-ucrania
  2025-04-24 https://securityaffairs.com/176886/malware/android-spyware-hidden-in-mapping-software-targets-russian-soldiers.html
  A new Android spyware was discovered in a fake Alpine Quest app, reportedly used by Russian soldiers for war zone planning. Doctor Web researchers uncovered a new spyware, tracked as Android.Spy.1292.origin, targeting Russian military personnel. The malicious code was hidden in a trojanized Alpine Quest app and spread via Russian Android catalogs. The malware steals […] "

  Autosummary: Each time the app is launched, the trojan silently gathers and transmits data such as the user’s phone number, accounts, contact list, current date, geolocation, stored file details, and the app version to a command-and-control server. "

  ---

  Android Spyware Disguised as Alpine Quest App Targets Russian Military Devices

  rusia-ucrania
  2025-04-23 https://thehackernews.com/2025/04/android-spyware-disguised-as-alpine.html
  Cybersecurity researchers have revealed that Russian military personnel are the target of a new malicious campaign that distributes Android spyware under the guise of the Alpine Quest mapping software. "The attackers hide this trojan inside modified Alpine Quest mapping software and distribute it in various ways, including through one of the Russian Android app catalogs," Doctor Web said in an "

  Autosummary: Contact lists Current date and geolocation Information about stored files, and App version Besides sending the victim"s location every time it changes to a Telegram bot, the spyware supports the ability to download and run additional modules that allow it to exfiltrate files of interest, particularly those sent via Telegram and WhatsApp. "

  ---

  Russian Hackers Exploit Microsoft OAuth to Target Ukraine Allies via Signal and WhatsApp

  exploits rusia-ucrania
  2025-04-23 https://thehackernews.com/2025/04/russian-hackers-exploit-microsoft-oauth.html
  Multiple suspected Russia-linked threat actors are "aggressively" targeting individuals and organizations with ties to Ukraine and human rights with an aim to gain unauthorized access to Microsoft 365 accounts since early March 2025. The highly targeted social engineering operations, per Volexity, are a shift from previously documented attacks that leveraged a technique known as device code "

  Autosummary: "These recently observed attacks rely heavily on one-on-one interaction with a target, as the threat actor must both convince them to click a link and send back a Microsoft-generated code," security researchers Charlie Gardner, Josh Duke, Matthew Meltzer, Sean Koessel, Steven Adair, and Tom Lancaster said in an exhaustive analysis. Volexity said it also observed an earlier iteration of the campaign that redirects users to the website "vscode-redirect.azurewebsites[.]net," which, in turn, redirects to the localhost IP address (127.0.0.1). "

  ---

  Russian army targeted by new Android malware hidden in mapping app

  exploits rusia-ucrania
  2025-04-23 https://www.bleepingcomputer.com/news/security/russian-army-targeted-by-new-android-malware-hidden-in-mapping-app/
  A new Android malware has been discovered hidden inside trojanized versions of the Alpine Quest mapping app, which is reportedly used by Russian soldiers as part of war zone operational planning. [...] "

  Autosummary: Specifically, the spyware performs the following actions: Sends the user"s phone number, contacts, geolocation, file info, and app version to attackers. "

  ---

  Hackers Abuse Russian Bulletproof Host Proton66 for Global Attacks and Malware Delivery

  exploits rusia-ucrania
  2025-04-21 https://thehackernews.com/2025/04/hackers-abuse-russian-bulletproof-host.html
  Cybersecurity researchers have disclosed a surge in "mass scanning, credential brute-forcing, and exploitation attempts" originating from IP addresses associated with a Russian bulletproof hosting service provider named Proton66. The activity, detected since January 8, 2025, targeted organizations worldwide, according to a two-part analysis published by Trustwave SpiderLabs last week.  "Net "

  Autosummary: " Trustwave"s latest analysis has revealed that the malicious requests originating from one of Proton66 net blocks (193.143.1[.]65) in February 2025 attempted to exploit some of the most recent critical vulnerabilities - CVE-2025-0108 - An authentication bypass vulnerability in the Palo Alto Networks PAN-OS software - An authentication bypass vulnerability in the Palo Alto Networks PAN-OS software CVE-2024-41713 - An insufficient input validation vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab - An insufficient input validation vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab CVE-2024-10914 - A command injection vulnerability D-Link NAS - A command injection vulnerability D-Link NAS CVE-2024-55591 & CVE-2025-24472 - Authentication bypass vulnerabilities in Fortinet FortiOS It"s worth noting that the exploitation of the two Fortinet FortiOS flaws has been attributed to an initial access broker dubbed Mora_001, which has been observed delivering a new ransomware strain called SuperBlack. "

  ---

  Chinese hackers target Russian govt with upgraded RAT malware

  exploits rusia-ucrania
  2025-04-18 https://www.bleepingcomputer.com/news/security/chinese-hackers-target-russian-govt-with-upgraded-rat-malware/
  Chinese-speaking IronHusky hackers are targeting Russian and Mongolian government organizations using upgraded MysterySnail remote access trojan (RAT) malware. [...] "

  Autosummary: "

  ---

  Paper Werewolf Deploys PowerModul Implant in Targeted Cyberattacks on Russian Sectors

  rusia-ucrania ciber
  2025-04-11 https://thehackernews.com/2025/04/paper-werewolf-deploys-powermodul.html
  The threat actor known as Paper Werewolf has been observed exclusively targeting Russian entities with a new implant called PowerModul. The activity, which took place between July and December 2024, singled out organizations in the mass media, telecommunications, construction, government entities, and energy sectors, Kaspersky said in a new report published Thursday. Paper Werewolf, also known "

  Autosummary: Some of the other payloads dropped by PowerModul are listed below - FlashFileGrabber , which is used to steal files from removable media, such as flash drives, and exfiltrate them to the C2 server , which is used to steal files from removable media, such as flash drives, and exfiltrate them to the C2 server FlashFileGrabberOffline , a variant of FlashFileGrabber that searches removable media for files with specific extensions, and when found, copies them to the local disk within the "%TEMP%\CacheStore\connect\" folder , a variant of FlashFileGrabber that searches removable media for files with specific extensions, and when found, copies them to the local disk within the "%TEMP%\CacheStore\connect\" folder USB Worm, which is capable of infecting removable media with a copy of PowerModul PowerTaskel is functionally similar to PowerModul in that it"s also designed to run PowerShell scripts sent by the C2 server. "

  ---

  Russian hackers attack Western military mission using malicious drive

  rusia-ucrania
  2025-04-10 https://www.bleepingcomputer.com/news/security/russian-hackers-attack-western-military-mission-using-malicious-drive/
  The Russian state-backed hacking group Gamaredon (aka "Shuckworm") has been targeting a military mission of a Western country in Ukraine in attacks likely deployed from removable drives. [...] "

  Autosummary: Payload stored in Registry, obfuscated and split by functions Source: Symantec The malware can steal documents (.DOC, .PDF, .XLS, .TXT) from various locations like Desktop, Documents, and Downloads, confirming Gamaredon’s continuing interest in espionage. "

  ---

  Russian bots hard at work spreading political unrest on Romania’s internet

  rusia-ucrania
  2025-04-08 https://www.bitdefender.com/en-us/blog/hotforsecurity/russian-bots-hard-at-work-spreading-political-unrest-on-romanias-internet
  Internet users in Romania are finding their social media posts and online news articles bombarded with comments promoting blatant propaganda, inciting hatred towards the EU and NATO, and support for Vladimir Putin"s Russia. Read more in my article on the Hot for Security blog. "

  Autosummary: Other observers have posted on Facebook evidence of how propaganda has been posted by thousands of accounts on Telegram groups in the form of comments claiming "Romanians are the servants of the Europeans, the EU is stealing our wealth, the authorities are against the people, Romanians must wake up and stop being cowards..." Ironically, some of the comments have been accidentally left in Russian rather than properly translated into Romanian. "

  ---

  Russian Hackers Exploit CVE-2025-26633 via MSC EvilTwin to Deploy SilentPrism and DarkWisp

  exploits rusia-ucrania
  2025-03-31 https://thehackernews.com/2025/03/russian-hackers-exploit-cve-2025-26633.html
  The threat actors behind the zero-day exploitation of a recently-patched security vulnerability in Microsoft Windows have been found to deliver two new backdoors called SilentPrism and DarkWisp. The activity has been attributed to a suspected Russian hacking group called Water Gamayun, which is also known as EncryptHub and LARVA-208. "The threat actor deploys payloads primarily by means of "

  Autosummary: Rhadamanthys is far from the only stealer in Water Gamayun"s arsenal, for it has been observed delivering another commodity stealer called StealC, as well as three custom PowerShell variants referred to as EncryptHub Stealer variant A, variant B, and variant C. The bespoke stealer is fully-featured malware that can collect extensive system information, including details about antivirus software, installed software, network adapters, and running applications. "

  ---

  Russian authorities arrest three suspects behind Mamont Android banking trojan

  financial exploits rusia-ucrania
  2025-03-28 https://securityaffairs.com/175935/cyber-crime/russian-authorities-arrest-three-suspects-behind-mamont-android-banking-trojan.html
  Russian authorities arrested three suspects for developing Mamont, a newly identified Android banking trojan. Russian authorities arrested three suspects in Saratov for developing Mamont (Russian for mammoth), a recently discovered Android banking trojan. “Three Saratov residents are suspected of fraud and unauthorized access to computer information. Officers from the fraud prevention department of PJSC Sberbank […] "

  Autosummary: Android banking trojan Pierluigi Paganini March 28, 2025 March 28, 2025 Russian authorities arrested three suspects for developing Mamont, a newly identified Android banking trojan. "

  ---

  Zero-Day Alert: Google Releases Chrome Patch for Exploit Used in Russian Espionage Attacks

  exploits rusia-ucrania
  2025-03-26 https://thehackernews.com/2025/03/zero-day-alert-google-releases-chrome.html
  Google has released out-of-band fixes to address a high-severity security flaw in its Chrome browser for Windows that it said has been exploited in the wild as part of attacks targeting organizations in Russia.  The vulnerability, tracked as CVE-2025-2783, has been described as a case of "incorrect handle provided in unspecified circumstances in Mojo on Windows." Mojo refers to a "

  Autosummary: The Russian cybersecurity vendor, in its own bulletin, characterized the zero-day exploitation of CVE-2025-2783 as a technically sophisticated targeted attack, indicative of an advanced persistent threat (APT). "

  ---

  Kaspersky Links Head Mare to Twelve, Targeting Russian Entities via Shared C2 Servers

  rusia-ucrania
  2025-03-21 https://thehackernews.com/2025/03/kaspersky-links-head-mare-to-twelve.html
  Two known threat activity clusters codenamed Head Mare and Twelve have likely joined forces to target Russian entities, new findings from Kaspersky reveal. "Head Mare relied heavily on tools previously associated with Twelve. Additionally, Head Mare attacks utilized command-and-control (C2) servers exclusively linked to Twelve prior to these incidents," the company said. "This suggests "

  Autosummary: Some of the other utilities used are quser.exe, tasklist.exe, and netstat.exe for system reconnaissance fscan and SoftPerfect Network Scanner for local network reconnaissance ADRecon for gathering information from Active Directory Mimikatz, secretsdump, and ProcDump for credential harvesting RDP for lateral movement mRemoteNG, smbexec, wmiexec, PAExec, and PsExec for remote host communication Rclone for data transfer The attacks culminate with the deployment of LockBit 3.0 and Babuk ransomware on compromised hosts, followed by dropping a note that urges victims to contact them on Telegram for decrypting their files. "

  ---

  YouTube Game Cheats Spread Arcane Stealer Malware to Russian-Speaking Users

  exploits rusia-ucrania
  2025-03-20 https://thehackernews.com/2025/03/youtube-game-cheats-spread-arcane.html
  YouTube videos promoting game cheats are being used to deliver a previously undocumented stealer malware called Arcane likely targeting Russian-speaking users. "What"s intriguing about this malware is how much it collects," Kaspersky said in an analysis. "It grabs account information from VPN and gaming clients, and all kinds of network utilities like ngrok, Playit, Cyberduck, FileZilla, and "

  Autosummary: Besides stealing login credentials, passwords, credit card data, and cookies from various Chromium- and Gecko-based browsers, Arcane is equipped to harvest comprehensive system data as well as configuration files, settings, and account information from several apps such as follows - VPN clients: OpenVPN, Mullvad, NordVPN, IPVanish, Surfshark, Proton, hidemy.name, PIA, CyberGhost, and ExpressVPN Network clients and utilities: ngrok, Playit, Cyberduck, FileZilla, and DynDNS Messaging apps: ICQ, Tox, Skype, Pidgin, Signal, Element, Discord, Telegram, Jabber, and Viber Email clients: Microsoft Outlook Gaming clients and services: Riot Client, Epic, Steam, Ubisoft Connect (ex-Uplay), Roblox, Battle.net, and various Minecraft clients Crypto wallets: Zcash, Armory, Bytecoin, Jaxx, Exodus, Ethereum, Electrum, Atomic, Guarda, and Coinomi Furthermore, Arcane is designed to take screenshots of the infected device, enumerate running processes, and list saved Wi-Fi networks and their passwords. "

  ---

  Leaked Black Basta Chats Suggest Russian Officials Aided Leader"s Escape from Armenia

  rusia-ucrania
  2025-03-19 https://thehackernews.com/2025/03/leaked-black-basta-chats-suggest.html
  The recently leaked trove of internal chat logs among members of the Black Basta ransomware operation has revealed possible connections between the e-crime gang and Russian authorities. The leak, containing over 200,000 messages from September 2023 to September 2024, was published by a Telegram user @ExploitWhispers last month. According to an analysis of the messages by cybersecurity company "

  Autosummary: "

  ---

  SilentCryptoMiner Infects 2,000 Russian Users via Fake VPN and DPI Bypass Tools

  rusia-ucrania
  2025-03-10 https://thehackernews.com/2025/03/silentcryptominer-infects-2000-russian.html
  A new mass malware campaign is infecting users with a cryptocurrency miner named SilentCryptoMiner by masquerading it as a tool designed to circumvent internet blocks and restrictions around online services. Russian cybersecurity company Kaspersky said the activity is part of a larger trend where cybercriminals are increasingly leveraging Windows Packet Divert (WPD) tools to distribute malware "

  Autosummary: " The approach has been used as part of schemes that propagate stealers, remote access tools (RATs), trojans that provide hidden remote access, and cryptocurrency miners like NJRat, XWorm, Phemedrone, and DCRat. "

  ---

  Large-scale cryptocurrency miner campaign targets Russian users with SilentCryptoMiner

  rusia-ucrania
  2025-03-10 https://securityaffairs.com/175169/breaking-news/miner-campaign-targeting-russian-users-with-silentcryptominer.html
  Experts warn of a large-scale cryptocurrency miner campaign targeting Russian users with SilentCryptoMiner. Kaspersky researchers discovered a mass malware campaign spreading SilentCryptoMiner by disguising it as a tool to bypass internet restrictions. While investigating the increased use of Windows Packet Divert (WPD) tools by crooks to distribute malware under this pretense, the researchers spotted the […] "

  Autosummary: Large-scale cryptocurrency miner campaign targets Russian users with SilentCryptoMiner Pierluigi Paganini March 10, 2025 March 10, 2025 Experts warn of a large-scale cryptocurrency miner campaign targeting Russian users with SilentCryptoMiner.Using this social engineering trick, threats like stealers, RATs, Trojans, and crypto miners can persist undetected. "

  ---

  U.S. Secret Service Seizes Russian Garantex Crypto Exchange Website

  rusia-ucrania
  2025-03-07 https://thehackernews.com/2025/03/us-secret-service-seizes-russian.html
  A coalition of international law enforcement agencies has seized the website associated with the cryptocurrency exchange Garantex ("garantex[.]org"), nearly three years after the service was sanctioned by the U.S. Treasury Department in April 2022. "The domain for Garantex has been seized by the United States Secret Service pursuant to a seizure warrant obtained by the United States Attorney"s "

  Autosummary: "

  ---

  International law enforcement operation seized the domain of the Russian crypto exchange Garantex

  rusia-ucrania
  2025-03-07 https://securityaffairs.com/175049/cyber-crime/international-law-enforcement-operation-seized-the-domain-of-the-russian-crypto-exchange-garantex.html
  The U.S. Secret Service and global law enforcement seized the domain of sanctioned Russian crypto exchange Garantex. An international law enforcement operation led by U.S. Secret Service seized the website (“garantex[.]org”) of the sanctioned Russian crypto exchange Garantex. In April 2022, the US Treasury Department sanctioned the virtual currency exchange. Garantex has been active since 2019, […] "

  Autosummary: The operation involved the U.S. DOJ, FBI, Europol, and law enforcement from Germany, the Netherlands, Finland, and Estonia. "

  ---

  CISA maintains stance on Russian cyber threats despite policy shift

  rusia-ucrania
  2025-03-04 https://securityaffairs.com/174862/intelligence/cisa-maintains-stance-on-russian-cyber-threats-despite-policy-shift.html
  US CISA confirms no change in defense against Russian cyber threats despite the Trump administration’s pause on offensive operations. US CISA stated there is no change in defending against Russian cyber threats, despite the Trump administration’s temporary pause on offensive cyber operations. US Defense Secretary Pete Hegseth has recently ordered US Cyber Command to pause […] "

  Autosummary: CISA maintains stance on Russian cyber threats despite policy shift Pierluigi Paganini March 04, 2025 March 04, 2025 US CISA confirms no change in defense against Russian cyber threats despite the Trump administration’s pause on offensive operations. "

  ---

  CISA refutes claims it has been ordered to stop monitoring Russian cyber threats

  rusia-ucrania
  2025-03-04 https://www.bitdefender.com/en-us/blog/hotforsecurity/cisa-refutes-ordered-stop-monitoring-russian-cyber-threats
  It"s been a confusing few days in the world of American cybersecurity... Read more in my article on the Hot for Security blog. "

  Autosummary: "

  ---

  Stop targeting Russian hackers, Trump administration orders US Cyber Command

  rusia-ucrania
  2025-03-03 https://www.bitdefender.com/en-us/blog/hotforsecurity/stop-targeting-russian-hackers-trump-administration-orders-us-cyber-command
  The Trump administration has told US cyber command and CISA to stop following or reporting on Russian cyber threats. Yes, Russia! That country everyone used to agree was home to lots of ransomware gangs and hackers. Hmmm... Read more in my article on the Hot for Security blog. "

  Autosummary: As The Guardian reports, recent statements from officials, including Liesyl Franz, deputy assistant secretary for international cybersecurity at the US state department, omitted any mention of Russia as a cybersecurity threat - focusing instead on China and Iran. "

  ---

  DHS says CISA will not stop monitoring Russian cyber threats

  rusia-ucrania
  2025-03-03 https://www.bleepingcomputer.com/news/security/dhs-says-cisa-will-not-stop-monitoring-russian-cyber-threats/
  The US Cybersecurity and Infrastructure Security Agency says that media reports about it being directed to no longer follow or report on Russian cyber activity are untrue, and its mission remains unchanged. [...] "

  Autosummary: "CISA"s mission is to defend against all cyber threats to U.S. Critical Infrastructure, including from Russia," the US cyber agency posted to X. "There has been no change in our posture. "

  ---

  Space Pirates Targets Russian IT Firms With New LuckyStrike Agent Malware

  exploits rusia-ucrania
  2025-02-27 https://thehackernews.com/2025/02/space-pirates-targets-russian-it-firms.html
  The threat actor known as Space Pirates has been linked to a malicious campaign targeting Russian information technology (IT) organizations with a previously undocumented malware called LuckyStrike Agent. The activity was detected in November 2024 by Solar, the cybersecurity arm of Russian state-owned telecom company Rostelecom. It"s tracking the activity under the name Erudite Mogwai. The "

  Autosummary: In one of the attacks targeting a government sector customer, Solar said it discovered the attacker deploying various tools to facilitate reconnaissance, while also dropping LuckyStrike Agent, a multi-functional .NET backdoor that uses Microsoft OneDrive for command-and-control (C2). "

  ---

  Russian phishing campaigns exploit Signal"s device-linking feature

  financial exploits rusia-ucrania
  2025-02-19 https://www.bleepingcomputer.com/news/security/russian-phishing-campaigns-exploit-signals-device-linking-feature/
  Russian threat actors have been launching phishing campaigns that exploit the legitimate "Linked Devices" feature in the Signal messaging app to gain unauthorized access to accounts of interest. [...] "

  Autosummary: “In these operations, UNC5792 has hosted modified Signal group invitations on actor-controlled infrastructure designed to appear identical to a legitimate Signal group invite” - Google Threat Intelligence Group The fake invitations had the legitimate redirect JavaScript code replaced with a malicious block that included Signal’s URI (Uniform Resource Identifier) for linking a new device (“sgnl://linkdevice uuid”) instead of the one for joining the group (“sgnl://signal.group/”). "

  ---

  US charges two Russian men in connection with Phobos ransomware operation

  exploits ransomware rusia-ucrania
  2025-02-14 https://www.bitdefender.com/en-us/blog/hotforsecurity/us-charges-russian-men-phobos-ransomware-operation
  Roman Berezhnoy and Egor Nikolaevich Glebov are alleged to have extorted over US $16 million in ransom payments using the Phobos ransomware, impacting over 1000 organisations in the United States. Read more in my article on the Hot for Security blog. "

  Autosummary: "

  ---

  Microsoft: Russian-Linked Hackers Using "Device Code Phishing" to Hijack Accounts

  financial rusia-ucrania
  2025-02-14 https://thehackernews.com/2025/02/microsoft-russian-linked-hackers-using.html
  Microsoft is calling attention to an emerging threat cluster it calls Storm-2372 that has been attributed to a new set of cyber attacks aimed at a variety of sectors since August 2024. The attacks have targeted government, non-governmental organizations (NGOs), information technology (IT) services and technology, defense, telecommunications, health, higher education, and energy/oil and gas "

  Autosummary: "

  ---

  BadPilot network hacking campaign fuels Russian SandWorm attacks

  rusia-ucrania
  2025-02-12 https://www.bleepingcomputer.com/news/security/badpilot-network-hacking-campaign-fuels-russian-sandworm-attacks/
  A subgroup of the Russian state-sponsored hacking group APT44, also known as "Seashell Blizzard" and "Sandworm", has been targeting critical organizations and governments in a multi-year campaign dubbed "BadPilot." [...] "

  Autosummary: Microsoft has observed network scans and subsequent exploitation attempts of the following vulnerabilities: CVE-2021-34473 (Microsoft Exchange) CVE-2022-41352 (Zimbra Collaboration Suite) CVE-2023-32315 (OpenFire) CVE-2023-42793 (JetBrains TeamCity) CVE-2023-23397 (Microsoft Outlook) CVE-2024-1709 (ConnectWise ScreenConnect) CVE-2023-48788 (Fortinet FortiClient EMS) After exploiting the above vulnerabilities to obtain access, the hackers established persistence by deploying custom web shells like "LocalOlive". "

  ---

  Russian cybercriminal Alexander Vinnik is being released from U.S. custody in exchange for Marc Fogel

  rusia-ucrania ciber
  2025-02-12 https://securityaffairs.com/174148/cyber-crime/russian-cybercriminal-alexander-vinnik-is-being-released-from-u-s.html
  Russian cybercriminal Alexander Vinnik is being released from U.S. custody in exchange for Marc Fogel, a Trump administration source told CNN. The New York Times first reported that Alexander Vinnik, a Russian money laundering suspect, is being released from U.S. custody in exchange for Marc Fogel, according to a Trump administration source. Alexander Vinnik, a […] "

  Autosummary: The virtual currency exchange received criminal proceeds from various illegal activities, including computer intrusions, ransomware attacks, identity theft, corruption, and drug distribution. Subsequently, Vinnik returned to Greece before being extradited to the U.S.. “Today’s result shows how the Justice Department, working with international partners, reaches across the globe to combat cryptocrime,” said Deputy Attorney General Lisa Monaco. "

  ---

  Russian military hackers deploy malicious Windows activators in Ukraine

  rusia-ucrania
  2025-02-11 https://www.bleepingcomputer.com/news/security/russian-military-hackers-deploy-malicious-windows-activators-in-ukraine/
  The Sandworm Russian military cyber-espionage group is targeting Windows users in Ukraine with trojanized Microsoft Key Management Service (KMS) activators and fake Windows updates. [...] "

  Autosummary: "

  ---

  HPE notifies employees of data breach after Russian Office 365 hack

  financial rusia-ucrania
  2025-02-07 https://www.bleepingcomputer.com/news/security/hpe-notifies-employees-of-data-breach-after-russian-office-365-hack/
  Hewlett Packard Enterprise (HPE) is notifying employees whose data was stolen from the company"s Office 365 email environment by Russian state-sponsored hackers in a May 2023 cyberattack. [...] "

  Autosummary: " The group behind the attack, Cozy Bear (also known as Midnight Blizzard, APT29, and Nobelium), is believed to be part of Russia"s Foreign Intelligence Service (SVR) and has also been linked to other high-profile breaches, including the infamous 2020 SolarWinds supply chain attack. "

  ---

  Russian cybercrooks exploiting 7-Zip zero-day vulnerability (CVE-2025-0411)

  exploits rusia-ucrania
  2025-02-04 https://www.helpnetsecurity.com/2025/02/04/russian-cybercrooks-exploited-7-zip-zero-day-vulnerability-cve-2025-0411/
  

  CVE-2025-0411, a Mark-of-the-Web bypass vulnerability in the open-source archiver tool 7-Zip that was fixed in November 2024, has been exploited in zero-day attacks to deliver malware to Ukrainian entities, Trend Micro researchers have revealed. The 7-Zip vulnerability (CVE-2025-0411) Mark-of-the-Web (MotW) is a zone identifier used by the Windows operating system to flag files downloaded from the internet as potentially harmful. “CVE-2025-0411 allows threat actors to bypass Windows MoTW protections by double archiving contents using 7-Zip. … More →

  The post Russian cybercrooks exploiting 7-Zip zero-day vulnerability (CVE-2025-0411) appeared first on Help Net Security.

  "

  Autosummary: CVE-2025-0411, a Mark-of-the-Web bypass vulnerability in the open-source archiver tool 7-Zip that was fixed in November 2024, has been exploited in zero-day attacks to deliver malware to Ukrainian entities, Trend Micro researchers have revealed. "

  ---

  Russian Cybercrime Groups Exploiting 7-Zip Flaw to Bypass Windows MotW Protections

  exploits rusia-ucrania
  2025-02-04 https://thehackernews.com/2025/02/russian-cybercrime-groups-exploiting-7.html
  A recently patched security vulnerability in the 7-Zip archiver tool was exploited in the wild to deliver the SmokeLoader malware. The flaw, CVE-2025-0411 (CVSS score: 7.0), allows remote attackers to circumvent mark-of-the-web (MotW) protections and execute arbitrary code in the context of the current user. It was addressed by 7-Zip in November 2024 with version 24.09. "The vulnerability was "

  Autosummary: The flaw, CVE-2025-0411 (CVSS score: 7.0), allows remote attackers to circumvent mark-of-the-web (MotW) protections and execute arbitrary code in the context of the current user. "

  ---

  E.U. Sanctions 3 Russian Nationals for Cyber Attacks Targeting Estonia’s Key Ministries

  rusia-ucrania
  2025-01-28 https://thehackernews.com/2025/01/eu-sanctions-3-russian-nationals-for.html
  The Council of the European Union has sanctioned three individuals for allegedly carrying out "malicious cyber activities" against Estonia. The three Russian nationals – Nikolay Alexandrovich Korchagin, Vitaly Shevchenko, and Yuriy Fedorovich Denisov – are officers of the General Staff of the Armed Forces of the Russian Federation (GRU) Unit 29155, it said. Per the council decision, all the "

  Autosummary: "

  ---

  GamaCopy Mimics Gamaredon Tactics in Cyber Espionage Targeting Russian Entities

  industry rusia-ucrania
  2025-01-27 https://thehackernews.com/2025/01/gamacopy-mimics-gamaredon-tactics-in.html
  A previously unknown threat actor has been observed copying the tradecraft associated with the Kremlin-aligned Gamaredon hacking group in its cyber attacks targeting Russian-speaking entities. The campaign has been attributed to a threat cluster dubbed GamaCopy, which is assessed to share overlaps with another hacking group named Core Werewolf, also tracked as Awaken Likho and PseudoGamaredon. "

  Autosummary: "

  ---

  EU sanctions Russian GRU hackers for cyberattacks against Estonia

  rusia-ucrania ciber
  2025-01-27 https://www.bleepingcomputer.com/news/security/eu-sanctions-russian-gru-hackers-for-cyberattacks-against-estonia/
  The European Union sanctioned three hackers, part of Unit 29155 of Russia"s military intelligence service (GRU), for their involvement in cyberattacks targeting Estonia"s government agencies in 2020. [...] "

  Autosummary: "

  ---

  How Russian hackers went after NGOs’ WhatsApp accounts

  rusia-ucrania
  2025-01-17 https://www.helpnetsecurity.com/2025/01/17/star-blizzard-whatsapp-phishing-ngos/
  

  Star Blizzard, a threat actor tied to the Russian Federal Security Service (FSB), was spotted attempting to compromise targets’ WhatsApp accounts through a clever phishing campaign. The campaign The campaign started with a spear-phishing email that was made to look like it was sent by a US government official. “We have established a private WhatsApp group to facilitate discussions regarding the latest non-govermental initiatives aimed at supporting Ukraine. This platform will also serve as a … More →

  The post How Russian hackers went after NGOs’ WhatsApp accounts appeared first on Help Net Security.

  "

  Autosummary: The spoofed WhatsApp page, with the QR code obscured (Source: Microsoft Threat Intelligence) “However, this QR code is actually used by WhatsApp to connect an account to a linked device and/or the WhatsApp Web portal,” Microsoft’s threat analysts explained. "

  ---

  Russian Star Blizzard Shifts Tactics to Exploit WhatsApp QR Codes for Credential Harvesting

  exploits industry rusia-ucrania financial
  2025-01-16 https://thehackernews.com/2025/01/russian-star-blizzard-shifts-tactics-to.html
  The Russian threat actor known as Star Blizzard has been linked to a new spear-phishing campaign that targets victims" WhatsApp accounts, signaling a departure from its longstanding tradecraft in a likely attempt to evade detection. "Star Blizzard"s targets are most commonly related to government or diplomacy (both incumbent and former position holders), defense policy or international relations "

  Autosummary: Active since at least 2012, it"s also tracked under the monikers Blue Callisto, BlueCharlie (or TAG-53), Calisto (alternately spelled Callisto), COLDRIVER, Dancing Salome, Gossamer Bear, Iron Frontier, TA446, and UNC4057. "

  ---

  Russian-Linked Hackers Target Kazakhstan in Espionage Campaign with HATVIBE Malware

  exploits rusia-ucrania
  2025-01-14 https://thehackernews.com/2025/01/russian-linked-hackers-target.html
  Russia-linked threat actors have been attributed to an ongoing cyber espionage campaign targeting Kazakhstan as part of the Kremlin"s efforts to gather economic and political intelligence in Central Asia. The campaign has been assessed to be the work of an intrusion set dubbed UAC-0063, which likely shares overlap with APT28, a nation-state group affiliated with Russia"s General Staff Main "

  Autosummary: It"s also known as Blue Athena, BlueDelta, Fancy Bear, Fighting Ursa, Forest Blizzard, FROZENLAKE, Iron Twilight, ITG05, Pawn Storm, Sednit, Sofacy, and TA422. "

  ---

  DoJ Indicts Three Russians for Operating Crypto Mixers Used in Cybercrime Laundering

  rusia-ucrania
  2025-01-11 https://thehackernews.com/2025/01/doj-indicts-three-russians-for.html
  The U.S. Department of Justice (DoJ) on Friday indicted three Russian nationals for their alleged involvement in operating the cryptocurrency mixing services Blender.io and Sinbad.io. Roman Vitalyevich Ostapenko and Alexander Evgenievich Oleynik were arrested on December 1, 2024, in coordination with the Netherlands" Financial Intelligence and Investigative Service, Finland"s National Bureau of "

  Autosummary: "Additionally, in the advertisement, Blender was described as not requiring users to sign up, register, or "provide any kind of detail except the receiving address!"" It"s also accused of facilitating money laundering for Russia-aligned ransomware gangs like TrickBot, Conti (formerly Ryuk), Sodinokibi (aka REvil), and Gandcrab. "

  ---

  DoJ charged three Russian citizens with operating crypto-mixing services

  rusia-ucrania
  2025-01-11 https://securityaffairs.com/172957/cyber-crime/doj-charged-russian-citizens-with-operating-crypto-mixing-services.html
  The U.S. Department of Justice charged three Russian citizens with operating crypto-mixing services that helped crooks launder cryptocurrency. The U.S. Department of Justice (DoJ) charged Russian national Roman Vitalyevich Ostapenko, Alexander Evgenievich Oleynik, and Anton Vyachlavovich Tarasov with operating crypto-mixing services Blender.io and Sinbad.io that helped crooks launder cryptocurrency. Roman Vitalyevich Ostapenko and Alexander Evgenievich […] "

  Autosummary: DoJ charged three Russian citizens with operating crypto-mixing services Pierluigi Paganini January 11, 2025 January 11, 2025 The U.S. Department of Justice charged three Russian citizens with operating crypto-mixing services that helped crooks launder cryptocurrency. "

  ---

  Banshee Stealer variant targets Russian-speaking macOS users

  rusia-ucrania
  2025-01-09 https://www.helpnetsecurity.com/2025/01/09/banshee-stealer-variant-targets-russian-speaking-macos-users/
  

  The Banshee Stealer is a stealthy threat to the rising number of macOS users around the world, including those in Russian-speaking countries, according to Check Point researcher Antonis Terefos. Banshee Stealer was first publicly profiled in August 2024, a month after its developer began selling it as-a-Service for the high price of $3,000 per month. The malware is capable of functioning across both macOS x86_64 and ARM64 architectures, and can capture / steal credentials and … More →

  The post Banshee Stealer variant targets Russian-speaking macOS users appeared first on Help Net Security.

  "

  Autosummary: But even after the leak, the threat persists: Check Point has identified multiple campaigns still distributing the malware through phishing websites, ostensibly offering popular software (Telegram, TradingView, Parallels, etc.) for download. "

  ---

  Ukrainian Cyber Alliance destroyed the connectivity of Russian ISP Nodex

  rusia-ucrania
  2025-01-09 https://securityaffairs.com/172864/hacktivism/ukrainian-cyber-alliance-destroyed-russian-isp-nodex.html
  A group of hacktivists, known as the Ukrainian Cyber Alliance, breached Russian ISP Nodex, stole sensitive documents, and wiped systems. Ukrainian Cyber Alliance hacked Russian ISP Nodex, stole sensitive data, and wiped systems, highlighting their cyberattack capabilities. The Ukrainian Cyber Alliance has been active since 2016, the Pro-Ukraine group has targeted Russian entities since the […] "

  Autosummary: Ukrainian Cyber Alliance destroyed the connectivity of Russian ISP Nodex Pierluigi Paganini January 09, 2025 January 09, 2025 A group of hacktivists, known as the Ukrainian Cyber Alliance, breached Russian ISP Nodex, stole sensitive documents, and wiped systems. "

  ---

  Russian ISP confirms Ukrainian hackers "destroyed" its network

  rusia-ucrania
  2025-01-08 https://www.bleepingcomputer.com/news/security/russian-isp-confirms-ukrainian-hackers-destroyed-its-network/
  Russian internet service provider Nodex confirmed on Tuesday that its network was "destroyed" in a cyberattack claimed by Ukrainian hacktivists part of the Ukrainian Cyber Alliance [...] "

  Autosummary: Since then, UCA cyber activists have claimed many breaches impacting various Russian organizations, including the Russian Ministry of Defense​​​​​, Commonwealth of Independent States Institute (financed by the Russian state company Gazprom), the Donetsk People"s Republic"s Ministry of Coal and Energy, Vladimir Putin"s political adviser Vladislav Surkov, and multiple Russian military officers and media outlets, among others. "

  ---

  Three Russian-German Nationals Charged with Espionage for Russian Secret Service

  rusia-ucrania
  2025-01-02 https://thehackernews.com/2025/01/three-russian-german-nationals-charged.html
  German prosecutors have charged three Russian-German nationals for acting as secret service agents for Russia. The individuals, named Dieter S., Alexander J., and Alex D., have been accused of working for a foreign secret service. Dieter S. is also alleged to have participated in sabotage operations as well as taking pictures of military installations with an aim to endanger national security. "

  Autosummary: "Dieter S. scouted out some of the targeted objects on site, taking photos and videos, for example of military transports and goods," prosecutors said, adding the intelligence information was then passed on to his contact. "

  ---

  Three Russian-German nationals charged with suspicion of secret service agent activity

  rusia-ucrania
  2025-01-02 https://securityaffairs.com/172559/intelligence/russian-german-nationals-charged-secret-service-agent-activity.html
  German authorities have charged three Russian-German nationals with suspicion of, among other things, secret service agent activity for the Russian government. German authorities have charged three Russian-German nationals on suspicion of activities including acting as secret service agents for the Russian government. On 9 December 2024, the Federal Prosecutor’s Office filed charges against the German-Russian nationals before […] "

  Autosummary: Three Russian-German nationals charged with suspicion of secret service agent activity Pierluigi Paganini January 02, 2025 January 02, 2025 German authorities have charged three Russian-German nationals with suspicion of, among other things, secret service agent activity for the Russian government. "

  ---

  Russian media outlets Telegram channels blocked in European countries

  rusia-ucrania
  2025-01-02 https://securityaffairs.com/172565/security/russian-media-outlets-telegram-channels-blocked-in-eu.html
  Telegram restricted access to Russian state-owned news channels in several European countries, including Poland, France, and Italy. Telegram blocked access to channels of multiple Russian state-owned news outlets across Europe, including Italy, Poland, Czechia, Belgium, France, the Netherlands, Greece, and Latvia. Some blocked Russian media outlets are RIA Novosti, NTV, Rossiya 1, and Rossiyskaya Gazeta.  Visitors are presented with […] "

  Autosummary: "

  ---

  Iranian and Russian Entities Sanctioned for Election Interference Using AI and Cyber Tactics

  industry rusia-ucrania
  2025-01-01 https://thehackernews.com/2025/01/iranian-and-russian-entities-sanctioned.html
  The U.S. Treasury Department"s Office of Foreign Assets Control (OFAC) on Tuesday leveled sanctions against two entities in Iran and Russia for their attempts to interfere with the November 2024 presidential election. The federal agency said the entities – a subordinate organization of Iran"s Islamic Revolutionary Guard Corps and a Moscow-based affiliate of Russia"s Main Intelligence "

  Autosummary: In August 2024, the Office of the Director of National Intelligence (ODNI), the Federal Bureau of Investigation (FBI), and the Cybersecurity and Infrastructure Security Agency (CISA) jointly accused Iran of attempting to undermine democratic processes, including by orchestrating cyber operations designed to gain access to sensitive information related to the elections. "

  ---

  U.S. Treasury sanctions Russian and Iranian entities for interfering in the presidential election

  rusia-ucrania
  2025-01-01 https://securityaffairs.com/172520/laws-and-regulations/u-s-treasury-sanctioned-russia-and-iran-entities-for-disinformation.html
  The U.S. Treasury sanctioned entities for disinformation tied to Russian and Iranian intelligence before the 2024 presidential elections. The U.S. Treasury sanctioned entities for spreading disinformation linked to Russian and Iranian intelligence ahead of the 2024 presidential elections. The U.S. Treasury sanctioned Moscow’s Center for Geopolitical Expertise (CGE), founded by OFAC-designated Aleksandr Dugin, for spreading disinformation and […] "

  Autosummary: “At the direction of, and with financial support from, the GRU, CGE and its personnel used generative AI tools to quickly create disinformation that would be distributed across a massive network of websites designed to imitate legitimate news outlets to create false corroboration between the stories, as well as to obfuscate their Russian origin.” "

  ---

  US charged Dual Russian and Israeli National as LockBit Ransomware developer

  exploits ransomware rusia-ucrania
  2024-12-22 https://securityaffairs.com/172201/uncategorized/us-authorities-charged-lockbit-ransomware-developer.html
  US authorities charged a dual Russian and Israeli national for being a developer of the LockBit ransomware group. Rostislav Panev, 51, a dual Russian-Israeli national, was charged as a LockBit ransomware developer. Arrested in Israel, he awaits extradition to the U.S. Panev was arrested in Israel in August and is awaiting extradition to the U.S. […] "

  Autosummary: “As alleged in the superseding complaint, at the time of Panev’s arrest in Israel in August, law enforcement discovered on Panev’s computer administrator credentials for an online repository that was hosted on the dark web and stored source code for multiple versions of the LockBit builder, which allowed LockBit’s affiliates to generate custom builds of the LockBit ransomware malware for particular victims. "

  ---

  US charges Russian-Israeli as suspected LockBit ransomware coder

  exploits ransomware rusia-ucrania
  2024-12-20 https://www.bleepingcomputer.com/news/security/us-charges-russian-israeli-as-suspected-lockbit-ransomware-coder/
  The US Department of Justice has charged a Russian-Israeli dual-national for his suspected role in developing malware and managing the infrastructure for the notorious LockBit ransomware group. [...] "

  Autosummary: "As alleged in the superseding complaint, at the time of Panev"s arrest in Israel in August, law enforcement discovered on Panev"s computer administrator credentials for an online repository that was hosted on the dark web and stored source code for multiple versions of the LockBit builder, which allowed LockBit"s affiliates to generate custom builds of the LockBit ransomware malware for particular victims," reads the complaint. "

  ---

  Russian hackers use RDP proxies to steal data in MiTM attacks

  rusia-ucrania
  2024-12-18 https://www.bleepingcomputer.com/news/security/russian-hackers-use-rdp-proxies-to-steal-data-in-mitm-attacks/
  The Russian hacking group tracked as APT29 (aka "Midnight Blizzard") is using a network of 193 remote desktop protocol proxy servers to perform man-in-the-middle (MiTM) attacks to steal data and credentials and to install malicious payloads. [...] "

  Autosummary: The domain names registered for the campaign suggest that APT29 targeted entities primarily in the U.S., France, Australia, Ukraine, Portugal, Germany, Israel, France, Greece, Turkey, and the Netherlands. "

  ---

  Ukrainian Minors Recruited for Cyber Ops and Reconnaissance in Russian Airstrikes

  rusia-ucrania
  2024-12-16 https://thehackernews.com/2024/12/ukrainian-minors-recruited-for-cyber.html
  The Security Service of Ukraine (SBU or SSU) has exposed a novel espionage campaign suspected to be orchestrated by Russia"s Federal Security Service (FSB) that involves recruiting Ukrainian minors for criminal activities under the guise of "quest games." Law enforcement officials said that it detained two FSB agent groups following a special operation in Kharkiv. These groups, per the agency, "

  Autosummary: "

  ---

  Russian cyberspies target Android users with new spyware

  rusia-ucrania
  2024-12-13 https://www.bleepingcomputer.com/news/security/russian-gamaredon-cyberspies-target-android-users-with-new-spyware/
  Russian cyberspies Gamaredon has been discovered using two Android spyware families named "BoneSpy" and "PlainGnome" to spy on and steal data from mobile devices. [...] "

  Autosummary: Impersonating the Samsung Knox Manager Source: BleepingComputer Lookout says development work on BoneSpy peaked between January and October 2022, stabilizing to the following capabilities: Collects SMS messages, including sender, content, and timestamps Records ambient audio and phone call conversations Captures GPS and cell-based location data Takes pictures using the camera and captures device screenshots Accesses user"s web browsing history Extracts names, numbers, emails, and call details from the contact list and call logs Accesses clipboard content Reads device notifications PlainGnome is a newer, custom Android surveillance malware that does not use the codebase of a previously known project. "

  ---

  Russian cyberspies target Android users with new spyware

  rusia-ucrania
  2024-12-13 https://www.bleepingcomputer.com/news/security/russian-cyberspies-target-android-users-with-new-spyware/
  Russian cyberspies Gamaredon has been discovered using two Android spyware families named "BoneSpy" and "PlainGnome" to spy on and steal data from mobile devices. [...] "

  Autosummary: Impersonating the Samsung Knox Manager Source: BleepingComputer Lookout says development work on BoneSpy peaked between January and October 2022, stabilizing to the following capabilities: Collects SMS messages, including sender, content, and timestamps Records ambient audio and phone call conversations Captures GPS and cell-based location data Takes pictures using the camera and captures device screenshots Accesses user"s web browsing history Extracts names, numbers, emails, and call details from the contact list and call logs Accesses clipboard content Reads device notifications PlainGnome is a newer, custom Android surveillance malware that does not use the codebase of a previously known project. "

  ---

  Russian cyber spies hide behind other hackers to target Ukraine

  rusia-ucrania
  2024-12-11 https://www.bleepingcomputer.com/news/security/russian-cyber-spies-hide-behind-other-hackers-to-target-ukraine/
  Russian cyber-espionage group Turla, aka "Secret Blizzard," is utilizing other threat actors" infrastructure to target Ukrainian military devices connected via Starlink. [...] "

  Autosummary: One of the tools Tavdig loads on compromised devices is KazuarV2, Turla"s more advanced, stealthy backdoor, designed for long-term intelligence collection, command execution, and data exfiltration. "

  ---

  RedLine info-stealer campaign targets Russian businesses through pirated corporate software

  rusia-ucrania
  2024-12-08 https://securityaffairs.com/171771/cyber-crime/redline-info-stealer-campaign-targets-russian-businesses.html
  An ongoing RedLine information-stealing campaign is targeting Russian businesses using pirated corporate software. Since January 2024, Russian businesses using unlicensed software have been targeted by an ongoing RedLine info-stealer campaign. Pirated software is distributed via Russian online forums, attackers disguise the malware as a tool to bypass licensing for business automation software. Threat actors target […] "

  Autosummary: RedLine info-stealer campaign targets Russian businesses through pirated corporate software Pierluigi Paganini December 08, 2024 December 08, 2024 An ongoing RedLine information-stealing campaign is targeting Russian businesses using pirated corporate software. "

  ---

  Romania Cancels Presidential Election Results After Alleged Russian Meddling on TikTok

  rusia-ucrania
  2024-12-07 https://thehackernews.com/2024/12/romania-cancels-presidential-election.html
  In a historic decision, Romania"s constitutional court has annulled the result of the first round of voting in the presidential election amid allegations of Russian interference. As a result, the second round vote, which was scheduled for December 8, 2024, will no longer take place. Călin Georgescu, who won the first round, denounced the verdict as an "officialized coup" and an attack on "

  Autosummary: " The European Commission, in a press statement on Thursday, said it has stepped up its monitoring of TikTok, urging the platform to "freeze and preserve data related to actual or foreseeable systemic risks its service could pose on electoral processes and civic discourse in the E.U." To that end, it has been asked to retain internal documents and information regarding the design and functioning of its recommender systems, in addition to details on how it"s addressing the risk of intentional manipulation through a technique called coordinated inauthentic behavior (CIB). "

  ---

  Russia’s FSB used spyware against a Russian programmer

  rusia-ucrania
  2024-12-07 https://securityaffairs.com/171767/malware/russias-fsb-used-spyware-against-a-russian-programmer.html
  Russia’s FSB used spyware against a Russian programmer after detaining him for allegedly donating to Ukraine earlier this year. The Federal Security Service (FSB) used spyware to monitor a Russian programmer, Kirill Parubets, after he was detained earlier this year for allegedly donating to Ukraine. Researchers from the First Department and the Citizen Lab discovered that the […] "

  Autosummary: Moreover, the spyware retains some permissions also found in the genuine app, such as precise location tracking, recording phone calls, and accessing contact information, which are common functionalities in many spyware tools.Its functionality includes location tracking, screen capture, keylogging, call recording, file extraction, password retrieval, and reading messages from other apps. "

  ---

  FSB Uses Trojan App to Monitor Russian Programmer Accused of Supporting Ukraine

  exploits rusia-ucrania
  2024-12-06 https://thehackernews.com/2024/12/fsb-uses-trojan-app-to-monitor-russian.html
  A Russian programmer accused of donating money to Ukraine had his Android device secretly implanted with spyware by the Federal Security Service (FSB) after he was detained earlier this year. The findings come as part of a collaborative investigation by First Department and the University of Toronto"s Citizen Lab. "The spyware placed on his device allows the operator to track a target device"s "

  Autosummary: " The second stage incorporates features to log keystrokes, extract files and stored passwords, read chats from other messaging apps, inject JavaScript, execute shell commands, obtain the device unlock password, and even add a new device administrator. "

  ---

  NCA Busts Russian Crypto Networks Laundering Funds and Evading Sanctions

  rusia-ucrania
  2024-12-05 https://thehackernews.com/2024/12/nca-busts-russian-crypto-networks.html
  The U.K. National Crime Agency (NCA) on Wednesday announced that it led an international investigation to disrupt Russian money laundering networks that were found to facilitate serious and organized crime across the U.K., the Middle East, Russia, and South America. The effort, codenamed Operation Destabilise, has resulted in the arrest of 84 suspects linked to two Russian-speaking networks "

  Autosummary: The TGR Group is said to provide a wide range of illegal financial services, including laundering funds belonging to sanctioned entities, an unregistered service to exchange cash and cryptocurrency, accepting cash receipts and converting them into digital assets for clients, a prepaid credit card service, and concealing the source of funds to allow Russian elites to purchase property in the U.K. The NCA noted that the Smart network was used to fund Russian espionage operations between late 2022 to summer 2023. "

  ---

  New Android spyware found on phone seized by Russian FSB

  rusia-ucrania
  2024-12-05 https://www.bleepingcomputer.com/news/security/new-android-spyware-found-on-phone-seized-by-russian-fsb/
  After a Russian programmer was detained by Russia"s Federal Security Service (FSB) for fifteen days and his phone confiscated, it was discovered that a new spyware was secretly installed on his device upon its return. [...] "

  Autosummary: "

  ---

  Russian money-laundering network linked to drugs and ransomware disrupted, 84 arrests

  financial exploits ransomware rusia-ucrania
  2024-12-05 https://www.tripwire.com/state-of-security/money-laundering-network-linked-drugs-and-ransomware-disrupted
  The UK"s National Crime Agency (NCA) has revealed details of Operation Destabilise, a years-long international law enforcement investigation into a giant Russian money laundering enterprise that handled billions of dollars for drug traffickers and ransomware gangs worldwide. Read more in my article on the Tripwire State of Security blog. "

  Autosummary: Led by the National Crime Agency working with Border Force, Op Destabilise has exposed Russian kleptocrats, drug gangs, and cyber criminals - all of whom relied on the flow of dirty money," said Security Minister Dan Jarvis. "

  ---

  Operation Destabilise dismantled Russian money laundering networks

  financial rusia-ucrania
  2024-12-05 https://securityaffairs.com/171710/cyber-crime/operation-destabilise-anti-money-laundering.html
  Operation Destabilise: The U.K. National Crime Agency disrupted Russian money laundering networks tied to organized crime. The U.K. National Crime Agency (NCA) disrupted Russian money laundering networks linked to organized crime across the U.K., Middle East, Russia, and South America as part of an operation called “Operation Destabilise.” “An international NCA-led investigation – Operation Destabilise […] "

  Autosummary: “Through the TGR Group, Russian elites sought to exploit digital assets—in particular U.S. dollar-backed stablecoins—to evade U.S. and international sanctions, further enriching themselves and the Kremlin,” said Acting Under Secretary for Terrorism and Financial Intelligence Bradley T. Smith, “The United States, alongside our allies and partners, remains committed to disrupting any effort by Russia to use digital assets or other illicit financial schemes to accrue, store, and transfer their ill-gotten gains.” “Through key facilitators like Zhdanova, Russian elites, ransomware groups, and other illicit actors sought to evade U.S. and international sanctions, particularly through the abuse of virtual currency,” said Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian E. Nelson. "

  ---

  Russian hackers hijack Pakistani hackers" servers for their own attacks

  rusia-ucrania
  2024-12-04 https://www.bleepingcomputer.com/news/security/russian-turla-hackers-hijack-pakistani-apt-servers-for-cyber-espionage-attacks/
  The notorious Russian cyber-espionage group Turla is hacking other hackers, hijacking the Pakistani threat actor Storm-0156"s infrastructure to launch their own covert attacks on already compromised networks. [...] "

  Autosummary: At the same time, Turla stole data from OilRig"s systems, including keylogger logs, directory listings, files, account credentials, and malware builders for private tools such as Neuron. It was determined that in late 2022, Turla had breached multiple C2 nodes of the Storm-0156 threat actor and deployed their own malware payloads, including a TinyTurla backdoor variant, the TwoDash backdoor, the Statuezy clipboard monitor, and the MiniPocket downloader. "

  ---

  UK disrupts Russian money laundering networks used by ransomware

  financial exploits ransomware rusia-ucrania
  2024-12-04 https://www.bleepingcomputer.com/news/security/uk-disrupts-russian-money-laundering-networks-used-by-ransomware/
  ​A law enforcement operation led by the United Kingdom"s National Crime Agency (NCA) has disrupted two Russian money laundering networks working with criminals worldwide, including ransomware gangs. [...] "

  Autosummary: As part of this Operation Destabilise, U.K. law enforcement has collaborated with many international partners, including the U.S. Department of the Treasury"s Office of Foreign Assets Control (OFAC), the FBI, the Drug Enforcement Agency, the French Direction Centrale de la Police Judiciaire, and Ireland"s national police and security service, An Garda Síochána (AGS). "

  ---

  Russian hackers hijack Pakistani hackers" servers for their own attacks

  rusia-ucrania
  2024-12-04 https://www.bleepingcomputer.com/news/security/russian-hackers-hijack-pakistani-hackers-servers-for-their-own-attacks/
  The notorious Russian cyber-espionage group Turla is hacking other hackers, hijacking the Pakistani threat actor Storm-0156"s infrastructure to launch their own covert attacks on already compromised networks. [...] "

  Autosummary: At the same time, Turla stole data from OilRig"s systems, including keylogger logs, directory listings, files, account credentials, and malware builders for private tools such as Neuron. It was determined that in late 2022, Turla had breached multiple C2 nodes of the Storm-0156 threat actor and deployed their own malware payloads, including a TinyTurla backdoor variant, the TwoDash backdoor, the Statuezy clipboard monitor, and the MiniPocket downloader. "

  ---

  North Korean Kimsuky Hackers Use Russian Email Addresses for Credential Theft Attacks

  rusia-ucrania
  2024-12-03 https://thehackernews.com/2024/12/north-korean-kimsuky-hackers-use.html
  The North Korea-aligned threat actor known as Kimsuky has been linked to a series of phishing attacks that involve sending email messages that originate from Russian sender addresses to ultimately conduct credential theft. "Phishing emails were sent mainly through email services in Japan and Korea until early September," South Korean cybersecurity company Genians said. "Then, from mid-September, "

  Autosummary: "

  ---

  Wanted Russian Cybercriminal Linked to Hive and LockBit Ransomware Has Been Arrested

  exploits ransomware rusia-ucrania ciber
  2024-11-30 https://thehackernews.com/2024/11/wanted-russian-cybercriminal-linked-to.html
  A Russian cybercriminal wanted in the U.S. in connection with LockBit and Hive ransomware operations has been arrested by law enforcement authorities in the country. According to a news report from Russian media outlet RIA Novosti, Mikhail Pavlovich Matveev has been accused of developing a malicious program designed to encrypt files and seek ransom in return for a decryption key. "At present, "

  Autosummary: "

  ---

  Russian group RomCom exploited Firefox and Tor Browser zero-days to target attacks Europe and North America

  exploits rusia-ucrania
  2024-11-27 https://securityaffairs.com/171443/apt/russia-romcom-group-firefox-tor-browser-zero-day.html
  The Russian RomCom group exploited Firefox and Tor Browser zero-day vulnerabilities in attacks on users in Europe and North America. Russian-based cybercrime group RomCom (aka UAT-5647, Storm-0978, Tropical Scorpius, UAC-0180, UNC2596) exploited two Firefox and Tor Browser zero-day vulnerabilities in recent attacks on users across Europe and North America. The first zero-day exploited by the Russian group, is a use-after-free […] "

  Autosummary: Russian-based cybercrime group RomCom (aka UAT-5647, Storm-0978, Tropical Scorpius, UAC-0180, UNC2596) exploited two Firefox and Tor Browser zero-day vulnerabilities in recent attacks on users across Europe and North America. "

  ---

  Firefox and Windows zero-days exploited by Russian RomCom hackers

  exploits rusia-ucrania
  2024-11-26 https://www.bleepingcomputer.com/news/security/firefox-and-windows-zero-days-exploited-by-russian-romcom-hackers/
  ​Russian-based RomCom cybercrime group chained two zero-day vulnerabilities in recent attacks targeting Firefox and Tor Browser users across Europe and North America. [...] "

  Autosummary: While investigating this campaign, ESET found that the Russian threat actors focused their attacks on organizations in Ukraine, Europe, and North America from various industries affected, including government, defense, energy, pharmaceuticals, and insurance. "

  ---

  Faraway Russian hackers breached US organization via Wi-Fi

  rusia-ucrania
  2024-11-25 https://www.helpnetsecurity.com/2024/11/25/enterprise-wi-fi-compromised/
  

  Forest Blizzard, a threat group associated with Russia’s GRU military intelligence service, repeatedly breached a US-based organization via compromised computer systems of nearby firms, which they leveraged to authenticate to the target’s enterprise Wi-Fi network. The repeated attacks Volexity, a company that specializes in helping organizations detect the presence of and boot out nation-state level intruders from their systems and networks, said that the attackers were first spotted on a server on the target US … More →

  The post Faraway Russian hackers breached US organization via Wi-Fi appeared first on Help Net Security.

  "

  Autosummary: They solved the problem by: Breaching a nearby organization’s system Moving laterally within that organization to find accessible systems that are connected to the network via a wired Ethernet connection and have a Wi-Fi adapter Using that Wi-Fi adapter to connect to the target organization’s Wi-Fi and authenticate to it by using credentials they previous compromised via password spraying. "

  ---

  Russian Hackers Deploy HATVIBE and CHERRYSPY Malware Across Europe and Asia

  exploits rusia-ucrania
  2024-11-22 https://thehackernews.com/2024/11/russian-hackers-deploy-hatvibe-and.html
  Threat actors with ties to Russia have been linked to a cyber espionage campaign aimed at organizations in Central Asia, East Asia, and Europe. Recorded Future"s Insikt Group, which has assigned the activity cluster the name TAG-110, said it overlaps with a threat group tracked by the Computer Emergency Response Team of Ukraine (CERT-UA) as UAC-0063, which, in turn, overlaps with APT28. The "

  Autosummary: " Russia is also believed to have ramped up its sabotage operations across European critical infrastructure following its full-scale invasion of Ukraine in February 2022, targeting Estonia, Finland, Latvia, Lithuania, Norway, and Poland with the goal of destabilizing NATO allies and disrupting their support for Ukraine. "

  ---

  Russian Phobos ransomware operator faces cybercrime charges

  exploits ransomware rusia-ucrania
  2024-11-19 https://securityaffairs.com/171184/cyber-crime/phobos-ransomware-operator-faces-cybercrime-charges.html
  Russian Phobos ransomware operator Evgenii Ptitsyn, accused of managing attacks, was extradited from South Korea to the US to face cybercrime charges. Russian Phobos ransomware operator Evgenii Ptitsyn, suspected of playing a key role in the ransomware operations, was extradited from South Korea to the US to face cybercrime charges. According to the DoJ, the […] "

  Autosummary: According to the DoJ, the Phobos ransomware operation targeted over 1,000 public and private entities in the United States and worldwide, extorting more than $16 million in ransom payments “The Justice Department unsealed criminal charges today against Evgenii Ptitsyn, 42, a Russian national, for allegedly administering the sale, distribution, and operation of Phobos ransomware.” "

  ---

  Seven-year-old gets job offer from Russian IT firm

  rusia-ucrania
  2024-11-18 https://www.bbc.com/news/articles/crr91exlwd8o
  The software company"s boss said Sergey, who teaches coding in online videos, was "a kind of Mozart" "

  Autosummary: "

  ---

  Russian Hackers Exploit New NTLM Flaw to Deploy RAT Malware via Phishing Emails

  financial exploits rusia-ucrania
  2024-11-14 https://thehackernews.com/2024/11/russian-hackers-exploit-new-ntlm-flaw.html
  A newly patched security flaw impacting Windows NT LAN Manager (NTLM) was exploited as a zero-day by a suspected Russia-linked actor as part of cyber attacks targeting Ukraine. The vulnerability in question, CVE-2024-43451 (CVSS score: 6.5), refers to an NTLM hash disclosure spoofing vulnerability that could be exploited to steal a user"s NTLMv2 hash. It was patched by Microsoft earlier this "

  Autosummary: "Minimal interaction with a malicious file by a user such as selecting (single-click), inspecting (right-click), or performing an action other than opening or executing could trigger this vulnerability," Microsoft revealed in its advisory. "

  ---

  US warns of last-minute Iranian and Russian election influence ops

  rusia-ucrania
  2024-11-05 https://www.bleepingcomputer.com/news/security/us-warns-of-last-minute-iranian-and-russian-election-influence-ops/
  The U.S. Cybersecurity & Infrastructure Security Agency is warning about last-minute influence operations conducted by Iranian and Russian actors to undermine the public trust in the integrity and fairness of the upcoming presidential election. [...] "

  Autosummary: "Influence actors linked to Russia, in particular, are manufacturing videos and creating fake articles to undermine the legitimacy of the election, instill fear in voters regarding the election process, and suggest Americans are using violence against each other due to political preferences, judging from information available to the IC," describes CISA. "

  ---

  Russian disinformation campaign active ahead of 2024 US election

  rusia-ucrania
  2024-11-04 https://securityaffairs.com/170551/intelligence/russia-disinformation-us-election-2024.html
  U.S. intel says Russia made a fake video claiming Haitians voted illegally in Georgia, aiming to spread election disinformation. U.S. intel reports Russia created a fake viral video falsely claiming Haitians illegally voted multiple times in Georgia, aiming to spread election disinformation. U.S. intelligence agencies’ claims are based on existing intel and past Russian disinformation […] "

  Autosummary: At the end of October, the Office of the Director of National Intelligence (ODNI), the Federal Bureau of Investigation (FBI), and the Cybersecurity and Infrastructure Security Agency (CISA) released the following statement: “The IC assesses that Russian actors manufactured and amplified a recent video that falsely depicted an individual ripping up ballots in Pennsylvania, judging from information available to the IC and prior activities of other Russian influence actors, including videos and other disinformation activities. "

  ---

  Russian hackers deliver malicious RDP configuration files to thousands

  rusia-ucrania
  2024-10-30 https://www.helpnetsecurity.com/2024/10/30/midnight-blizzard-spearphishing-rdp-file/
  

  Midnight Blizzard – a cyber espionage group that has been linked to the Russian Foreign Intelligence Service (SVR) – is targeting government, academia, defense, and NGO workers with phishing emails containing a signed Remote Desktop Protocol (RDP) configuration file. “Based on our investigation of previous Midnight Blizzard spear-phishing campaigns, we assess that the goal of this operation is likely intelligence collection,” Microsoft’s threat analysts say. Midnight Blizzard Midnight Blizzard (aka Cozy Bear, APT29, and UNC2452) … More →

  The post Russian hackers deliver malicious RDP configuration files to thousands appeared first on Help Net Security.

  "

  Autosummary: As the Ukrainian CERT team recently warned, running the malicious file will establish an outgoing RDP connection with the attackers’ server, allowing the server access to disks, network resources, printers, COM ports, audio devices, the clipboard and other resources (including credentials) on the targets’ computer, as well as put into place technical prerequisites for running third-party programs or scripts. "

  ---

  Russian charged by U.S. for creating RedLine infostealer malware

  exploits rusia-ucrania
  2024-10-29 https://www.bleepingcomputer.com/news/security/russian-charged-by-us-for-creating-redline-infostealer-malware/
  The United States announced charges today against Maxim Rudometov, a Russian national, for being the suspected developer and administrator of the RedLine malware operation, one of the most prolific infostealers over the past few years. [...] "

  Autosummary: The operation was spearheaded by the Dutch police working with international partners, including the FBI, U.S. Department of Justice, and Eurojust, achieving unprecedented disruption to two highly impactful MaaS operations that have stolen millions of account credentials. "

  ---

  Russian Espionage Group Targets Ukrainian Military with Malware via Telegram

  exploits rusia-ucrania
  2024-10-28 https://thehackernews.com/2024/10/russian-espionage-group-targets.html
  A suspected Russian hybrid espionage and influence operation has been observed delivering a mix of Windows and Android malware to target the Ukrainian military under the Telegram persona Civil Defense. Google"s Threat Analysis Group (TAG) and Mandiant are tracking the activity under the name UNC5812. The threat group, which operates a Telegram channel named civildefense_com_ua, was created on "

  Autosummary: After the malware was publicly exposed by Cyfirma in late August 2023, EVLF, the threat actor behind the project, decided to cease activity, but not before selling their Telegram channel to a Chinese-speaking threat actor. "

  ---

  Four REvil Ransomware Members Sentenced in Rare Russian Cybercrime Convictions

  exploits ransomware rusia-ucrania
  2024-10-26 https://thehackernews.com/2024/10/four-revil-ransomware-members-sentenced.html
  Four members of the now-defunct REvil ransomware operation have been sentenced to several years in prison in Russia, marking one of the rare instances where cybercriminals from the country have been convicted of hacking and money laundering charges. Russian news publication Kommersant reported that a court in St. Petersburg found Artem Zaets, Alexei Malozemov, Daniil Puzyrevsky, and Ruslan "

  Autosummary: "

  ---

  Crypt Ghouls Targets Russian Firms with LockBit 3.0 and Babuk Ransomware Attacks

  exploits ransomware rusia-ucrania
  2024-10-19 https://thehackernews.com/2024/10/crypt-ghouls-targets-russian-firms-with.html
  A nascent threat actor known as Crypt Ghouls has been linked to a set of cyber attacks targeting Russian businesses and government agencies with ransomware with the twin goals of disrupting business operations and financial gain. "The group under review has a toolkit that includes utilities such as Mimikatz, XenAllPasswordPro, PingCastle, Localtonet, resocks, AnyDesk, PsExec, and others," "

  Autosummary: "

  ---

  Russian RomCom Attacks Target Ukrainian Government with New SingleCamper RAT Variant

  government rusia-ucrania
  2024-10-17 https://thehackernews.com/2024/10/russian-romcom-attacks-target-ukrainian.html
  The Russian threat actor known as RomCom has been linked to a new wave of cyber attacks aimed at Ukrainian government agencies and unknown Polish entities since at least late 2023. The intrusions are characterized by the use of a variant of the RomCom RAT dubbed SingleCamper (aka SnipBot or RomCom 5.0), said Cisco Talos, which is monitoring the activity cluster under the moniker UAT-5647. "This "

  Autosummary: "

  ---

  US, UK warn of Russian APT29 hackers targeting Zimbra, TeamCity servers

  government rusia-ucrania
  2024-10-10 https://www.bleepingcomputer.com/news/security/us-uk-warn-of-russian-apt29-hackers-targeting-zimbra-teamcity-servers/
  U.S. and U.K. cyber agencies warned today that APT29 hackers linked to Russia"s Foreign Intelligence Service (SVR) target vulnerable Zimbra and JetBrains TeamCity servers "at a mass scale." [...] "

  Autosummary: "

  ---

  Pro-Ukrainian Hackers Strike Russian State TV on Putin"s Birthday

  government rusia-ucrania
  2024-10-08 https://thehackernews.com/2024/10/pro-ukrainian-hackers-strike-russian.html
  Ukraine has claimed responsibility for a cyber attack that targeted Russia state media company VGTRK and disrupted its operations, according to reports from Bloomberg and Reuters. The incident took place on the night of October 7, VGTRK confirmed, describing it as an "unprecedented hacker attack." However, it said "no significant damage" was caused and that everything was working normally "

  Autosummary: Another threat actor that has remained laser-focused on Ukraine is Gamaredon, a Russian hacking crew that"s also known as Aqua Blizzard (previously Actinium), Armageddon, Hive0051, Iron Tilden, Primitive Bear, Shuckworm, Trident Ursa, UAC-0010, UNC530, and Winterflounder. "

  ---

  Cyberattack Group "Awaken Likho" Targets Russian Government with Advanced Tools

  government rusia-ucrania ciber
  2024-10-08 https://thehackernews.com/2024/10/cyberattack-group-awaken-likho-targets.html
  Russian government agencies and industrial entities are the target of an ongoing activity cluster dubbed Awaken Likho. "The attackers now prefer using the agent for the legitimate MeshCentral platform instead of the UltraVNC module, which they had previously used to gain remote access to systems," Kaspersky said, detailing a new campaign that began in June 2024 and continued at least until "

  Autosummary: "

  ---

  Kyiv’s hackers launched an unprecedented cyber attack on Russian state media VGTRK on Putin’s birthday

  government rusia-ucrania
  2024-10-07 https://securityaffairs.com/169486/cyber-warfare-2/kyivs-hackers-hit-russian-state-media.html
  Russian state media VGTRK faced a major cyberattack, which a Ukrainian source claimed was conducted by Kyiv’s hackers. A Ukrainian government source told Reuters that Kyiv’s hackers are behind the cyber attack that disrupted operations at the Russian state media company VGTRK on Putin’s birthday. The All-Russia State Television and Radio Broadcasting Company (VGTRK, Russian: […] "

  Autosummary: Kyiv’s hackers launched an unprecedented cyber attack on Russian state media VGTRK on Putin’s birthday Pierluigi Paganini October 07, 2024 October 07, 2024 Russian state media VGTRK faced a major cyberattack, which a Ukrainian source claimed was conducted by Kyiv’s hackers. "

  ---

  100+ domains seized to stymie Russian Star Blizzard hackers

  rusia-ucrania
  2024-10-04 https://www.helpnetsecurity.com/2024/10/04/star-blizzard-domains-seized/
  

  Microsoft and the US Justice Department have seized over 100 domains used by Star Blizzard, a Russian nation-state threat actor. “Between January 2023 and August 2024, Microsoft observed Star Blizzard target over 30 civil society organizations – journalists, think tanks, and non-governmental organizations (NGOs) core to ensuring democracy can thrive – by deploying spear-phishing campaigns to exfiltrate sensitive information and interfere in their activities,” Steven Masada, Assistant General Counsel at Microsoft’s Digital Crimes Unit, explained. … More →

  The post 100+ domains seized to stymie Russian Star Blizzard hackers appeared first on Help Net Security.

  "

  Autosummary: "

  ---

  U.S. and Microsoft Seize 107 Russian Domains in Major Cyber Fraud Crackdown

  rusia-ucrania
  2024-10-04 https://thehackernews.com/2024/10/us-and-microsoft-seize-107-russian.html
  Microsoft and the U.S. Department of Justice (DoJ) on Thursday announced the seizure of 107 internet domains used by state-sponsored threat actors with ties to Russia to facilitate computer fraud and abuse in the country. "The Russian government ran this scheme to steal Americans" sensitive information, using seemingly legitimate email accounts to trick victims into revealing account credentials "

  Autosummary: "

  ---

  Microsoft and DOJ disrupt Russian FSB hackers" attack infrastructure

  rusia-ucrania
  2024-10-03 https://www.bleepingcomputer.com/news/security/microsoft-and-doj-seize-spear-phishing-domains-used-by-star-blizzard-russian-hackers/
  Microsoft and the Justice Department have seized over 100 domains used by the Russian ColdRiver hacking group to target United States government employees and nonprofit organizations from Russia and worldwide in spear-phishing attacks. [...] "

  Autosummary: "

  ---

  New HTML Smuggling Campaign Delivers DCRat Malware to Russian-Speaking Users

  exploits rusia-ucrania
  2024-09-27 https://thehackernews.com/2024/09/new-html-smuggling-campaign-delivers.html
  Russian-speaking users have been targeted as part of a new campaign distributing a commodity trojan called DCRat (aka DarkCrystal RAT) by means of a technique known as HTML smuggling. The development marks the first time the malware has been deployed using this method, a departure from previously observed delivery vectors such as compromised or fake websites, or phishing emails bearing PDF "

  Autosummary: "The scripts" structure, comments and choice of function names and variables were strong clues that the threat actor used GenAI to create the malware," HP Wolf Security said. "

  ---

  US sanctions crypto exchanges used by Russian ransomware gangs

  exploits ransomware rusia-ucrania
  2024-09-26 https://www.bleepingcomputer.com/news/security/us-sanctions-crypto-exchanges-used-by-russian-ransomware-gangs/
  The U.S. Treasury Department"s Office of Foreign Assets Control (OFAC) has sanctioned PM2BTC and Cryptex, two cryptocurrency exchanges that laundered funds from Russian ransomware gangs and other cybercrime groups. [...] "

  Autosummary: "Cryptex is also associated with over $720 million in transactions to services frequently used by Russia-based ransomware actors and cybercriminals, including fraud shops, mixing services, exchanges lacking KYC programs, and OFAC-designated virtual currency exchange Garantex," the Treasury said. "

  ---

  U.S. Proposes Ban on Connected Vehicles Using Chinese and Russian Tech

  rusia-ucrania
  2024-09-24 https://thehackernews.com/2024/09/us-proposes-ban-on-connected-vehicles.html
  The U.S. Department of Commerce (DoC) said it"s proposing a ban on the import or sale of connected vehicles that integrate software and hardware made by foreign adversaries, particularly that of the People"s Republic of China (PRC) and Russia. "The proposed rule focuses on hardware and software integrated into the Vehicle Connectivity System (VCS) and software integrated into the Automated "

  Autosummary: "

  ---

  Hacktivist group Twelve is back and targets Russian entities

  rusia-ucrania
  2024-09-23 https://securityaffairs.com/168746/hacking/twelve-group-targets-russian-entities.html
  Hacktivist group Twelve is back and targets Russian entities to destroy critical assets and disrupt their operations. The hacktivist group Twelve has been active since at least April 2023, it was formed in the wake of the conflict between Russia and Ukraine. The threat actor focuses on destroying critical assets, disrupting target business, and stealing […] "

  Autosummary: Some of the tools used by the group are Cobalt Strike, mimikatz, chisel, BloodHound, PowerView, adPEAS, CrackMapExec, Advanced IP Scanner and PsExec. "

  ---

  Hacktivist Group Twelve Targets Russian Entities with Destructive Cyber Attacks

  rusia-ucrania
  2024-09-21 https://thehackernews.com/2024/09/hacktivist-group-twelve-targets-russian.html
  A hacktivist group known as Twelve has been observed using an arsenal of publicly available tools to conduct destructive cyber attacks against Russian targets. "Rather than demand a ransom for decrypting data, Twelve prefers to encrypt victims" data and then destroy their infrastructure with a wiper to prevent recovery," Kaspersky said in a Friday analysis. "The approach is indicative of a "

  Autosummary: " Prominent among the other tools used by Twelve are Cobalt Strike, Mimikatz, Chisel, BloodHound, PowerView, adPEAS, CrackMapExec, Advanced IP Scanner, and PsExec for credential theft, discovery, network mapping, and privilege escalation. "

  ---

  Russian security firm Dr.Web disconnects all servers after breach

  rusia-ucrania
  2024-09-18 https://www.bleepingcomputer.com/news/security/russian-security-firm-drweb-disconnects-all-servers-after-breach/
  On Tuesday, Russian anti-malware company Doctor Web (Dr.Web) disclosed a security breach after its systems were targeted in a cyberattack over the weekend. [...] "

  Autosummary: "The attempt to harm our infrastructure was prevented in a timely manner, and no user whose system was protected by Dr.Web was affected," it added in a separate statement in English, published on its official website. "

  ---

  Russian state media networks banned by Facebook owner

  government rusia-ucrania
  2024-09-17 https://www.bbc.com/news/articles/c4gllnx0p40o
  Russian state media outlets have come under increased scrutiny in Western countries. "

  Autosummary: Russian state media networks banned by Facebook owner The Russian embassy in Washington, broadcaster RT, formerly Russia Today, and the owner of the Sputnik news agency, Rossiya Segodnya, did not immediately respond to BBC requests for comment. "

  ---

  Wix to block Russian users starting September 12

  rusia-ucrania
  2024-09-10 https://www.bleepingcomputer.com/news/legal/wix-to-block-russian-users-starting-september-12/
  Wix.com has announced it will stop providing services to Russian users on September 12, 2024, with all accounts from Russia, including free and premium, to be blocked and their websites taken down. [...] "

  Autosummary: It offers a user-friendly interface, an extensive collection of templates, an app market to expand functionality, SEO tools, and dedicated e-commerce tools to handle payments and shipping. "

  ---

  U.S. Offers $10 Million for Info on Russian Cadet Blizzard Hackers Behind Major Attacks

  rusia-ucrania
  2024-09-09 https://thehackernews.com/2024/09/us-offers-10-million-for-info-on.html
  The U.S. government and a coalition of international partners have officially attributed a Russian hacking group tracked as Cadet Blizzard to the General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155). "These cyber actors are responsible for computer network operations against global targets for the purposes of espionage, sabotage, and reputational harm "

  Autosummary: The joint advisory, released last week as part of a coordinated exercise dubbed Operation Toy Soldier, comes from cybersecurity and intelligence authorities in the U.S., the Netherlands, the Czech Republic, Germany, Estonia, Latvia, Ukraine, Canada, Australia, and the U.K. Cadet Blizzard, also known as Ember Bear, FROZENVISTA, Nodaria, Ruinous Ursa, UAC-0056, and UNC2589, gained attention in January 2022 for deploying the destructive WhisperGate (aka PAYWIPE) malware against multiple Ukrainian victim organizations in advance of Russia"s full-blown military invasion of the country. "

  ---

  FBI Cracks Down on Dark Web Marketplace Managed by Russian and Kazakh Nationals

  rusia-ucrania
  2024-09-07 https://thehackernews.com/2024/09/fbi-cracks-down-on-dark-web-marketplace.html
  Two men have been indicted in the U.S. for their alleged involvement in managing a dark web marketplace called WWH Club that specializes in the sale of sensitive personal and financial information. Alex Khodyrev, a 35-year-old Kazakhstan national, and Pavel Kublitskii, a 37-year-old Russian national, have been charged with conspiracy to commit access device fraud and conspiracy to commit wire "

  Autosummary: Flashpoint, in a report published last month, said WWH-Club remains operational despite the law enforcement effort, and that "its other administrators are attempting to distance themselves from Kublitskii and Khodyrev." Khodyrev and Kublitskii "had been living in Miami for the past two years, while secretly continuing to administer WWH Club and its sister dark web marketplaces, forums, and schools," the DoJ said. "

  ---

  Exposed: Russian military Unit 29155 does digital sabotage, espionage

  rusia-ucrania
  2024-09-06 https://www.helpnetsecurity.com/2024/09/06/unit-29155/
  

  The US Department of Justice has named five Russian computer hackers as members of Unit 29155 – i.e., the 161st Specialist Training Center of the Russian General Staff Main Intelligence Directorate (GRU) – which they deem resposible for the 2022 WhisperGate wiper malware attacks on Ukrainian government organizations and critical infrastructure, and subsequently computer network operations against NATO member and ally countries. “Since early 2022, the primary focus of the cyber actors appears to be … More →

  The post Exposed: Russian military Unit 29155 does digital sabotage, espionage appeared first on Help Net Security.

  "

  Autosummary: Active Directory (AD) enumeration (Impacket, ldapdomaindump, BloodHound) Vulnerability scanning (Acunetix, Amass, Droopescan, eScan, and JoomScan) They use CVE exploit scripts from GitHub repositories to target vulnerable IoT and networking devices, as well as computers and web servers, and virtual private servers to host their tools, perform reconnaissance, exploit victim infrastructure, and exfiltrate victim data. "

  ---

  Is Russian group APT28 behind the cyber attack on the German air traffic control agency (DFS)?

  rusia-ucrania
  2024-09-05 https://securityaffairs.com/168070/apt/apt28-cyber-attack-german-air-traffic-control-agency-dfs.html
  A cyber attack hit the German air traffic control agency (DFS) disrupting its operations, experts attribute it to Russia-linked group APT28. A cyber attack targeted the German Air Traffic Control Agency (DFS), as reported by Spiegel and European Truth. DFS, based in Langen near Frankfurt, confirmed that attackers breached its office connection but confirmed that […] "

  Autosummary: The APT28 group (aka Fancy Bear, Pawn Storm, Sofacy Group, Sednit, BlueDelta, and STRONTIUM) has been active since at least 2007 and it has targeted governments, militaries, and security organizations worldwide. "

  ---

  U.S. Seizes 32 Pro-Russian Propaganda Domains in Major Disinformation Crackdown

  rusia-ucrania
  2024-09-05 https://thehackernews.com/2024/09/us-seizes-32-pro-russian-propaganda.html
  The U.S. Department of Justice (DoJ) on Wednesday announced the seizure of 32 internet domains used by a pro-Russian propaganda operation called Doppelganger as part of a sweeping set of actions. Accusing the Russian government-directed foreign malign influence campaign of violating U.S. money laundering and criminal trademark laws, the agency called out companies Social Design Agency (SDA), "

  Autosummary: The complete list of domains, which mimic legitimate news outlets like Der Spiegel, Fox News, Le Monde, and The Washington Post, is as follows - tribunalukraine.info rrn.media ukrlm.info faz.ltd spiegel.agency lemonde.ltd leparisien.ltd rbk.media 50statesoflie.media meisterurian.io artichoc.io vip-news.org acrosstheline.press mypride.press truthgate.us warfareinsider.us shadowwatch.us pravda-ua.com waronfakes.com holylandherald.com levinaigre.net grenzezank.com lexomnium.com uschina.online honeymoney.press sueddeutsche.co tagesspiegel.co bild.work fox-news.top fox-news.in forward.pw, and washingtonpost.pm Concurrent with the domain seizures, the Treasury Department sanctioned 10 individuals and two entities for engaging in efforts to influence and undermine confidence in the electoral process. "

  ---

  Russian military hackers linked to critical infrastructure attacks

  rusia-ucrania
  2024-09-05 https://www.bleepingcomputer.com/news/security/us-and-allies-link-russian-military-hackers-behind-critical-infrastructure-attacks-to-gru-unit-29155/
  The United States and its allies have linked a group of Russian hackers (tracked as Cadet Blizzard and Ember Bear) behind global critical infrastructure attacks to Unit 29155 of Russia"s Main Directorate of the General Staff of the Armed Forces (also known as GRU). [...] "

  Autosummary: GRU Unit 29155 junior officers (U.S. State Department) Today, the U.S. State Department also announced a reward of up to $10 million through its Rewards for Justice program for information on Vladislav Borovkov, Denis Igorevich Denisenko, Yuriy Denisov, Dmitry Yuryevich Goloshubov, and Nikolay Aleksandrovich Korchagin, five of the Russian military intelligence officers believed to be part of GRU"s Unit 29155. "

  ---

  US cracks down on Russian disinformation before 2024 election

  rusia-ucrania
  2024-09-04 https://www.bleepingcomputer.com/news/security/us-cracks-down-on-russian-disinformation-before-2024-election/
  The FBI seized 32 web domains used by the Doppelgänger Russian-linked influence operation network in a disinformation campaign targeting the American public ahead of this year"s presidential election. [...] "

  Autosummary: " The complete list of domains used by Doppelgänger for spreading disinformation that the FBI has seized includes: ribunalukraine.info, rrn.media, ukrlm.info, faz.ltd, spiegel.agency, lemonde.ltd, leparisien.ltd, rbk.media, 50statesoflie.media, meisterurian.io, artichoc.io, vip-news.org, acrosstheline.press, mypride.press, truthgate.us, warfareinsider.us, shadowwatch.us, pravda-ua.com, waronfakes.com, holylandherald.com, levinaigre.net, grenzezank.com, lexomnium.com, uschina.online, honeymoney.press, sueddeutsche.co, tagesspiegel.co, bild.work, fox-news.top, fox-news.in, forward.pw, and washingtonpost.pm. "

  ---

  Russian Military Cyber Actors Target US and Global Critical Infrastructure

  rusia-ucrania
  2024-09-04 https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a
  

  Summary

  The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and National Security Agency (NSA) assess that cyber actors affiliated with the Russian General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155) are responsible for computer network operations against global targets for the purposes of espionage, sabotage, and reputational harm since at least 2020. GRU Unit 29155 cyber actors began deploying the destructive WhisperGate malware against multiple Ukrainian victim organizations as early as January 13, 2022. These cyber actors are separate from other known and more established GRU-affiliated cyber groups, such as Unit 26165 and Unit 74455.

  To mitigate this malicious cyber activity, organizations should take the following actions today:

  • Prioritize routine system updates and remediate known exploited vulnerabilities.
  • Segment networks to prevent the spread of malicious activity.
  • Enable phishing-resistant multifactor authentication (MFA) for all externally facing account services, especially for webmail, virtual private networks (VPNs), and accounts that access critical systems.

  This Cybersecurity Advisory provides tactics, techniques, and procedures (TTPs) associated with Unit 29155 cyber actors—both during and succeeding their deployment of WhisperGate against Ukraine—as well as further analysis (see Appendix A) of the WhisperGate malware initially published in the joint advisory, Destructive Malware Targeting Organizations in Ukraine, published February 26, 2022.

  FBI, CISA, NSA and the following partners are releasing this joint advisory as a collective assessment of Unit 29155 cyber operations since 2020:

  • U.S. Department of th "

    Autosummary: Unit 29155 cyber actors have been observed obtaining the respective exploit scripts for, but not exploiting, the following CVEs: CVE-2020-1472 (Microsoft: Windows Server) CVE-2021-26084 (Atlassian Confluence Server and Data Center) CVE-2021-3156 (Red Hat: Privilege Escalation via Command Line Argument Parsing) CVE-2021-4034 (Red Hat: Polkit Privilege Escalation) CVE-2022-27666 (Red Hat: Heap Buffer Overflow Flaw) Estonian Internal Security Service (KAPO) Latvian State Security Service (VDD) Security Service of Ukraine (SBU) Computer Emergency Response Team of Ukraine (CERT-UA) Canadian Security Intelligence Service (CSIS) Communications Security Establishment Canada (CSE) Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) United Kingdom National Cyber Security Centre (NCSC-UK) For additional information on Russian state-sponsored malicious cyber activity and related indictments, see the recent U.S. Department of Justice (DOJ) press releases for June 26, 2024, and September 5, 2024, FBI’s Cyber Crime webpage, and CISA’s Russia Cyber Threat Overview and Advisories webpage. Acunetix: Unit 29155 cyber actors leveraged both Acunetix and Nmap to identify open ports, services, and vulnerabilities for networks [T1595.002].[6] Unit 29155 cyber actors leveraged both Acunetix and Nmap to identify open ports, services, and vulnerabilities for networks [T1595.002].[6] Amass: Unit 29155 cyber actors leveraged both Amass and VirusTotal to obtain subdomains for target websites "

    ---

    Russian APT29 hackers use iOS, Chrome exploits created by spyware vendors

    exploits rusia-ucrania
    2024-08-29 https://www.bleepingcomputer.com/news/security/russian-apt29-hackers-use-ios-chrome-exploits-created-by-spyware-vendors/
    The Russian state-sponsored APT29 hacking group has been observed using the same iOS and Android exploits created by commercial spyware vendors in a series of cyberattacks between November 2023 and July 2024. [...] "

    Autosummary: In 2021, the Russian cyber-operatives exploited CVE-2021-1879 as a zero-day, targeting government officials in Eastern Europe, attempting to deliver a cookie-stealing framework that snatched LinkedIn, Gmail, and Facebook accounts. "

    ---

    Russian Hackers Exploit Safari and Chrome Flaws in High-Profile Cyberattack

    exploits rusia-ucrania ciber
    2024-08-29 https://thehackernews.com/2024/08/russian-hackers-exploit-safari-and.html
    Cybersecurity researchers have flagged multiple in-the-wild exploit campaigns that leveraged now-patched flaws in Apple Safari and Google Chrome browsers to infect mobile users with information-stealing malware. "These campaigns delivered n-day exploits for which patches were available, but would still be effective against unpatched devices," Google Threat Analysis Group (TAG) researcher Clement "

    Autosummary: CVE-2024-4671 - A use-after-free flaw in Chrome"s Visuals component that could result in arbitrary code execution (Fixed by Google in Chrome version 124.0.6367.201/.202 for Windows and macOS, and version 124.0.6367.201 for Linux in May 2024) CVE-2024-5274 - A type confusion flaw in the V8 JavaScript and WebAssembly engine that could result in arbitrary code execution (Fixed by Google in Chrome version 125.0.6422.112/.113 for Windows and macOS, and version 125.0.6422.112 for Linux in May 2024) The November 2023 and February 2024 campaigns are said to have involved the compromises of the two Mongolian government websites – both in the first and only mfa.gov[.]mn in the latter – to deliver an exploit for CVE-2023-41993 by means of a malicious iframe component pointing to an actor-controlled domain. "

    ---

    US offers $2.5M reward for Belarusian man involved in mass malware distribution

    exploits rusia-ucrania
    2024-08-28 https://securityaffairs.com/167684/cyber-crime/belarusian-man-mass-malware-distribution.html
    The US Department of State offers a $2.5 million reward for information leading to the arrest of a Belarusian cybercriminal involved in the mass malware distribution. The US Department of State announced a $2.5 million reward for information leading to the arrest of Volodymyr Kadariya (38), a Belarusian national allegedly involved in a significant malware […] "

    Autosummary: “Kadariya and his associates used multiple strategies to profit from their widespread hacking and wire fraud scheme, including by using accounts on predominantly Russian cybercrime forums to sell to cybercriminals access to the compromised devices of victim Internet users (so-called “loads” or “bots”), as well as information stolen from victims and recorded in “logs,” such as banking information and login credentials, to enable further efforts to defraud the victim Internet users or deliver additional malware to their devices.” "

    ---

    Russian national arrested in Argentina for laundering money of crooks and Lazarus APT

    financial latam rusia-ucrania
    2024-08-24 https://securityaffairs.com/167485/cyber-crime/russian-national-arrested-laundering-lazarus-funds.html
    A Russian national was arrested in Argentina for laundering proceeds from illicit actors, including North Korea-linked Lazarus Group. This week, the Argentine Federal Police (PFA) arrested a Russian national for laundering proceeds from illicit actors and seized millions of dollars in assets from his Argentinian-based operation. The cybercriminal facilitated money laundering by accepting illicit cryptocurrency […] "

    Autosummary: Russian national arrested in Argentina for laundering money of crooks and Lazarus APT Pierluigi Paganini August 24, 2024 August 24, 2024 A Russian national was arrested in Argentina for laundering proceeds from illicit actors, including North Korea-linked Lazarus Group.Through our investigation, we were able to confirm that the Lazarus Group and APT38, cyber actors associated with the DPRK, are responsible for the theft of $100 million of virtual currency from Harmony’s Horizon bridge reported on June 24, 2022.” "

    ---

    Russian laundering millions for Lazarus hackers arrested in Argentina

    latam rusia-ucrania
    2024-08-23 https://www.bleepingcomputer.com/news/legal/russian-laundering-millions-for-lazarus-hackers-arrested-in-argentina/
    The federal police in Argentina (PFA) have arrested a 29-year-old Russian national in Buenos Aires, who is facing money laundering charges related to cryptocurrency proceeds of the notorious North Korean hackers" Lazarus Group." [...] "

    Autosummary: "

    ---

    Russian Hacker Jailed 3+ Years for Selling Stolen Credentials on Dark Web

    rusia-ucrania
    2024-08-16 https://thehackernews.com/2024/08/russian-hacker-jailed-3-years-for.html
    A 27-year-old Russian national has been sentenced to over three years in prison for peddling financial information, login credentials, and other personally identifying information (PII) on a now-defunct dark web marketplace called Slilpp. Georgy Kavzharadze, 27, of Moscow, Russia, pleaded guilty to one count of conspiracy to commit bank fraud and wire fraud earlier this February. In addition to "

    Autosummary: "

    ---

    Russian Hackers Using Fake Brand Sites to Spread DanaBot and StealC Malware

    exploits rusia-ucrania
    2024-08-16 https://thehackernews.com/2024/08/russian-hackers-using-fake-brand-sites.html
    Cybersecurity researchers have shed light on a sophisticated information stealer campaign that impersonates legitimate brands to distribute malware like DanaBot and StealC. The activity cluster, orchestrated by Russian-speaking cybercriminals and collectively codenamed Tusk, is said to encompass several sub-campaigns, leveraging the reputation of the platforms to trick users into downloading the "

    Autosummary: Cybersecurity researchers have shed light on a sophisticated information stealer campaign that impersonates legitimate brands to distribute malware like DanaBot and StealC. The activity cluster, orchestrated by Russian-speaking cybercriminals and collectively codenamed Tusk, is said to encompass several sub-campaigns, leveraging the reputation of the platforms to trick users into downloading the malware using bogus sites and social media accounts. "

    ---

    Russian national sentenced to 40 months for selling stolen data on the dark web

    rusia-ucrania
    2024-08-16 https://securityaffairs.com/167146/deep-web/russian-national-sentenced-40-months.html
    A Russian national was sentenced to over three years in prison for selling stolen information and credentials on a dark web marketplace. The 27-year-old Russian national Georgy Kavzharadze (also known as “George,” “TeRorPP,” “Torqovec,” and “PlutuSS”) has been sentenced to over three years in prison for selling financial information, login credentials, and other personal data on […] "

    Autosummary: The 27-year-old Russian national Georgy Kavzharadze (also known as “George,” “TeRorPP,” “Torqovec,” and “PlutuSS”) has been sentenced to over three years in prison for selling financial information, login credentials, and other personal data on the dark web marketplace, Slilpp. "

    ---

    Russian-Linked Hackers Target Eastern European NGOs and Media

    rusia-ucrania
    2024-08-15 https://thehackernews.com/2024/08/russian-linked-hackers-target-eastern.html
    Russian and Belarusian non-profit organizations, Russian independent media, and international non-governmental organizations active in Eastern Europe have become the target of two separate spear-phishing campaigns orchestrated by threat actors whose interests align with that of the Russian government. While one of the campaigns – dubbed River of Phish – has been attributed to COLDRIVER, an "

    Autosummary: "When the cost of discovery remains low, phishing remains not only an effective technique, but a way to continue global targeting while avoiding exposing more sophisticated (and expensive) capabilities to discovery," the Citizen Lab said. "

    ---

    Belarusian-Ukrainian Hacker Extradited to U.S. for Ransomware and Cybercrime Charges

    exploits ransomware rusia-ucrania
    2024-08-14 https://thehackernews.com/2024/08/belarusian-ukrainian-hacker-extradited.html
    A coalition of law enforcement agencies coordinated by the U.K. National Crime Agency (NCA) has led to the arrest and extradition of a Belarussian and Ukrainian dual-national believed to be associated with Russian-speaking cybercrime groups. Maksim Silnikau (aka Maksym Silnikov), 38, went by the online monikers J.P. Morgan, xxx, and lansky. He was extradited to the U.S. from Poland on August 9, "

    Autosummary: "On various occasions, Silnikau allegedly distributed information and tools to Ransom Cartel participants, including information about compromised computers, such as stolen credentials, and tools such as those designed to encrypt or "lock" compromised computers," the DoJ noted. "

    ---

    Russian who sold 300,000 stolen credentials gets 40 months in prison

    rusia-ucrania
    2024-08-14 https://www.bleepingcomputer.com/news/security/russian-who-sold-300-000-stolen-credentials-gets-40-months-in-prison/
    ​Georgy Kavzharadze, a 27-year-old Russian national, has been sentenced to 40 months in prison for selling login credentials for over 300,000 accounts on Slilpp, the largest online marketplace of stolen logins, until its seizure in June 2021. [...] "

    Autosummary: Largest online market for stolen credentials The U.S. Department of Justice announced the takedown of Slilpp on June 10, 2021, following a joint operation with law enforcement agencies from the United States, Germany, the Netherlands, and Romania, who seized servers used to host Slilpp"s infrastructure. "

    ---

    EastWind campaign targets Russian organizations with sophisticated backdoors

    rusia-ucrania
    2024-08-12 https://securityaffairs.com/166924/apt/eastwind-campaign-targets-russian-organizations.html
    A campaign tracked as EastWind is targeting Russian government and IT organizations with PlugY and GrewApacha Backdoors. In late July 2024, Kaspersky researchers detected a series of targeted cyberattacks against the Russian government and IT organizations. Kaspersky named this campaign has EastWind. Threat actors sent phishing emails with RAR archive attachments containing a Windows shortcut […] "

    Autosummary: The attackers used the results of the utility’s work on their side as a unique key to encrypt the payload file, which can only be decrypted on the victim’s computer, after which they downloaded the following files to the infected computers: Attackers also employed a previously undetected malware dubbed PlugY, which is downloaded through the CloudSorcerer backdoor. "

    ---

    Google deactivates Russian AdSense accounts, sends final payments

    rusia-ucrania
    2024-08-12 https://www.bleepingcomputer.com/news/google/google-deactivates-russian-adsense-accounts-sends-final-payments/
    Google is notifying Russian YouTubers, bloggers, and publishers that their Adsense accounts are being deactivated and can no longer be used for advertising. [...] "

    Autosummary: "

    ---

    Chinese hacking groups target Russian government, IT firms

    government rusia-ucrania
    2024-08-11 https://www.bleepingcomputer.com/news/security/chinese-hacking-groups-target-russian-government-it-firms/
    A series of targeted cyberattacks that started at the end of July 2024, targeting dozens of systems used in Russian government organizations and IT companies, are linked to Chinese hackers of the APT31 and APT 27 groups. [...] "

    Autosummary: Some things to look out for are: DLL files larger than 5MB in size in the "C:\Users\Public" directory Unsigned "msedgeupdate.dll" files in the file system A running process named "msiexec.exe" for each logged-in user The Russian cybersecurity firm concludes that APT27 and APT31 are likely working together in EastWind. "

    ---

    Russian cyber spies stole data and emails from UK government systems

    government rusia-ucrania
    2024-08-09 https://securityaffairs.com/166795/intelligence/russia-hacked-uk-government-systems.html
    Earlier this year, Russian cyber spies breached UK government systems and stole sensitive data and emails, reported The Record media. Earlier this year, Russia’s foreign intelligence service stole internal emails and data on individuals from the UK government. The news was first reported by Recorded Future News, which obtained an official description of the incident […] "

    Autosummary: Russian cyber spies stole data and emails from UK government systems Pierluigi Paganini August 09, 2024 August 09, 2024 Earlier this year, Russian cyber spies breached UK government systems and stole sensitive data and emails, reported The Record media. "

    ---

    New CMoon USB worm targets Russians in data theft attacks

    rusia-ucrania
    2024-08-07 https://www.bleepingcomputer.com/news/security/new-cmoon-usb-worm-targets-russians-in-data-theft-attacks/
    A new self-spreading worm named "CMoon," capable of stealing account credentials and other data, has been distributed in Russia since early July 2024 via a compromised gas supply company website. [...] "

    Autosummary: An interesting and somewhat unusual feature is the targeting of files that might contain account credentials such as .pfx, .p12, .kdb, .kdbx, .lastpass, .psafe3, .pem, .key, .private, .asc, .gpg, .ovpn, and .log files. "

    ---

    Spies" children did not know they were Russian

    rusia-ucrania
    2024-08-03 https://www.bbc.com/news/articles/cljyj9jp993o
    The Dultsev children thought they were from Argentina and cannot speak Russian. "

    Autosummary: It was not until Thursday, during the large scale Russia-West prisoner swap, that the Kremlin spies, and their children, were returned to Russia. "

    ---

    U.S. Releases High-Profile Russian Hackers in Diplomatic Prisoner Exchange

    rusia-ucrania
    2024-08-02 https://thehackernews.com/2024/08/us-releases-high-profile-russian.html
    In a historic prisoner exchange between Belarus, Germany, Norway, Russia, Slovenia, and the U.S., two Russian nationals serving time for cybercrime activities have been freed and repatriated to their country. This includes Roman Valerevich Seleznev and Vladislav Klyushin, who are part of a group of eight people who have been swapped back to Russia in exchange for the release of 16 people who "

    Autosummary: "

    ---

    U.S. released Russian cybercriminals in diplomatic prisoner exchange

    rusia-ucrania ciber
    2024-08-02 https://securityaffairs.com/166459/uncategorized/russian-cybercriminals-diplomatic-prisoner-exchange.html
    Today, 24 prisoners were released in an international swap between Russia and Western countries, including convicted  Russian cybercriminals. In the recent international prisoner swap two notorious Russian cybercriminals, Roman Seleznev (40) and Vladislav Klyushin (42), are among those released. In December 2017, the Russian hacker Roman Seleznev, aka Track2, Bulba and Ncux, was sentenced to 27 years in prison, he was convicted […] "

    Autosummary: Kliushin was charged alongside four other Russian citizens, Ivan Ermakov (aka Ivan Yermakov, 35), Nikolai Rumiantcev (aka Nikolay Rumyantsev, 33), Mikhail Vladimirovich Irzak (aka Mikka Irzak, 43), and Igor Sergeevich Sladkov (42).Seleznev developed automated systems for systemic identity… pic.twitter.com/0P36EKtoMB — vx-underground (@vxunderground) August 1, 2024 In December 2017, the Russian hacker Roman Seleznev, aka Track2, Bulba and Ncux, was sentenced to 27 years in prison, he was convicted of causing $170 million in damage by hacking into point-of-sale systems. "

    ---

    UK takes down major "Russian Coms" caller ID spoofing platform

    rusia-ucrania
    2024-08-01 https://www.bleepingcomputer.com/news/security/uk-takes-down-russian-comms-caller-id-spoofing-platform-used-to-scam-170-000-people/
    The United Kingdom"s National Crime Agency (NCA) has shut down Russian Coms, a major caller ID spoofing platform used by hundreds of criminals to make over 1.8 million scam calls. [...] "

    Autosummary: Promoted through Snapchat, Instagram, and Telegram, Russian Coms was available as a handset and later as a web app that could provide customers with encrypted calls, web phone, no logs, instant handset wipes, voice changing services, international calls, and 24/7 support. "

    ---

    Ukraine’s cyber operation shut down the ATM services of major Russian banks

    financial rusia-ucrania
    2024-07-27 https://securityaffairs.com/166214/cyber-warfare-2/atm-services-russian-banks-hacked.html
    Ukraine launched a massive cyber operation that shut down the ATM services of the biggest Russian banks on July 27, reported the Kyiv Post. Ukraine has launched a massive cyberattack against ATMs of Russian banks, the cyber operation began on July 23. “This is an opportune moment to fully implement the Kremlin’s long-desired ‘import substitution’ […] "

    Autosummary: The list of hacked Russian banks includes Dom.RF, VTB Bank, Alfa-Bank, Sberbank, Raiffeisen Bank, RSHB Bank, Rosbank, Gazprombank, Tinkoff Bank and iBank. "

    ---

    Russian ransomware gangs account for 69% of all ransom proceeds

    exploits ransomware rusia-ucrania
    2024-07-26 https://www.bleepingcomputer.com/news/security/russian-ransomware-gangs-account-for-69-percent-of-all-ransom-proceeds/
    Russian-speaking threat actors accounted for at least 69% of all crypto proceeds linked to ransomware throughout the previous year, exceeding $500,000,000. [...] "

    Autosummary: In 2023, the largest players in this space included LockBit, Black Basta, ALPHV/BlackCat, Cl0p, PLAY, and Akira, all run by Russian-speaking threat actors. "

    ---

    US sanctions Russian hacktivists who breached water facilities

    rusia-ucrania
    2024-07-22 https://www.bleepingcomputer.com/news/security/us-sanctions-russian-hacktivists-who-breached-water-facilities/
    The US government has imposed sanctions on two Russian cybercriminals for cyberattacks targeting critical infrastructure. [...] "

    Autosummary: The US Treasury mentions the example of Dmitry Khoroshev, the leader of the LockBit ransomware operation, sanctioned in May 2024, as well as Aleksandr Gennadievich Ermakov, a Russian national and a member of the REvil ransomware group, sanctioned in January 2024. "

    ---

    Russian nationals plead guilty to participating in the LockBit ransomware group

    exploits ransomware rusia-ucrania
    2024-07-20 https://securityaffairs.com/165941/cyber-crime/lockbit-ransomware-group-members-plead-guilty.html
    Two Russian nationals pleaded guilty to participating in the LockBit ransomware group and carrying out attacks against victims worldwide. Two foreign nationals, Ruslan Magomedovich Astamirov and Mikhail Vasiliev, pleaded guilty in Newark federal court for their roles in the LockBit ransomware operation. The LockBit ransomware operation has been active since January 2020, the group hit […] "

    Autosummary: In May 2023, the US Justice Department charged Russian national Mikhail Pavlovich Matveev (30), aka Wazawaka, m1x, Boriselcin, and Uhodiransomwar, for his alleged role in multiple ransomware attacks.On April 26, 2021, Matveev and his Babuk coconspirators hit the Metropolitan Police Department in Washington, D.C. The Russian citizen was charged with conspiring to transmit ransom demands, conspiring to damage protected computers, and intentionally damaging protected computers. "

    ---

    Russians plead guilty to involvement in LockBit ransomware attacks

    exploits ransomware rusia-ucrania
    2024-07-19 https://www.bleepingcomputer.com/news/security/russians-plead-guilty-to-involvement-in-lockbit-ransomware-attacks/
    Two Russian individuals admitted to participating in many LockBit ransomware attacks, which targeted victims worldwide and across the United States. [...] "

    Autosummary: Between 2021 and 2023, Vasiliev (aka Ghostrider, Free, Digitalocean90, Digitalocean99, Digitalwaters99, and Newwave110) also used LockBit ransomware in at least 12 attacks against victims worldwide, including businesses in New Jersey, Michigan, the United Kingdom, and Switzerland, causing at least $500,000 in damage and losses, according to the guilty plea. "

    ---

    Two Russian Nationals Plead Guilty in LockBit Ransomware Attacks

    exploits ransomware rusia-ucrania
    2024-07-19 https://thehackernews.com/2024/07/two-russian-nationals-plead-guilty-in.html
    Two Russian nationals have pleaded guilty in a U.S. court for their participation as affiliates in the LockBit ransomware scheme and helping facilitate ransomware attacks across the world. The defendants include Ruslan Magomedovich Astamirov, 21, of Chechen Republic, and Mikhail Vasiliev, 34, a dual Canadian and Russian national of Bradford, Ontario. Astamirov was arrested in Arizona by U.S. law "

    Autosummary: " Astamirov (aka BETTERPAY, offtitan, and Eastfarmer) is said to have deployed LockBit against at least 12 victims between 2020 and 2023, receiving $1.9 million in ransom payments from victims located in the U.S. state of Virginia, Japan, France, Scotland, and Kenya. "

    ---

    U.S. Seizes Domains Used by AI-Powered Russian Bot Farm for Disinformation

    rusia-ucrania
    2024-07-12 https://thehackernews.com/2024/07/us-seizes-domains-used-by-ai-powered.html
    The U.S. Department of Justice (DoJ) said it seized two internet domains and searched nearly 1,000 social media accounts that Russian threat actors allegedly used to covertly spread pro-Kremlin disinformation in the country and abroad on a large scale. "The social media bot farm used elements of AI to create fictitious social media profiles — often purporting to belong to individuals in the "

    Autosummary: " At the heart of the operation is a network of bulletproof hosting providers encompassing Aeza, Evil Empire, GIR, and TNSECURITY, which have also harbored command-and-control domains for different malware families like Stealc, Amadey, Agent Tesla, Glupteba, Raccoon Stealer, RisePro, RedLine Stealer, RevengeRAT, Lumma, Meduza, and Mystic. "Using this tool, RT affiliates disseminated disinformation to and about a number of countries, including the United States, Poland, Germany, the Netherlands, Spain, Ukraine, and Israel," law enforcement agencies from Canada, the Netherlands, and the U.S. said. "

    ---

    US disrupts AI-powered bot farm pushing Russian propaganda on X

    rusia-ucrania
    2024-07-09 https://www.bleepingcomputer.com/news/security/us-disrupts-ai-powered-bot-farm-pushing-russian-propaganda-on-x/
    Almost a thousand Twitter accounts controlled by a large bot farm pushing Russian propaganda and domains used to register the bots were taken down in a joint international law enforcement operation led by the U.S. Justice Department. [...] "

    Autosummary: "

    ---

    Apple Removes VPN Apps from Russian App Store Amid Government Pressure

    government rusia-ucrania
    2024-07-08 https://thehackernews.com/2024/07/apple-removes-vpn-apps-from-russian-app.html
    Apple removed a number of virtual private network (VPN) apps in Russia from its App Store on July 4, 2024, following a request by Russia"s state communications watchdog Roskomnadzor, Russian news media reported. This includes the mobile apps of 25 VPN service providers, including ProtonVPN, Red Shield VPN, NordVPN and Le VPN, according to MediaZona. It"s worth noting that NordVPN previously shut "

    Autosummary: "

    ---

    CloudSorcerer hackers abuse cloud services to steal Russian govt data

    rusia-ucrania
    2024-07-08 https://www.bleepingcomputer.com/news/security/cloudsorcerer-hackers-abuse-cloud-services-to-steal-russian-govt-data/
    A new advanced persistent threat (APT) group named CloudSorcerer abuses public cloud services to steal data from Russian government organizations in cyberespionage attacks. [...] "

    Autosummary: It also supports a range of commands retrieved from the C2, including: Shell command execution using the "ShellExecuteExW" API Copy, move, rename, or delete files Receive a shellcode from the pipe and inject it into any process by allocating memory and creating a new thread in a remote process Receive a PE file, create a section, and map it into the remote process Create a process using COM interfaces Create a process as a dedicated user Create a new service or modify an existing service Add new network users or remove legitimate users from the system Overall, the CloudSorcerer backdoor is a potent tool that enables the threat actors to perform malicious actions on the infected machines. "

    ---

    New APT Group "CloudSorcerer" Targets Russian Government Entities

    government rusia-ucrania
    2024-07-08 https://thehackernews.com/2024/07/new-apt-group-cloudsorcerer-targets.html
    A previously undocumented advanced persistent threat (APT) group dubbed CloudSorcerer has been observed targeting Russian government entities by leveraging cloud services for command-and-control (C2) and data exfiltration. Cybersecurity firm Kaspersky, which discovered the activity in May 2024, the tradecraft adopted by the threat actor bears similarities with that of CloudWizard, but pointed "

    Autosummary: "

    ---

    TeamViewer links corporate cyberattack to Russian state hackers

    government rusia-ucrania ciber
    2024-06-28 https://www.bleepingcomputer.com/news/security/teamviewer-links-corporate-cyberattack-to-russian-state-hackers/
    RMM software developer TeamViewer says a Russian state-sponsored hacking group known as Midnight Blizzard is believed to be behind a breach of their corporate network this week. [...] "

    Autosummary: "Following best-practice architecture, we have a strong segregation of the Corporate IT, the production environment, and the TeamViewer connectivity platform in place," continues TeamViewer"s statement. TeamViewer says they believe their internal corporate network, not their production environment, was breached on Wednesday, June 26, using an employee"s credentials. "

    ---

    Russian hackers read the emails you sent us, Microsoft warns more customers

    rusia-ucrania
    2024-06-28 https://www.bitdefender.com/blog/hotforsecurity/russian-hackers-read-your-emails-to-us-microsoft-warns-more-customers/
    More of Microsoft"s clients are being warned that emails they exchanged with the company were accessed by Russian hackers who broke into its systems and spied on staff inboxes. Read more in my article on the Hot for Security blog. "

    Autosummary: "This week, we are continuing notifications to customers who corresponded with Microsoft corporate email accounts that were exfiltrated by the Midnight Blizzard threat actor," said a Microsoft spokesperson. "

    ---

    Russian National Indicted for Cyber Attacks on Ukraine Before 2022 Invasion

    rusia-ucrania
    2024-06-27 https://thehackernews.com/2024/06/russian-national-indicted-for-cyber.html
    A 22-year-old Russian national has been indicted in the U.S. for his alleged role in staging destructive cyber attacks against Ukraine and its allies in the days leading to Russia"s full-blown military invasion of Ukraine in early 2022. Amin Timovich Stigal, the defendant in question, is assessed to be affiliated with the Main Directorate of the General Staff of the Armed Forces of the Russian "

    Autosummary: "From August 5, 2021, through February 3, 2022, the conspirators leveraged the same computer infrastructure they used in the Ukraine-related attacks to probe computers belonging to a federal government agency in Maryland in the same manner as they had initially probed the Ukrainian Government networks," the Justice Department (DoJ) said. "

    ---

    U.S. indicts Russian GRU hacker, offers $10 million reward

    rusia-ucrania
    2024-06-27 https://www.bleepingcomputer.com/news/security/us-indicts-russian-gru-hacker-offers-10-million-reward/
    The U.S. indicted Russian national Amin Timovich Stigal for his alleged role in cyberattacks targeting Ukrainian government computer networks in an operation from the Russian foreign military intelligence agency (GRU) prior to invading the country. [...] "

    Autosummary: You could be eligible for a reward and relocation" - Rewards for Justice If arrested and convicted, Stigal faces a potential maximum sentence of five years in prison for his participation in cyberattacks against Ukraine, the U.S., and other NATO member countries. "

    ---

    ExCobalt Cybercrime group targets Russian organizations in multiple sectors

    rusia-ucrania
    2024-06-24 https://securityaffairs.com/164838/breaking-news/excobalt-cybercrime-group-targets-russian-orgs.html
    The cybercrime group ExCobalt targeted Russian organizations in multiple sectors with a previously unknown backdoor known as GoRed. Positive Technologies researchers reported that a cybercrime gang called ExCobalt targeted Russian organizations in multiple sectors with a previously unknown Golang-based backdoor known as GoRed. Members of the ExCobalt group have been active since at least 2016, […] "

    Autosummary: The group exploited the following vulnerabilities for privilege escalation: CVE-2022-2586, CVE-2021-3156, CVE-2021-4034, CVE-2019-13272, CVE-2022-27228, CVE-2021-44228, CVE-2021-40438, CVE-2023-3519, BDU:2023-05857, and CVE-2019-12725. "

    ---

    ExCobalt Cyber Gang Targets Russian Sectors with New GoRed Backdoor

    rusia-ucrania
    2024-06-22 https://thehackernews.com/2024/06/excobalt-cyber-gang-targets-russian.html
    Russian organizations have been targeted by a cybercrime gang called ExCobalt using a previously unknown Golang-based backdoor known as GoRed. "ExCobalt focuses on cyber espionage and includes several members active since at least 2016 and presumably once part of the notorious Cobalt Gang," Positive Technologies researchers Vladislav Lunin and Alexander Badayev said in a technical report "

    Autosummary: "

    ---

    US sanctions 12 Kaspersky Lab execs for working in Russian tech sector

    rusia-ucrania
    2024-06-21 https://www.bleepingcomputer.com/news/security/us-sanctions-12-kaspersky-lab-execs-for-working-in-russian-tech-sector/
    The Treasury Department"s Office of Foreign Assets Control (OFAC) has sanctioned twelve Kaspersky Lab executives for operating in the technology sector of Russia. [...] "

    Autosummary: Mikhail Yuryevich Gerber (Gerber) - Executive Vice President of Consumer Business Anton Mikhaylovich Ivanov (Ivanov) - Chief Technology Officer (CTO) Kirill Aleksandrovich Astrakhan (Astrakhan) - Executive Vice President for Corporate Business Anna Vladimirovna Kulashova (Kulashova) - Managing Director for Russia and the Commonwealth of Independent States (CIS) While many of these members report directly to the CEO, Eugene Kaspersky, the US government says they have not sanctioned Kaspersky Lab, its parent or subsidiary companies, or its CEO. "

    ---

    French Diplomatic Entities Targeted in Russian-Linked Cyber Attacks

    rusia-ucrania
    2024-06-20 https://thehackernews.com/2024/06/french-diplomatic-entities-targeted-in.html
    State-sponsored actors with ties to Russia have been linked to targeted cyber attacks aimed at French diplomatic entities, the country"s information security agency ANSSI said in an advisory. The attacks have been attributed to a cluster tracked by Microsoft under the name Midnight Blizzard (formerly Nobelium), which overlaps with activity tracked as APT29, BlueBravo, Cloaked Ursa, Cozy Bear, "

    Autosummary: Most of Nobelium campaigns against diplomatic entities use compromised legitimate email accounts belonging to diplomatic staff, and conduct phishing campaigns against diplomatic institutions, embassies, and consulates," the agency said. "

    ---

    US bans Kaspersky software for alleged Russian links

    rusia-ucrania
    2024-06-20 https://www.bbc.com/news/articles/ceqq7663wd2o
    Government says Moscow"s influence over the company was found to pose a significant risk to US infrastructure. "

    Autosummary: "

    ---

    Russian warships leave Cuba after five days

    rusia-ucrania
    2024-06-17 https://www.bbc.com/news/articles/ckrr8dn238yo
    The Russian fleet had been anchored just 90 miles from the US state of Florida. "

    Autosummary: "

    ---

    Two Ukrainians accused of spreading Russian propaganda and hack soldiers’ phones

    rusia-ucrania
    2024-06-14 https://securityaffairs.com/164516/cyber-warfare-2/ukrainians-accused-russian-propaganda.html
    Ukraine’s security service (SBU) detained two individuals accused of supporting Russian intelligence in spreading propaganda and hacking soldiers’ phones. Ukraine’s security service, the SBU, detained two individuals who are accused of supporting Russian intelligence in spreading pro-Russia propaganda. They are also accused of hacking the phones of Ukrainian soldiers. The arrests result from an investigation conducted by […] "

    Autosummary: Two Ukrainians accused of spreading Russian propaganda and hack soldiers’ phones Pierluigi Paganini June 14, 2024 June 14, 2024 Ukraine’s security service (SBU) detained two individuals accused of supporting Russian intelligence in spreading propaganda and hacking soldiers’ phones. "

    ---

    Cuba welcomes Russian military ships to Havana

    rusia-ucrania
    2024-06-13 https://www.bbc.com/news/videos/c722m823612o
    The vessels are expected to stay in the island during the weekend as part of a military drill in the Caribbean. "

    Autosummary: "

    ---

    Russian warships arrive in Cuba in show of force

    rusia-ucrania
    2024-06-12 https://www.bbc.com/news/articles/cg66g0neweko
    The visit is seen as Russia"s sabre-rattling, amid tensions with the West over Moscow"s invasion of Ukraine. "

    Autosummary: "

    ---

    Russian Power Companies, IT Firms, and Govt Agencies Hit by Decoy Dog Trojan

    exploits rusia-ucrania
    2024-06-04 https://thehackernews.com/2024/06/russian-power-companies-it-firms-and.html
    Russian organizations are at the receiving end of cyber attacks that have been found to deliver a Windows version of a malware called Decoy Dog. Cybersecurity company Positive Technologies is tracking the activity cluster under the name Operation Lahat, attributing it to an advanced persistent threat (APT) group called HellHounds. "The Hellhounds group compromises organizations they select and "

    Autosummary: Details about Decoy Dog, a custom variant of the open-source Pupy RAT, emerged in April 2023, when Infoblox uncovered the malware"s use of DNS tunneling for communications with its command-and-control (C2) server to remotely control infected hosts. "

    ---

    Russian Hackers Target Europe with HeadLace Malware and Credential Harvesting

    exploits rusia-ucrania
    2024-05-31 https://thehackernews.com/2024/05/russian-hackers-target-europe-with.html
    The Russian GRU-backed threat actor APT28 has been attributed as behind a series of campaigns targeting networks across Europe with the HeadLace malware and credential-harvesting web pages. APT28, also known by the names BlueDelta, Fancy Bear, Forest Blizzard, FROZENLAKE, Iron Twilight, ITG05, Pawn Storm, Sednit, Sofacy, and TA422, is an advanced persistent threat (APT) group affiliated with "

    Autosummary: APT28, also known by the names BlueDelta, Fancy Bear, Forest Blizzard, FROZENLAKE, Iron Twilight, ITG05, Pawn Storm, Sednit, Sofacy, and TA422, is an advanced persistent threat (APT) group affiliated with Russia"s strategic military intelligence unit, the GRU. "

    ---

    Russian indicted for selling access to US corporate networks

    rusia-ucrania
    2024-05-28 https://www.bleepingcomputer.com/news/security/russian-indicted-for-selling-access-to-us-corporate-networks/
    A 31-year-old Russian national named Evgeniy Doroshenko has been indicted for wire and computer fraud in the United States for allegedly acting as an "initial access broker" from February 2019 to May 2024. [...] "

    Autosummary: "

    ---

    Russian hackers use new Lunar malware to breach a European govt"s agencies

    exploits rusia-ucrania
    2024-05-16 https://www.bleepingcomputer.com/news/security/russian-hackers-use-new-lunar-malware-to-breach-a-european-govts-agencies/
    Security researchers discovered two previously unseen backdoors dubbed LunarWeb and LunarMail that were used to compromise a European government"s diplomatic institutions abroad. [...] "

    Autosummary: LunarMail operational diagram Source: ESET Based on similarities in observed tactics, techniques, and procedures (TTPs) between the Lunar toolset and and past activities, ESET attributes the backdoors to the Russian hacking group Turla with medium confidence. The commands LunarWeb supports include executing shell and PowerShell commands, collecting system information, running Lua code, zipping files, and exfiltrating data in AES-256 encrypted form. "

    ---

    How AI turned a Ukrainian YouTuber into a Russian

    rusia-ucrania
    2024-05-14 https://www.bbc.com/news/articles/c25rre8ww57o
    As generative AI develops so quickly, regulating it and protecting people has become a challenge. "

    Autosummary: Error. "

    ---

    Russian hackers defaced local British news sites

    rusia-ucrania
    2024-05-13 https://securityaffairs.com/163080/cyber-crime/russian-hackers-british-newspaper-websites.html
    A group of hackers that defines itself as “first-class Russian hackers” claims the defacement of hundreds of local and regional British newspaper websites. A group claiming to be “first-class Russian hackers” defaced numerous local and regional British newspaper websites owned by Newsquest Media Group. The group defaced the home pages of the targeted websites and […] "

    Autosummary: “The operations have primarily targeted audiences in Lithuania, Latvia, and Poland with anti-North Atlantic Treaty Organization (NATO) narratives, often leveraging website compromises or spoofed email accounts to disseminate fabricated content, including falsified correspondence from military officials” reads the report published by FireEye. "

    ---

    Poland says Russian military hackers target its govt networks

    rusia-ucrania
    2024-05-09 https://www.bleepingcomputer.com/news/security/poland-says-russian-military-hackers-target-its-govt-networks/
    Poland says a state-backed threat group linked to Russia"s military intelligence service (GRU) has been targeting Polish government institutions throughout the week. [...] "

    Autosummary: According to evidence found by CSIRT MON, the country"s Computer Security Incident Response Team (led by the Polish Minister of National Defense) and CERT Polska (the Polish computer emergency response team), Russian APT28 state hackers attacked multiple government institutions in a large-scale phishing campaign. "

    ---

    Russian Operator of BTC-e Crypto Exchange Pleads Guilty to Money Laundering

    financial rusia-ucrania
    2024-05-07 https://thehackernews.com/2024/05/russian-operator-of-btc-e-crypto.html
    A Russian operator of a now-dismantled BTC-e cryptocurrency exchange has pleaded guilty to money laundering charges from 2011 to 2017. Alexander Vinnik, 44, was charged in January 2017 and taken into custody in Greece in July 2017. He was subsequently extradited to the U.S. in August 2022. Vinnik and his co-conspirators have been accused of owning and managing "

    Autosummary: "

    ---

    LockBit leader unmasked: US charges Russian national

    ransomware rusia-ucrania
    2024-05-07 https://www.helpnetsecurity.com/2024/05/07/lockbit-lockbitsupp-unmasked/
    

    Russian national Dmitry Khoroshev is “LockBitSupp”, the creator, developer and administator of the infamous LockBit ransomware group, according to UK, US and Australia law enforcement agencies. The US Justice Deparment has unsealed charges against Khoroshev and the US Department of the Treasury’s Office of Foreign Assets Control (OFAC), the Australian Department of Foreign Affairs, and the UK Foreign, Commonwealth and Development Office have imposed sanctions on him. Taking LockBit down In February 2024, the UK … More →

    The post LockBit leader unmasked: US charges Russian national appeared first on Help Net Security.

    "

    Autosummary: With the help of affiliates, the LockBit ransomware group attacked more than 2,500 victims – individuals, businesses, hospitals, critical infrastructure organizations, government agencies, etc. – in 120+ countries, and “extracted at least $500 million in ransom payments from their victims and caused billions of dollars in broader losses, such as lost revenue, incident response, and recovery.” "

    ---

    Russian Hacker Dmitry Khoroshev Unmasked as LockBit Ransomware Administrator

    exploits ransomware rusia-ucrania
    2024-05-07 https://thehackernews.com/2024/05/russian-hacker-dmitry-khoroshev.html
    The U.K. National Crime Agency (NCA) has unmasked the administrator and developer of the LockBit ransomware operation, revealing it to be a 31-year-old Russian national named Dmitry Yuryevich Khoroshev. In addition, Khoroshev has been sanctioned by the U.K. Foreign, Commonwealth and Development Office (FCD), the U.S. Department of the Treasury’s Office of Foreign Assets Control ( "

    Autosummary: "LockBit ransomware has been used against Australian, UK and US businesses, comprising 18% of total reported Australian ransomware incidents in 2022-23 and 119 reported victims in Australia," Penny Wong, Minister for Foreign Affairs of Australia, said. "

    ---

    Cubans lured to Russian army by high pay and passports

    rusia-ucrania
    2024-05-04 https://www.bbc.co.uk/news/world-europe-68949298
    The number of Cubans recruited to fight in Ukraine is thought to be in the hundreds. "

    Autosummary: "

    ---

    US govt warns of pro-Russian hacktivists targeting water facilities

    rusia-ucrania
    2024-05-01 https://www.bleepingcomputer.com/news/security/us-govt-warns-of-pro-russian-hacktivists-targeting-water-facilities/
    The US government is warning that pro-Russian hacktivists are seeking out and hacking into unsecured operational technology (OT) systems used to disrupt critical infrastructure operations. [...] "

    Autosummary: The joint advisory comes from six US govt agencies, including CISA, FBI, NSA, EPA, DOE, USDA, and FDA, as well as the Multi-State Information Sharing and Analysis Center (MS-ISAC), Canada"s Centre for Cyber Security (CCCS), and United Kingdom"s National Cyber Security Centre (NCSC-UK). "

    ---

    Meta faces EU probe over Russian disinformation

    rusia-ucrania
    2024-04-30 https://www.bbc.com/news/articles/c72p1dr0mk8o
    The EU says Facebook and Instagram have not done enough to combat "malicious actors"" political ads. "

    Autosummary: Error. "

    ---

    Russian hackers’ custom tool exploits old Windows Print Spooler flaw (CVE-2022-38028)

    exploits rusia-ucrania
    2024-04-23 https://www.helpnetsecurity.com/2024/04/23/cve-2022-38028-exploits/
    

    For nearly four years and perhaps even longer, Forest Blizzard (aka Fancy Bear, aka APT28) has been using a custom tool that exploits a specific vulnerability in Windows Print Spooler service (CVE-2022-38028). Dubbed GooseEgg, the tool is a launcher application that can spawn other applications with SYSTEM-level permissions, thus helping the hackers to perform remote code execution, install backdoors, steal credentials, and more. “Microsoft has observed Forest Blizzard using GooseEgg as part of post-compromise activities … More →

    The post Russian hackers’ custom tool exploits old Windows Print Spooler flaw (CVE-2022-38028) appeared first on Help Net Security.

    "

    Autosummary: “Microsoft has observed Forest Blizzard using GooseEgg as part of post-compromise activities against targets including Ukrainian, Western European, and North American government, non-governmental, education, and transportation sector organizations,” Microsoft threat analysts have shared on Monday. "

    ---

    Russian Sandworm hackers targeted 20 critical orgs in Ukraine

    rusia-ucrania
    2024-04-22 https://www.bleepingcomputer.com/news/security/russian-sandworm-hackers-targeted-20-critical-orgs-in-ukraine/
    Russian hacker group Sandworm aimed to disrupt operations at around 20 critical infrastructure facilities in Ukraine, according to a report from the Ukrainian Computer Emergency Response Team (CERT-UA). [...] "

    Autosummary: From March 7 to March 15, 2024, CERT-UA engaged in extensive counter-cyberattack operations, which included informing affected enterprises, removing malware, and enhancing security measures. "

    ---

    Russian Hacker Group ToddyCat Uses Advanced Tools for Industrial-Scale Data Theft

    industry rusia-ucrania
    2024-04-22 https://thehackernews.com/2024/04/russian-hacker-group-toddycat-uses.html
    The threat actor known as ToddyCat has been observed using a wide range of tools to retain access to compromised environments and steal valuable data. Russian cybersecurity firm Kaspersky characterized the adversary as relying on various programs to harvest data on an "industrial scale" from primarily governmental organizations, some of them defense related, located in "

    Autosummary: "

    ---

    Previously unknown Kapeka backdoor linked to Russian Sandworm APT

    rusia-ucrania
    2024-04-18 https://securityaffairs.com/161987/hacking/kapeka-backdoor-linked-sandworm.html
    Russia-linked APT Sandworm employed a previously undocumented backdoor called Kapeka in attacks against Eastern Europe since 2022. WithSecure researchers identified a new backdoor named Kapeka that has been used in attacks targeting victims in Eastern Europe since at least mid-2022. The backdoor is very sophisticated, it serves as both an initial toolkit and as a backdoor […] "

    Autosummary: In 2022, the Russian APT used multiple wipers in attacks aimed at Ukraine,including AwfulShred, CaddyWiper, HermeticWiper, Industroyer2, IsaacWiper, WhisperGate, Prestige, RansomBoggs, and ZeroWipe. The Sandworm group (aka BlackEnergy, UAC-0082, Iron Viking, Voodoo Bear, and TeleBots) has been active since 2000, it operates under the control of Unit 74455 of the Russian GRU’s Main Center for Special Technologies (GTsST). "

    ---

    Russian APT Deploys New "Kapeka" Backdoor in Eastern European Attacks

    rusia-ucrania
    2024-04-17 https://thehackernews.com/2024/04/russian-apt-deploys-new-kapeka-backdoor.html
    A previously undocumented "flexible" backdoor called Kapeka has been "sporadically" observed in cyber attacks targeting Eastern Europe, including Estonia and Ukraine, since at least mid-2022. The findings come from Finnish cybersecurity firm WithSecure, which attributed the malware to the Russia-linked advanced persistent threat (APT) group tracked as Sandworm (aka APT44 or "

    Autosummary: " "The backdoor"s victimology, infrequent sightings, and level of stealth and sophistication indicate APT-level activity, highly likely of Russian origin." "

    ---

    Russian Sandworm hackers pose as hacktivists in water utility breaches

    rusia-ucrania
    2024-04-17 https://www.bleepingcomputer.com/news/security/russian-sandworm-hackers-pose-as-hacktivists-in-water-utility-breaches/
    The Sandworm hacking group associated with Russian military intelligence has been hiding attacks and operations behind multiple online personas posing as hacktivist groups. [...] "

    Autosummary: "These aims include priming the information space with narratives favorable to Russia, generating perceptions of popular support for the war for domestic and foreign audiences, and making the GRU’s cyber capabilities appear more potent through exaggerated claims of impact" - Mandiant The war in Ukraine made Sandworm notorious for launching multi-faceted attacks aimed at causing damage to the country"s critical infrastructure and services, including state networks, telecommunications providers, news media, and the power grid. "

    ---

    Ukrainian Blackjack group used ICS malware Fuxnet against Russian targets

    exploits industry rusia-ucrania
    2024-04-15 https://securityaffairs.com/161865/hacking/blackjack-ics-malware-fuxnet.html
    The Ukrainian hacking group Blackjack used a destructive ICS malware dubbed Fuxnet in attacks against Russian infrastructure. Industrial and enterprise IoT cybersecurity firm Claroty reported that the Ukrainian Blackjack hacking group claims to have damaged emergency detection and response capabilities in Moscow and beyond the Russian capital using a destructive ICS malware dubbed Fuxnet. The […] "

    Autosummary: “The attackers developed and deployed malware that targeted the gateways and deleted filesystems, directories, disabled remote access services, routing services for each device, and rewrote flash memory, destroyed NAND memory chips, UBI volumes and other actions that further disrupted operation of these gateways.” concludes the report.However, our analysis of data leaked by Blackjack, including the Fuxnet malware, indicates that only a little more than 500 sensor gateways were bricked by the malware in the attack, and the remote sensors and controllers likely remain intact.” reads the analysis published by Claroty. "

    ---

    US sanctions crypto exchanges used by Russian darknet market, banks

    financial rusia-ucrania
    2024-03-25 https://www.bleepingcomputer.com/news/security/us-sanctions-crypto-exchanges-used-by-russian-darknet-market-banks/
    The U.S. Treasury Department"s Office of Foreign Assets Control (OFAC) has sanctioned three cryptocurrency exchanges for working with OFAC-designated Russian dark web markets and banks. [...] "

    Autosummary: OFAC also designated multiple other Russian fintech companies and their owners for working with OFAC-designated Rosbank, VTB Bank, Sberbank, Sovcombank, and the Central Bank of Russia to help Russian companies and nationals evade sanctions. "

    ---

    Russian Hackers Use "WINELOADER" Malware to Target German Political Parties

    exploits rusia-ucrania
    2024-03-23 https://thehackernews.com/2024/03/russian-hackers-use-wineloader-malware.html
    The WINELOADER backdoor used in recent cyber attacks targeting diplomatic entities with wine-tasting phishing lures has been attributed as the handiwork of a hacking group with links to Russia"s Foreign Intelligence Service (SVR), which was responsible for breaching SolarWinds and Microsoft. The findings come from Mandiant, which said Midnight Blizzard (aka APT29, BlueBravo, or "

    Autosummary: WINELOADER, per the Google Cloud subsidiary, has also been employed in an operation targeting diplomatic entities in the Czech Republic, Germany, India, Italy, Latvia, and Peru in late January 2024. "

    ---

    Microsoft to shut down 50 cloud services for Russian businesses

    rusia-ucrania
    2024-03-23 https://www.bleepingcomputer.com/news/microsoft/microsoft-to-shut-down-50-cloud-services-for-russian-businesses/
    Microsoft plans to limit access to over fifty cloud products for Russian organizations by the end of March as part of the sanctions requirements against the country issued by EU regulators last December. [...] "

    Autosummary: It has been clarified that the invalidation of licenses impacts Russian companies and organizations engaging in architecture, design, construction, manufacturing, media, education and entertainment, building information modeling (BIM), computer-aided design (CAD), and computer-aided manufacturing (CAM). "As you may know, the European Union recently imposed new economic sanctions that, effective March 20, 2024, prohibit Microsoft from supplying certain management or design software (including cloud-based solutions) to entities incorporated in Russia. Some of the most important products that will have their license keys invalidated are: Microsoft Azure : Cloud platform for computing, analytics, storage, and networking services. "

    ---

    Russian Hackers Target Ukrainian Telecoms with Upgraded "AcidPour" Malware

    exploits rusia-ucrania Telcos
    2024-03-22 https://thehackernews.com/2024/03/russian-hackers-target-ukrainian.html
    The data wiping malware called AcidPour may have been deployed in attacks targeting four telecom providers in Ukraine, new findings from SentinelOne show. The cybersecurity firm also confirmed connections between the malware and AcidRain, tying it to threat activity clusters associated with Russian military intelligence. "AcidPour"s expanded capabilities would enable it to better "

    Autosummary: "AcidPour"s expanded capabilities would enable it to better disable embedded devices including networking, IoT, large storage (RAIDs), and possibly ICS devices running Linux x86 distributions," security researchers Juan Andres Guerrero-Saade and Tom Hegel said. "

    ---

    Russian hackers target German political parties with WineLoader malware

    exploits rusia-ucrania
    2024-03-22 https://www.bleepingcomputer.com/news/security/russian-hackers-target-german-political-parties-with-wineloader-malware/
    Researchers are warning that a notorious hacking group linked to Russia"s Foreign Intelligence Service (SVR) is targeting political parties in Germany for the first time, shifting their focus away from the typical targeting of diplomatic missions. [...] "

    Autosummary: The WineLoader backdoor features several similarities with other malware variants deployed in past APT29 attacks, such as "burnbatter", "myskybeat", and "beatdrop," suggesting a common developer. "

    ---

    U.S. Sanctions Russians Behind "Doppelganger" Cyber Influence Campaign

    rusia-ucrania
    2024-03-21 https://thehackernews.com/2024/03/us-sanctions-russians-behind.html
    The U.S. Treasury Department"s Office of Foreign Assets Control (OFAC) on Wednesday announced sanctions against two 46-year-old Russian nationals and the respective companies they own for engaging in cyber influence operations. Ilya Andreevich Gambashidze (Gambashidze), the founder of the Moscow-based company Social Design Agency (SDA), and Nikolai Aleksandrovich Tupikin (Tupikin), the CEO and "

    Autosummary: Ilya Andreevich Gambashidze (Gambashidze), the founder of the Moscow-based company Social Design Agency (SDA), and Nikolai Aleksandrovich Tupikin (Tupikin), the CEO and current owner of Russia-based Company Group Structura LLC (Structura), have been accused of providing services to the Russian government in connection to a "foreign malign influence campaign. "

    ---

    Suspected Russian Data-Wiping "AcidPour" Malware Targeting Linux x86 Devices

    exploits rusia-ucrania Linux
    2024-03-19 https://thehackernews.com/2024/03/suspected-russian-data-wiping-acidpour.html
    A new variant of a data wiping malware called AcidRain has been detected in the wild that"s specifically designed for targeting Linux x86 devices. The malware, dubbed AcidPour, is compiled for Linux x86 devices, SentinelOne"s Juan Andres Guerrero-Saade said in a series of posts on X. "The new variant [...] is an ELF binary compiled for x86 (not MIPS) and while it refers to similar devices/ "

    Autosummary: "

    ---

    Microsoft: Russian hackers accessed internal systems, code repositories

    rusia-ucrania
    2024-03-11 https://www.helpnetsecurity.com/2024/03/11/microsoft-russian-hackers-srouce-code/
    

    Midnight Blizzard (aka APT29), a group of Russian hackers tied to the country’s Foreign Intelligence Service (SVR), has leveraged information stolen from Microsoft corporate email systems to burrow into the company’s source code repositories and internal systems. “It is apparent that Midnight Blizzard is attempting to use secrets of different types it has found. Some of these secrets were shared between customers and Microsoft in email, and as we discover them in our exfiltrated email, … More →

    The post Microsoft: Russian hackers accessed internal systems, code repositories appeared first on Help Net Security.

    "

    Autosummary: "

    ---

    Microsoft Confirms Russian Hackers Stole Source Code, Some Customer Secrets

    rusia-ucrania
    2024-03-09 https://thehackernews.com/2024/03/microsoft-confirms-russian-hackers.html
    Microsoft on Friday revealed that the Kremlin-backed threat actor known as Midnight Blizzard (aka APT29 or Cozy Bear) managed to gain access to some of its source code repositories and internal systems following a hack that came to light in January 2024. "In recent weeks, we have seen evidence that Midnight Blizzard is using information initially exfiltrated from our "

    Autosummary: "In recent weeks, we have seen evidence that Midnight Blizzard is using information initially exfiltrated from our corporate email systems to gain, or attempt to gain, unauthorized access," the tech giant said. "

    ---

    Microsoft says Russian hackers breached its systems, accessed source code

    rusia-ucrania
    2024-03-08 https://www.bleepingcomputer.com/news/microsoft/microsoft-says-russian-hackers-breached-its-systems-accessed-source-code/
    Microsoft says the Russian "Midnight Blizzard" hacking group recently accessed some of its internal systems and source code repositories using authentication secrets stolen during a January cyberattack. [...] "

    Autosummary: "In recent weeks, we have seen evidence that Midnight Blizzard is using information initially exfiltrated from our corporate email systems to gain, or attempt to gain, unauthorized access," reads a new blog post by the Microsoft Security Response Center. "

    ---

    Ukraine claims it hacked Russian Ministry of Defence, stole secrets and encryption ciphers

    rusia-ucrania
    2024-03-06 https://www.bitdefender.com/blog/hotforsecurity/ukraine-claims-it-hacked-russian-ministry-of-defence-stole-secrets-and-encryption-ciphers/
    Ukraine claims its hackers have gained possession of "the information security and encryption software" used by Russia"s Ministry of Defence , as well as secret documents, reports, and instructions exchanged between over 2,000 units of Russia"s security services. Read more in my article on the Hot for Security blog. "

    Autosummary: According to an official statement from the Defence Intelligence of Ukraine, the hack has allowed Ukraine to gain possession of "the information security and encryption software" used by Russia"s Ministry of Defence (Minoborony), as well as secret documents, reports, and instructions exchanged between over 2,000 units of Russia"s security services. "

    ---

    Ukraine’s GUR hacked the Russian Ministry of Defense

    rusia-ucrania
    2024-03-05 https://securityaffairs.com/159981/cyber-warfare-2/ukraine-gur-hacked-russian-ministry-of-defense.html
    The Main Intelligence Directorate (GUR) of Ukraine’s Ministry of Defense claims that it hacked the Russian Ministry of Defense. The Main Intelligence Directorate (GUR) of Ukraine’s Ministry of Defense announced it had breached the Russian Ministry of Defense servers as part of a special operation, and exfiltrated confidential documents. Stolen documents include: The stolen documents […] "

    Autosummary: This encompasses deputies, assistants, and specialists, individuals who used the electronic document management systems known as ‘bureaucrat."” “Cyber ​​specialists of the Ministry of Defense of Ukraine implemented another successful special operation against the aggressor state of Russia – as a result of the attack, it was possible to gain access to the servers of the Ministry of Defense of the Russian Federation.” "

    ---

    Ukraine claims it hacked Russian Ministry of Defense servers

    rusia-ucrania
    2024-03-04 https://www.bleepingcomputer.com/news/security/ukraine-claims-it-hacked-russian-ministry-of-defense-servers/
    The Main Intelligence Directorate (GUR) of Ukraine"s Ministry of Defense claims that it breached the servers of the Russian Ministry of Defense (Minoborony) and stole sensitive documents. [...] "

    Autosummary: "

    ---

    Russian hackers hijack Ubiquiti routers to launch stealthy attacks

    rusia-ucrania
    2024-02-27 https://www.bleepingcomputer.com/news/security/russian-hackers-hijack-ubiquiti-routers-to-launch-stealthy-attacks/
    Russian APT28 military hackers are using compromised Ubiquiti EdgeRouters to evade detection, the FBI says in a joint advisory issued with the NSA, the U.S. Cyber Command, and international partners. [...] "

    Autosummary: Military Unit 26165 cyberspies, part of Russia"s Main Intelligence Directorate of the General Staff (GRU) and tracked as APT28 and Fancy Bear, are using these hijacked and very popular routers to build extensive botnets that help them steal credentials, collect NTLMv2 digests, and proxy malicious traffic. "

    ---

    Russian hackers shift to cloud attacks, US and allies warn

    rusia-ucrania
    2024-02-26 https://www.bleepingcomputer.com/news/security/russian-hackers-shift-to-cloud-attacks-us-and-allies-warn/
    Members of the Five Eyes (FVEY) intelligence alliance warned today that APT29 Russian Foreign Intelligence Service (SVR) hackers are now switching to attacks targeting their victims" cloud services. [...] "

    Autosummary: APT29"s initial cloud breach vectors also include the use of stolen access tokens that enable them to hijack accounts without using credentials, compromised residential routers to proxy their malicious activity, MFA fatigue to bypass multi-factor authentication (MFA), and registering their own devices as new devices on the victims" cloud tenants After gaining initial access, SVR hackers use sophisticated tools like the MagicWeb malware (which allows them to authenticate as any user within a compromised network) to evade detection in the victims"s networks, mainly government and critical organizations spanning Europe, the United States, and Asia. "

    ---

    Russian hacker is set to face trial for the hack of a local power grid

    rusia-ucrania
    2024-02-24 https://securityaffairs.com/159536/hacking/cyber-attack-power-plant-russia-hacker.html
    A Russian national (49) was charged with a cyberattack on a local power plant that caused a widespread blackout. The news agency TASS reported that a Russian national (49) is set to face trial on charges of carrying out a cyberattack on a local power plant that left 38 villages in the Vologda region in […] "

    Autosummary: "

    ---

    Russian Government Software Backdoored to Deploy Konni RAT Malware

    exploits government rusia-ucrania
    2024-02-22 https://thehackernews.com/2024/02/russian-government-software-backdoored.html
    An installer for a tool likely used by the Russian Consular Department of the Ministry of Foreign Affairs (MID) has been backdoored to deliver a remote access trojan called Konni RAT (aka UpDog). The findings come from German cybersecurity company DCSO, which linked the activity as originating from the Democratic People"s Republic of Korea (DPRK)-nexus actors targeting Russia. The "

    Autosummary: The remote access trojan, which comes with capabilities for file transfers and command execution, is believed to have been put to use as early as 2014, and has also been utilized by other North Korean threat actors known as Kimsuky and ScarCruft (aka APT37). "

    ---

    Russian Hackers Target Ukraine with Disinformation and Credential-Harvesting Attacks

    rusia-ucrania
    2024-02-21 https://thehackernews.com/2024/02/russian-hackers-target-ukraine-with.html
    Cybersecurity researchers have unearthed a new influence operation targeting Ukraine that leverages spam emails to propagate war-related disinformation. The activity has been linked to Russia-aligned threat actors by Slovak cybersecurity company ESET, which also identified a spear-phishing campaign aimed at a Ukrainian defense company in October 2023 and a European Union agency in November 2023 "

    Autosummary: Operation Texonto, as the entire campaign has been codenamed, has not been attributed to a specific threat actor, although some elements of it, particularly the spear-phishing attacks, overlap with COLDRIVER, which has a history of harvesting credentials via bogus sign-in pages. "

    ---

    Russian-Linked Hackers Breach 80+ Organizations via Roundcube Flaws

    rusia-ucrania
    2024-02-19 https://thehackernews.com/2024/02/russian-linked-hackers-breach-80.html
    Threat actors operating with interests aligned to Belarus and Russia have been linked to a new cyber espionage campaign that likely exploited cross-site scripting (XSS) vulnerabilities in Roundcube webmail servers to target over 80 organizations. These entities are primarily located in Georgia, Poland, and Ukraine, according to Recorded Future, which attributed the intrusion set to a threat "

    Autosummary: "

    ---

    U.S. Government Disrupts Russian-Linked Botnet Engaged in Cyber Espionage

    government rusia-ucrania
    2024-02-16 https://thehackernews.com/2024/02/us-government-disrupts-russian-linked.html
    The U.S. government on Thursday said it disrupted a botnet comprising hundreds of small office and home office (SOHO) routers in the country that was put to use by the Russia-linked APT28 actor to conceal its malicious activities. "These crimes included vast spear-phishing and similar credential harvesting campaigns against targets of intelligence interest to the Russian government, such as U.S. "

    Autosummary: APT28, also tracked under the monikers BlueDelta, Fancy Bear, Fighting Ursa, Forest Blizzard (formerly Strontium), FROZENLAKE, Iron Twilight, Pawn Storm, Sednit, Sofacy, and TA422, is assessed to be linked to Unit 26165 of Russia"s Main Directorate of the General Staff (GRU). "

    ---

    U.S. authorities disrupt Russian intelligence’s botnet

    rusia-ucrania
    2024-02-16 https://www.helpnetsecurity.com/2024/02/16/us-authorities-disrupt-russian-intelligence-botnet/
    

    In January 2024, an operation dismantled a network of hundreds of SOHO routers controlled by GRU Military Unit 26165, also known as APT 28, Sofacy Group, Forest Blizzard, Pawn Storm, Fancy Bear, and Sednit. This network facilitated various crimes, including extensive spearphishing and credential harvesting against entities of interest to the Russian government, such as U.S. and foreign governments, military, and key security and corporate sectors. This botnet was distinct from prior GRU and Russian … More →

    The post U.S. authorities disrupt Russian intelligence’s botnet appeared first on Help Net Security.

    "

    Autosummary: In January 2024, an operation dismantled a network of hundreds of SOHO routers controlled by GRU Military Unit 26165, also known as APT 28, Sofacy Group, Forest Blizzard, Pawn Storm, Fancy Bear, and Sednit. "

    ---

    Russian Turla Hackers Target Polish NGOs with New TinyTurla-NG Backdoor

    rusia-ucrania
    2024-02-15 https://thehackernews.com/2024/02/russian-turla-hackers-target-polish.html
    The Russia-linked threat actor known as Turla has been observed using a new backdoor called TinyTurla-NG as part of a three-month-long campaign targeting Polish non-governmental organizations in December 2023. "TinyTurla-NG, just like TinyTurla, is a small "last chance" backdoor that is left behind to be used when all other unauthorized access/backdoor mechanisms have failed or been "

    Autosummary: "

    ---

    FBI disrupts Moobot botnet used by Russian military hackers

    rusia-ucrania
    2024-02-15 https://www.bleepingcomputer.com/news/security/fbi-disrupts-moobot-botnet-used-by-russian-military-hackers/
    The FBI took down a botnet of small office/home office (SOHO) routers used by Russia"s Main Intelligence Directorate of the General Staff (GRU) to proxy malicious traffic and to target the United States and its allies in spearphishing and credential theft attacks. [...] "

    Autosummary: "Additionally, in order to neutralize the GRU"s access to the routers until victims can mitigate the compromise and reassert full control, the operation reversibly modified the routers" firewall rules to block remote management access to the devices, and during the course of the operation, enabled temporary collection of non-content routing information that would expose GRU attempts to thwart the operation," the Justice Department said. "

    ---

    FBI disrupts Russian Moobot botnet infecting Ubiquiti routers

    rusia-ucrania
    2024-02-15 https://www.bleepingcomputer.com/news/security/fbi-disrupts-russian-moobot-botnet-infecting-ubiquiti-routers/
    The FBI took down a botnet of small office/home office (SOHO) routers used by Russia"s Main Intelligence Directorate of the General Staff (GRU) to proxy malicious traffic and to target the United States and its allies in spearphishing and credential theft attacks. [...] "

    Autosummary: "Additionally, in order to neutralize the GRU"s access to the routers until victims can mitigate the compromise and reassert full control, the operation reversibly modified the routers" firewall rules to block remote management access to the devices, and during the course of the operation, enabled temporary collection of non-content routing information that would expose GRU attempts to thwart the operation," the Justice Department said. "

    ---

    Belarusian National Linked to BTC-e Faces 25 Years for $4 Billion Crypto Money Laundering

    financial rusia-ucrania
    2024-02-05 https://thehackernews.com/2024/02/belarusian-national-linked-to-btc-e.html
    A 42-year-old Belarusian and Cypriot national with alleged connections to the now-defunct cryptocurrency exchange BTC-e is facing charges related to money laundering and operating an unlicensed money services business. Aliaksandr Klimenka, who was arrested in Latvia on December 21, 2023, was extradited to the U.S. If convicted, he faces a maximum penalty of 25 years in prison. BTC-e, which had "

    Autosummary: Urban, who went by the aliases Sosa, Elijah, King Bob, Anthony Ramirez, and Gustavo Fring, is said to be a key member of the cybercrime group known as Scattered Spider, according to KrebsOnSecurity, as well as a "top member" of a broader cybercrime ecosystem that calls itself The Com. "

    ---

    Russian APT28 Hackers Targeting High-Value Orgs with NTLM Relay Attacks

    rusia-ucrania
    2024-02-02 https://thehackernews.com/2024/02/russian-apt28-hackers-targeting-high.html
    Russian state-sponsored actors have staged NT LAN Manager (NTLM) v2 hash relay attacks through various methods from April 2022 to November 2023, targeting high-value targets worldwide. The attacks, attributed to an "aggressive" hacking crew called APT28, have set their eyes on organizations dealing with foreign affairs, energy, defense, and transportation, as well as those involved with "

    Autosummary: APT28 is also tracked by the broader cybersecurity community under the names Blue Athena, BlueDelta, Fancy Bear, Fighting Ursa, Forest Blizzard (formerly Strontium), FROZENLAKE, Iron Twilight, ITG05, Pawn Storm, Sednit, Sofacy, and TA422. "

    ---

    Pro-Ukraine hackers wiped 2 petabytes of data from Russian research center

    rusia-ucrania
    2024-01-27 https://securityaffairs.com/158214/hacktivism/ukraines-ministry-of-defense-hit-russian-recent-center.html
    The Main Intelligence Directorate of Ukraine’s Ministry of Defense states that pro-Ukraine hackers wiped 2 petabytes of data from a Russian research center. The Main Directorate of Intelligence of the Ministry of Defense of Ukraine revealed that pro-Ukraine hackers group “BO Team” wiped the database of the Far Eastern Scientific Research Center of Space Hydrometeorology […] "

    Autosummary: Pro-Ukraine hackers wiped 2 petabytes of data from Russian research center Pierluigi Paganini January 27, 2024 January 27, 2024 The Main Intelligence Directorate of Ukraine’s Ministry of Defense states that pro-Ukraine hackers wiped 2 petabytes of data from a Russian research center. "

    ---

    Russian TrickBot Mastermind Gets 5-Year Prison Sentence for Cybercrime Spree

    rusia-ucrania
    2024-01-26 https://thehackernews.com/2024/01/russian-trickbot-mastermind-gets-5-year.html
    40-year-old Russian national Vladimir Dunaev has been sentenced to five years and four months in prison for his role in creating and distributing the TrickBot malware, the U.S. Department of Justice (DoJ) said. The development comes nearly two months after Dunaev pleaded guilty to committing computer fraud and identity theft and conspiracy to commit wire fraud and bank fraud. " "

    Autosummary: Cybersecurity firm Intel 471 said Ermakov went by various online aliases such as blade_runner, GustaveDore, JimJones, aiiis_ermak, GistaveDore, gustavedore, GustaveDore, Gustave7Dore, ProgerCC, SHTAZI, and shtaziIT. "

    ---

    Russian Midnight Blizzard APT is targeting orgs worldwide, Microsoft warns

    rusia-ucrania
    2024-01-26 https://securityaffairs.com/158164/apt/midnight-blizzard-apt-cyberespionage.html
    Microsoft revealed that Russia-linked APT Midnight Blizzard has been targeting organizations worldwide in a cyberespionage campaign. Microsoft announced that the Russia-linked APT Midnight Blizzard that hit the company in late November 2023 has been targeting organizations worldwide as part of a large-scale cyberespionage campaign. The IT giant also confirmed that is currently notifying impacted organizations. […] "

    Autosummary: The Midnight Blizzard group (aka APT29, SVR group, Cozy Bear, Nobelium, BlueBravo, and The Dukes) along with APT28 cyber espionage group was involved in the Democratic National Committee hack and the wave of attacks aimed at the 2016 US Presidential Elections. "

    ---

    Ukraine: Hack wiped 2 petabytes of data from Russian research center

    rusia-ucrania
    2024-01-26 https://www.bleepingcomputer.com/news/security/ukraine-hack-wiped-2-petabytes-of-data-from-russian-research-center/
    The Main Intelligence Directorate of Ukraine"s Ministry of Defense claims that pro-Ukrainian hacktivists breached the Russian Center for Space Hydrometeorology, aka "planeta" (планета), and wiped 2 petabytes of data. [...] "

    Autosummary: "Among the destroyed data are meteorological and satellite data, which were actively used in constant mode by the Ministry of Defense and MNS RF, "Roscosmos," and several other state agencies-aggressors, as well as years of unique research," reads the announcement (machine translated). "

    ---

    Tech Giant HP Enterprise Hacked by Russian Hackers Linked to DNC Breach

    rusia-ucrania
    2024-01-25 https://thehackernews.com/2024/01/tech-giant-hp-enterprise-hacked-by.html
    Hackers with links to the Kremlin are suspected to have infiltrated information technology company Hewlett Packard Enterprise"s (HPE) cloud email environment to exfiltrate mailbox data. "The threat actor accessed and exfiltrated data beginning in May 2023 from a small percentage of HPE mailboxes belonging to individuals in our cybersecurity, go-to-market, business segments, and other functions," "

    Autosummary: "

    ---

    Russian hackers breached Microsoft, HPE corporate maliboxes

    rusia-ucrania
    2024-01-25 https://www.helpnetsecurity.com/2024/01/25/cozy-bear-microsoft-hpe/
    

    Cozy Bear (aka Midnight Blizzard, aka APT29) has been busy hacking and spying on big tech companies: both Microsoft and Hewlett Packard Enterprise (HPE) have recently disclosed successful attack campaigns by the Russia-affiliated APT group. The Microsoft breach Last Friday, Microsoft revealed that a threat-actor identified as Midnight Blizzard – a hacking group believed to be associated with the Russian Foreign Intelligence Service (SVR) – has breached their corporate systems on January 12, 2024. The … More →

    The post Russian hackers breached Microsoft, HPE corporate maliboxes appeared first on Help Net Security.

    "

    Autosummary: "

    ---

    Russian TrickBot malware dev sentenced to 64 months in prison

    exploits rusia-ucrania
    2024-01-25 https://www.bleepingcomputer.com/news/security/russian-trickbot-malware-dev-sentenced-to-64-months-in-prison/
    Russian national Vladimir Dunaev has been sentenced to five years and four months in prison for his role in creating and distributing the Trickbot malware used in attacks against hospitals, companies, and individuals worldwide. [...] "

    Autosummary: The TrickBot malware he helped develop enabled cybercriminals to collect infected victims" sensitive information (such as login credentials, credit card information, emails, passwords, social security numbers, and addresses) and siphon off funds from victims" bank accounts Dunaev is the second TrickBot malware dev prosecuted by the U.S. Department of Justice after Latvian national Alla Witte (aka Max) was apprehended in February 2021 and charged with helping develop the module designed to deploy ransomware on compromised networks. "

    ---

    U.S., U.K., Australia Sanction Russian REvil Hacker Behind Medibank Breach

    financial rusia-ucrania
    2024-01-24 https://thehackernews.com/2024/01/us-uk-australia-sanction-russian-revil.html
    Governments from Australia, the U.K., and the U.S. have imposed financial sanctions on a Russian national for his alleged role in the 2022 ransomware attack against health insurance provider Medibank. Alexander Ermakov (aka blade_runner, GistaveDore, GustaveDore, or JimJones), 33, has been tied to the breach of the Medibank network as well as the theft and release of Personally Identifiable "

    Autosummary: "

    ---

    HPE: Russian hackers breached its security team’s email accounts

    rusia-ucrania
    2024-01-24 https://www.bleepingcomputer.com/news/security/hpe-russian-hackers-breached-its-security-teams-email-accounts/
    Hewlett Packard Enterprise (HPE) disclosed today that suspected Russian hackers known as Midnight Blizzard gained access to the company"s Microsoft Office 365 email environment to steal data from its cybersecurity team and other departments. [...] "

    Autosummary: "Based on our investigation, we now believe that the threat actor accessed and exfiltrated data beginning in May 2023 from a small percentage of HPE mailboxes belonging to individuals in our cybersecurity, go-to-market, business segments, and other functions," reads the SEC filing. "

    ---

    Russian hackers stole Microsoft corporate emails in month-long breach

    rusia-ucrania
    2024-01-20 https://www.bleepingcomputer.com/news/security/russian-hackers-stole-microsoft-corporate-emails-in-month-long-breach/
    Microsoft disclosed Friday night that some of its corporate email accounts were breached and data stolen by the Russian state-sponsored hacking group Midnight Blizzard. [...] "

    Autosummary: The company detected the attack on January 12th, with Microsoft initiating its response to investigate, disrupt, and mitigate the breach. "

    ---

    Google: Russian FSB hackers deploy new Spica backdoor malware

    exploits rusia-ucrania
    2024-01-18 https://www.bleepingcomputer.com/news/security/google-russian-fsb-hackers-deploy-new-spica-backdoor-malware/
    Google says the ColdRiver Russian-backed hacking group is pushing previously unknown backdoor malware using payloads masquerading as a PDF decryption tool. [...] "

    Autosummary: PDF lure document (Google TAG) The Spica Rust-based malware uses JSON over websockets to communicate with its command-and-control (C2) server, and it helps to run arbitrary shell commands, steal Chrome, Firefox, Opera, and Edge cookies, upload and download files, and exfiltrate documents. "

    ---

    Russian COLDRIVER Hackers Expand Beyond Phishing with Custom Malware

    financial exploits rusia-ucrania
    2024-01-18 https://thehackernews.com/2024/01/russian-coldriver-hackers-expand-beyond.html
    The Russia-linked threat actor known as COLDRIVER has been observed evolving its tradecraft to go beyond credential harvesting to deliver its first-ever custom malware written in the Rust programming language. Google"s Threat Analysis Group (TAG), which shared details of the latest activity, said the attack chains leverage PDFs as decoy documents to trigger the infection sequence. The lures are "

    Autosummary: COLDRIVER, also known by the names Blue Callisto, BlueCharlie (or TAG-53), Calisto (alternately spelled Callisto), Gossamer Bear, Star Blizzard (formerly SEABORGIUM), TA446, and UNC4057, is known to be active since 2019, targeting a wide range of sectors. "

    ---

    Google TAG warns that Russian COLDRIVER APT is using a custom backdoor

    rusia-ucrania
    2024-01-18 https://securityaffairs.com/157705/apt/google-warns-coldriver-malware.html
    Google warns that the Russia-linked threat actor COLDRIVER expands its targeting and is developing a custom malware. The ColdRiver APT (aka “Seaborgium“, “Callisto”, “Star Blizzard”, “TA446”) is a Russian cyberespionage group that has been targeting government officials, military personnel, journalists and think tanks since at least 2015. In the past, the group’s activity involved persistent phishing […] "

    Autosummary: Spica supports multiple capabilities, such as: Executing arbitrary shell commands Stealing cookies from Chrome, Firefox, Opera and Edge Uploading and downloading files Perusing the filesystem by listing the contents of it Enumerating documents and exfiltrating them in an archive There is also a command called “telegram,” but the functionality of this command is unclear The malware maintains persistence via an obfuscated PowerShell command that creates a scheduled task named CalendarChecker. "

    ---

    Pro-Ukraine hackers breach Russian ISP in revenge for KyivStar attack

    rusia-ucrania
    2024-01-10 https://www.bleepingcomputer.com/news/security/pro-ukraine-hackers-breach-russian-isp-in-revenge-for-kyivstar-attack/
    A pro-Ukraine hacktivist group named "Blackjack" has claimed a cyberattack against Russian provider of internet services M9com as a direct response to the attack against Kyivstar mobile operator. [...] "

    Autosummary: "

    ---

    Russian Hackers Had Covert Access to Ukraine"s Telecom Giant for Months

    rusia-ucrania Telcos
    2024-01-05 https://thehackernews.com/2024/01/russian-hackers-had-covert-access-to.html
    Ukrainian cybersecurity authorities have disclosed that the Russian state-sponsored threat actor known as Sandworm was inside telecom operator Kyivstar"s systems at least since May 2023. The development was first reported by Reuters. The incident, described as a "powerful hacker attack," first came to light last month, knocking out access to mobile and internet services "

    Autosummary: "

    ---

    Russian hackers wiped thousands of systems in KyivStar attack

    rusia-ucrania
    2024-01-04 https://www.bleepingcomputer.com/news/security/russian-hackers-wiped-thousands-of-systems-in-kyivstar-attack/
    The Russian hackers behind a December breach of Kyivstar, Ukraine"s largest telecommunications service provider, have wiped all systems on the telecom operator"s core network. [...] "

    Autosummary: "We attacked Kyivstar because the company provides communications to the Armed Forces of Ukraine, as well as government agencies and law enforcement agencies of Ukraine." Today, Vityuk confirmed that Sandworm was behind the December attack on Kyivstar, saying that this Russian military intelligence unit carried out other cyberattacks targeting Ukrainian targets, "in particular [..] telecom operators and ISPs. "

    ---

    Russian military hackers target Ukraine with new MASEPIE malware

    exploits rusia-ucrania
    2023-12-28 https://www.bleepingcomputer.com/news/security/russian-military-hackers-target-ukraine-with-new-masepie-malware/
    Ukraine"s Computer Emergency Response Team (CERT) is warning of a new phishing campaign that allowed Russia-linked hackers to deploy previously unseen malware on a network in under one hour. [...] "

    Autosummary: "

    ---

    Cloud Atlas" Spear-Phishing Attacks Target Russian Agro and Research Companies

    financial rusia-ucrania
    2023-12-25 https://thehackernews.com/2023/12/cloud-atlas-spear-phishing-attacks.html
    The threat actor referred to as Cloud Atlas has been linked to a set of spear-phishing attacks on Russian enterprises. Targets included a Russian agro-industrial enterprise and a state-owned research company, according to a report from F.A.C.C.T., a standalone cybersecurity company formed after Group-IB"s formal exit from Russia earlier this year. Cloud Atlas, active since at "

    Autosummary: Also called Clean Ursa, Inception, Oxygen, and Red October, the threat actor is known for its persistent campaigns targeting Russia, Belarus, Azerbaijan, Turkey, and Slovenia. "

    ---

    Ukraine war: How TikTok fakes pushed Russian lies to millions

    rusia-ucrania
    2023-12-15 https://www.bbc.co.uk/news/world-europe-67687449?at_medium=RSS&at_campaign=KARANGA
    The BBC uncovers a vast Russia-based network of fake TikTok accounts pushing disinformation about Ukraine. "

    Autosummary: "

    ---

    French authorities arrested a Russian national for his role in the Hive ransomware operation

    exploits ransomware rusia-ucrania
    2023-12-14 https://securityaffairs.com/155815/cyber-crime/french-authorities-hive-ransomware-member.html
    French police arrested a Russian national who is suspected of laundering money resulting from the criminal activity of the Hive ransomware gang. The French authorities arrested in Paris a Russian national who is suspected of laundering criminal proceeds for the Hive ransomware gang. “A Russian, suspected of having recovered in cryptocurrencies the money taken from […] "

    Autosummary: The authorities reported that from June 2021 through at least November 2022, threat actors targeted a wide range of businesses and critical infrastructure sectors, including Government Facilities, Communications, Critical Manufacturing, Information Technology, and especially Healthcare and Public Health (HPH). "

    ---

    Russian hackers target unpatched JetBrains TeamCity servers

    government rusia-ucrania
    2023-12-14 https://www.helpnetsecurity.com/2023/12/14/russian-hackers-cve-2023-42793/
    

    Russian state-sponsored hackers have been exploiting CVE-2023-42793 to target unpatched, internet-facing JetBrains TeamCity servers since September 2023, US, UK and Polish cybersecurity and law enforcement authorities have warned. The targets APT 29 (aka CozyBear, aka Midnight Blizzard), believed to be associated with the Russian Foreign Intelligence Service (SVR), has been active since 2013. The group is known for targeting a wide variety of organizations: government agencies, think tanks, political organizations, diplomatic agencies, biomedical and energy … More →

    The post Russian hackers target unpatched JetBrains TeamCity servers appeared first on Help Net Security.

    "

    Autosummary: These attacks seem to be opportunistic in nature and hit disparate organizations in the US, Europe, Asia, and Australia: “an energy trade association; companies that provide software for billing, medical devices, customer care, employee monitoring, financial management, marketing, sales, and video games; as well as hosting companies, tools manufacturers, and small and large IT companies.” "

    ---

    Russian SVR-Linked APT29 Targets JetBrains TeamCity Servers in Ongoing Attacks

    government rusia-ucrania
    2023-12-14 https://thehackernews.com/2023/12/russian-svr-linked-apt29-targets.html
    Threat actors affiliated with the Russian Foreign Intelligence Service (SVR) have targeted unpatched JetBrains TeamCity servers in widespread attacks since September 2023. The activity has been tied to a nation-state group known as APT29, which is also tracked as BlueBravo, Cloaked Ursa, Cozy Bear, Midnight Blizzard (formerly Nobelium), and The Dukes. It"s notable for the supply chain "

    Autosummary: Targets of the campaign include an energy trade association; firms that provide software for billing, medical devices, customer care, employee monitoring, financial management, marketing, sales, and video games; as well as hosting companies, tools manufacturers, and small and large IT enterprises. "The SVR has, however, been observed using the initial access gleaned by exploiting the TeamCity CVE to escalate its privileges, move laterally, deploy additional backdoors, and take other steps to ensure persistent and long-term access to the compromised network environments," cybersecurity agencies from Poland, the U.K., and the U.S. said. "

    ---

    CISA: Russian hackers target TeamCity servers since September

    government rusia-ucrania
    2023-12-13 https://www.bleepingcomputer.com/news/security/cisa-russian-hackers-target-teamcity-servers-since-september/
    CISA and partner cybersecurity agencies and intelligence services warned that the APT29 hacking group linked to Russia"s Foreign Intelligence Service (SVR) has been targeting unpatched TeamCity servers in widespread attacks since September 2023. [...] "

    Autosummary: "By choosing to exploit CVE-2023-42793, a software development program, the authoring agencies assess the SVR could benefit from access to victims, particularly by allowing the threat actors to compromise the networks of dozens of software developers," CISA warned today. "

    ---

    French police arrests Russian suspect linked to Hive ransomware

    exploits ransomware rusia-ucrania
    2023-12-13 https://www.bleepingcomputer.com/news/security/french-police-arrests-russian-suspect-linked-to-hive-ransomware/
    French authorities arrested a Russian national in Paris for allegedly helping the Hive ransomware gang with laundering their victims" ransom payments. [...] "

    Autosummary: "At the same time, the full cooperation with Europol, Eurojust and the Cypriot authorities made it possible to search his home in a Cypriot seaside resort, thus providing important elements of investigation," said Nicolas Guidoux, a Deputy Director in the French Ministry of the Interior. "

    ---

    Russian APT28 Hackers Targeting 13 Nations in Ongoing Cyber Espionage Campaign

    rusia-ucrania
    2023-12-12 https://thehackernews.com/2023/12/russian-apt28-hackers-targeting-13.html
    The Russian nation-state threat actor known as APT28 has been observed making use of lures related to the ongoing Israel-Hamas war to facilitate the delivery of a custom backdoor called HeadLace. IBM X-Force is tracking the adversary under the name ITG05, which is also known as BlueDelta, Fancy Bear, Forest Blizzard (formerly Strontium), FROZENLAKE, Iron Twilight, Sednit, Sofacy, and "

    Autosummary: "

    ---

    Ukrainian military intelligence service hacked the Russian Federal Taxation Service

    rusia-ucrania
    2023-12-12 https://securityaffairs.com/155727/cyber-warfare-2/ukraine-hacked-russian-federal-taxation-service.html
    The Ukrainian government’s military intelligence service announced the hack of the Russian Federal Taxation Service (FNS). Hackers of the Main Intelligence Directorate of the Ministry of Defense of Ukraine announced they have compromised the Russian Federal Taxation Service (FNS). The military intelligence service said that the hack was the result of a successful special operation […] "

    Autosummary: “During the special operation, military intelligence managed to break into one of the well-protected key central servers of the Federal Tax Service (FSS of the Russian Federation), and further into more than 2,300 of its regional servers throughout Russia, as well as in the territory of the temporarily occupied Crimea.” reads a statement published by the Main Intelligence Directorate of the Ministry of Defense of Ukraine. "

    ---

    Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally

    exploits government rusia-ucrania
    2023-12-12 https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
    

    SUMMARY

    The U.S. Federal Bureau of Investigation (FBI), U.S. Cybersecurity & Infrastructure Security Agency (CISA), U.S. National Security Agency (NSA), Polish Military Counterintelligence Service (SKW), CERT Polska (CERT.PL), and the UK’s National Cyber Security Centre (NCSC) assess Russian Foreign Intelligence Service (SVR) cyber actors—also known as Advanced Persistent Threat 29 (APT 29), the Dukes, CozyBear, and NOBELIUM/Midnight Blizzard—are exploiting CVE-2023-42793 at a large scale, targeting servers hosting JetBrains TeamCity software since September 2023.

    Software developers use TeamCity software to manage and automate software compilation, building, testing, and releasing. If compromised, access to a TeamCity server would provide malicious actors with access to that software developer’s source code, signing certificates, and the ability to subvert software compilation and deployment processes—access a malicious actor could further use to conduct supply chain operations. Although the SVR used such access to compromise SolarWinds and its customers in 2020, limited number and seemingly opportunistic types of victims currently identified, indicate that the SVR has not used the access afforded by the TeamCity CVE in a similar manner. The SVR has, however, been observed using the initial access gleaned by exploiting the TeamCity CVE to escalate its privileges, move laterally, deploy additional backdoors, and take other steps to ensure persistent and long-term access to the compromised network environments.

    To bring Russia’s actions to public attention, the authoring agencies are providing information on the SVR’s most recent compromise to aid organizations in conducting their own investigations and securing their networks, provide compromised entities with actionable indicators of compromise (IOCs), and empower private sector cybersecurity companies to better detect and counter the SVR’s malicious actions. The authoring agencies r "

    Autosummary: SQL Server executable files - based on the review of the post exploitation actions, the SVR showed an interest in specific files of the SQL Server installed on the compromised systems: C:\Program Files\Microsoft SQL Server\MSSQL14.MSSQLSERVER\MSSQL\Binn\sqlmin.dll, C:\Program Files\Microsoft SQL Server\MSSQL14.MSSQLSERVER\MSSQL\Binn\sqllos.dll, C:\Program Files\Microsoft SQL Server\MSSQL14.MSSQLSERVER\MSSQL\Binn\sqllang.dll, C:\Program Files\Microsoft SQL Server\MSSQL14.MSSQLSERVER\MSSQL\Binn\sqltses.dll C:\Program Files\Microsoft SQL Server\MSSQL14.MSSQLSERVER\MSSQL\Binn\secforwarder.dll Visual Studio files – based on the review of the post exploitation actions, the SVR showed an interest in specific files of the Visual Studio: C:\Program Files (x86)\Microsoft Visual Studio\2017\SQL\Common7\IDE\VSIXAutoUpdate.exe Update management agent files – based on the review of the post exploitation actions, the SVR showed an interest in executables and configuration of patch management software: C:\Program Files (x86)\PatchManagementInstallation\Agent\12\Httpd\bin\httpd.exe C:\Program Files (x86)\PatchManagementInstallation\Agent\12\Httpd C:\ProgramData\GFI\LanGuard 12\HttpdConfig\httpd.conf Interest in SQL Server Based on the review of the exploitation, the SVR also showed an interest in details of the SQL Server [T1059.001],[T1505.001]: powershell Compress-Archive -Path "C:\Program Files\Microsoft SQL Server\MSSQL14.MSSQLSERVER\MSSQL\Binn\sqlmin.dll","C:\Program Files\Microsoft SQL Server\MSSQL14.MSSQLSERVER\MSSQL\Binn\sqllos.dll","C:\Program Files\Microsoft SQL Server\MSSQL14.MSSQLSERVER\MSSQL\Binn\sqllang.dll","C:\Program Files\Microsoft SQL Server\MSSQL14.MSSQLSERVER\MSSQL\Binn\sqltses.dll" -DestinationPath C:\Windows\temp\1\sql.zip SVR cyber actors also exfiltrated secforwarder.dll Tactics Used to Avoid Detection To avoid detection, the SVR used a “Bring Your Own Vulnerable Driver” nltest -dclist nltest -dsgetdc tasklist netstat wmic /node:""<redacted>"" /user:""<redacted>"" /password:""<redacted>"" process list brief wmic /node:""<redacted>"" process list brief wmic process get commandline -all wmic process <proc_id> get commandline wmic process where name=""GoogleCrashHandler64.exe"" get commandline,processed powershell ([adsisearcher]"((samaccountname=<redacted>))").Findall().Properties powershell ([adsisearcher]"((samaccountname=<redacted>))").Findall().Properties.memberof powershell Get-WmiObject -Class Win32_Service -Computername powershell Get-WindowsDriver -Online -AllSUMMARY The U.S. Federal Bureau of Investigation (FBI), U.S. Cybersecurity & Infrastructure Security Agency (CISA), U.S. National Security Agency (NSA), Polish Military Counterintelligence Service (SKW), CERT Polska (CERT.PL), and the UK’s National Cyber Security Centre (NCSC) assess Russian Foreign Intelligence Service (SVR) cyber actors—also known as Advanced Persistent Threat 29 (APT 29), the Dukes, CozyBear, and NOBELIUM/Midnight Blizzard—are exploiting CVE-2023-42793 at a large scale, targeting servers hosting JetBrains TeamCity software since September 2023.REG_DWORD /d "0" /f The SVR used the following Mimikatz commands [T1003]: privilege::debug lsadump::cache lsadump::secrets lsadump::sam sekurlsa::logonpasswords Persistence The SVR relied on scheduled tasks [T1053.005] to secure persistent execution of backdoors.[T1564], illustrated below: Privilege Escalation To facilitate privilege escalation [T1098], the SVR used multiple techniques, including WinPEAS, NoLmHash registry key modification, and the Mimikatz tool. BMP files that were used to exchange data were generated in the following way: Compress data using zlib, Encrypt data using custom algorithm, Add “***” string literal to encrypted data, Create a random BMP with random rectangle, And finally, encode encrypted data within lower pixel bits.Get-NetUser -UACFilter NOT_ACCOUNTDISABLE | select samaccountname, description, pwdlastset, logoncount, badpwdcount" Get-NetDiDomain Get-AdUser Get-DomainUser -UserName "

    ---

    UK and US expose Russian hacking plot intended to influence UK’s 2019 elections and spread disinformation

    rusia-ucrania
    2023-12-08 https://www.bitdefender.com/blog/hotforsecurity/uk-and-us-expose-russian-hacking-plot-intended-to-influence-uks-2019-elections-and-spread-disinformation/
    Two men have been charged with hacking into computer networks in the United States, UK, other NATO countries, and Ukraine, on behalf of the Russian government. Read more in my article on the Hot for Security blog. "

    Autosummary: The men are said to be members of the Callisto Group (also known as Star Blizzard, SEABORGIUM, TA446, COLDRIVER, TAG-53, and BlueCharlie). Two men have been charged with hacking into computer networks in the United States, UK, other NATO countries, and Ukraine, on behalf of the Russian government. "

    ---

    Russian pleads guilty to running crypto-exchange used by ransomware gangs

    exploits ransomware rusia-ucrania
    2023-12-07 https://www.bleepingcomputer.com/news/security/russian-pleads-guilty-to-running-crypto-exchange-used-by-ransomware-gangs/
    Russian national Anatoly Legkodymov pleaded guilty to operating the Bitzlato cryptocurrency exchange that helped ransomware gangs and other cybercriminals launder over $700 million. [...] "

    Autosummary: As a Bitzlato co-founder and principal stakeholder, Legkodymov (also known as "Gandalf" and "Tolik") has agreed to disband the cryptocurrency exchange and relinquish any rights to approximately $23 million in seized assets, as outlined in the plea agreement. "

    ---

    UK and allies expose Russian FSB hacking group, sanction members

    rusia-ucrania
    2023-12-07 https://www.bleepingcomputer.com/news/security/uk-and-allies-expose-russian-fsb-hacking-group-sanction-members/
    The UK National Cyber Security Centre (NCSC) and Microsoft warn that the Russian state-backed actor "Callisto Group" (aka "Seaborgium" or "Star Blizzard") is targeting organizations worldwide with spear-phishing campaigns used to steal account credentials and data. [...] "

    Autosummary: Callisto"s latest tactics In a bulletin published today, the UK"s NCSC says Callisto remains focused on launching spear-phishing attacks targeting the country"s governmental organizations, think tanks, politicians, defense-industrial units, and various NGOs. In addition, the UK says the group is behind credential and data theft attacks against parliamentarians from multiple political parties, universities, journalists, the public sector, non-government organizations, and other civil society organizations. "

    ---

    Russian military hackers target NATO fast reaction corps

    rusia-ucrania
    2023-12-07 https://www.bleepingcomputer.com/news/security/russian-military-hackers-target-nato-fast-reaction-corps/
    Russian APT28 military hackers used Microsoft Outlook zero-day exploits to target multiple European NATO member countries, including a NATO Rapid Deployable Corps. [...] "

    Autosummary: Additionally, beyond European Defense, Foreign Affairs, and Internal Affairs agencies, APT28"s focus extended to critical infrastructure organizations involved in energy production and distribution, pipeline infrastructure operations, and material handling, personnel, and air transportation. "

    ---

    Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spear-phishing Campaigns

    financial ransomware rusia-ucrania
    2023-12-06 https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a
    

    The Russia-based actor is targeting organizations and individuals in the UK and other geographical areas of interest.

    OVERVIEW

    The Russia-based actor Star Blizzard (formerly known as SEABORGIUM, also known as Callisto Group/TA446/COLDRIVER/TAG-53/BlueCharlie) continues to successfully use spear-phishing attacks against targeted organizations and individuals in the UK, and other geographical areas of interest, for information-gathering activity.

    The UK National Cyber Security Centre (NCSC), the US Cybersecurity and Infrastructure Security Agency (CISA), the US Federal Bureau of Investigation (FBI), the US National Security Agency (NSA), the US Cyber National Mission Force (CNMF), the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), the Canadian Centre for Cyber Security (CCCS), and the New Zealand National Cyber Security Centre (NCSC-NZ) assess that Star Blizzard is almost certainly subordinate to the Russian Federal Security Service (FSB) Centre 18.

    Industry has previously published details of Star Blizzard. This advisory draws on that body of information.

    This advisory raises awareness of the spear-phishing techniques Star Blizzard uses to target individuals and organizations. This activity is continuing through 2023.

    To download a PDF version of this advisory, see Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spear-phishing Campaigns.

    TARGETING PROFILE

    Since 2019, Star Blizzard has targeted sectors including academia, defense, governmental organizations, NGOs, think tanks and politicians.

    Tar "

    Autosummary: The UK National Cyber Security Centre (NCSC), the US Cybersecurity and Infrastructure Security Agency (CISA), the US Federal Bureau of Investigation (FBI), the US National Security Agency (NSA), the US Cyber National Mission Force (CNMF), the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), the Canadian Centre for Cyber Security (CCCS), and the New Zealand National Cyber Security Centre (NCSC-NZ) assess that Star Blizzard is almost certainly subordinate to the Russian Federal Security Service (FSB) Centre 18. OVERVIEW The Russia-based actor Star Blizzard (formerly known as SEABORGIUM, also known as Callisto Group/TA446/COLDRIVER/TAG-53/BlueCharlie) continues to successfully use spear-phishing attacks against targeted organizations and individuals in the UK, and other geographical areas of interest, for information-gathering activity. Star Blizzard uses webmail addresses from different providers, including Outlook, Gmail, Yahoo and Proton mail in their initial approach [T1585.002], impersonating known contacts of the target or well-known names in the target’s field of interest or sector. TARGETING PROFILE Since 2019, Star Blizzard has targeted sectors including academia, defense, governmental organizations, NGOs, think tanks and politicians.Spear-phishing Link Star Blizzard sends spear-phishing emails with malicious links directly to credential-stealing sites, or to documents hosted on a file-sharing site, which then direct victims to credential-stealing sites. "

    ---

    Russian hacker pleads guilty to Trickbot malware conspiracy

    exploits rusia-ucrania
    2023-12-05 https://www.bitdefender.com/blog/hotforsecurity/russian-hacker-pleads-guilty-to-trickbot-malware-conspiracy/
    A 40-year-old Russian man faces a lengthy prison sentence in the United States after pleading guilty to his involvement in the distribution and development of the notorious Trickbot malware. Read more in my article on the Hot for Security blog. "

    Autosummary: "

    ---

    Russian hackers use old Outlook vulnerability to target Polish orgs (CVE-2023-23397)

    exploits rusia-ucrania
    2023-12-05 https://www.helpnetsecurity.com/2023/12/05/apt28-poland-cve-2023-23397/
    

    Russian state-backed hacking group Forest Blizzard (aka Fancy Bear, aka APT28) has been using a known Microsoft Outlook vulnerability (CVE-2023-23397) to target public and private entities in Poland, Polish Cyber Command has warned. Compromising email accounts and maintaining access to them APT28 is known for targeting government, non-governmental, energy and transportation organizations in the US, Europe, and the Middle East. The most recent attacks were detected and reported by the computer security incident response team … More →

    The post Russian hackers use old Outlook vulnerability to target Polish orgs (CVE-2023-23397) appeared first on Help Net Security.

    "

    Autosummary: At the time of the release of the patch, CVE-2023-23397 was known to have been leveraged as a zero-day by a Russia-based threat actor “in targeted attacks against a limited number of organizations in government, transportation, energy, and military sectors in Europe.” "

    ---

    Russian hackers exploiting Outlook bug to hijack Exchange accounts

    exploits rusia-ucrania
    2023-12-04 https://www.bleepingcomputer.com/news/microsoft/russian-hackers-exploiting-outlook-bug-to-hijack-exchange-accounts/
    Microsoft"s Threat Intelligence team issued a warning earlier today about the Russian state-sponsored actor APT28 (aka "Fancybear" or "Strontium") actively exploiting the CVE-2023-23397 Outlook flaw to hijack Microsoft Exchange accounts and steal sensitive information. [...] "

    Autosummary: In October, the French cybersecurity agency (ANSSI) revealed that the Russian hackers had used the zero-click attack against government entities, businesses, universities, research institutes, and think tanks in France. "

    ---

    Russian Hacker Vladimir Dunaev Convicted for Creating TrickBot Malware

    exploits rusia-ucrania
    2023-12-02 https://thehackernews.com/2023/12/russian-hacker-vladimir-dunaev.html
    A Russian national has been found guilty in connection with his role in developing and deploying a malware known as TrickBot, the U.S. Department of Justice (DoJ) announced. Vladimir Dunaev, 40, was arrested in South Korea in September 2021 and extradited to the U.S. a month later. "Dunaev developed browser modifications and malicious tools that aided in credential harvesting and data "

    Autosummary: "

    ---

    Ukraine says it hacked Russian aviation agency, leaks data

    rusia-ucrania
    2023-11-27 https://www.bleepingcomputer.com/news/security/ukraine-says-it-hacked-russian-aviation-agency-leaks-data/
    Ukraine"s intelligence service, operating under the Defense Ministry, claims they hacked Russia"s Federal Air Transport Agency, "Rosaviatsia," to expose a purported collapse of Russia"s aviation sector. [...] "

    Autosummary: "An analysis of the character of aviation incidents from the documents obtained indicates that a number of failures, especially those related to engines, landing gear, and wing mechanics, are of a systemic type." "

    ---

    North Korea-linked Konni APT uses Russian-language weaponized documents

    rusia-ucrania
    2023-11-24 https://securityaffairs.com/154695/apt/konni-apt-russian-language-bait-doc.html
    North Korea-linked Konni APT group used Russian-language Microsoft Word documents to deliver malware. FortiGuard Labs researchers observed the North Korea-linked Konni APT group using a weaponized Russian-language Word document in an ongoing phishing campaign. The KONNI RAT was first spotted by Cisco Talos researchers in 2017, it has been undetected since 2014 and was employed in highly […] "

    Autosummary: North Korea-linked Konni APT uses Russian-language weaponized documents Pierluigi Paganini November 24, 2023 November 24, 2023 North Korea-linked Konni APT group used Russian-language Microsoft Word documents to deliver malware. "

    ---

    Konni Group Using Russian-Language Malicious Word Docs in Latest Attacks

    rusia-ucrania
    2023-11-23 https://thehackernews.com/2023/11/konni-group-using-russian-language.html
    A new phishing attack has been observed leveraging a Russian-language Microsoft Word document to deliver malware capable of harvesting sensitive information from compromised Windows hosts. The activity has been attributed to a threat actor called Konni, which is assessed to share overlaps with a North Korean cluster tracked as Kimsuky (aka APT43). "This campaign relies on a remote access trojan "

    Autosummary: " The Visual Basic for Application (VBA) macro subsequently proceeds to launch an interim Batch script that performs system checks, User Account Control (UAC) bypass, and ultimately paves the way for the deployment of a DLL file that incorporates information gathering and exfiltration capabilities. "

    ---

    Russian hackers use Ngrok feature and WinRAR exploit to attack embassies

    exploits rusia-ucrania
    2023-11-19 https://www.bleepingcomputer.com/news/security/russian-hackers-use-ngrok-feature-and-winrar-exploit-to-attack-embassies/
    After Sandworm and APT28 (known as Fancy Bear), another state-sponsored Russian hacker group, APT29, is leveraging the CVE-2023-38831 vulnerability in WinRAR for cyberattacks. [...] "

    Autosummary: Lure from Russian APT28 hackers with WinRAR exploit to target political entities source: ESET A report from Google in October notes that the security issue was exploited by Russian and Chinese state hackers to steal credentials and other sensitive data, as well as to establish persistence on target systems. "

    ---

    Russian Cyber Espionage Group Deploys LitterDrifter USB Worm in Targeted Attacks

    rusia-ucrania
    2023-11-18 https://thehackernews.com/2023/11/russian-cyber-espionage-group-deploys.html
    Russian cyber espionage actors affiliated with the Federal Security Service (FSB) have been observed using a USB propagating worm called LitterDrifter in attacks targeting Ukrainian entities. Check Point, which detailed Gamaredon"s (aka Aqua Blizzard, Iron Tilden, Primitive Bear, Shuckworm, and Winterflounder) latest tactics, branded the group as engaging in large-scale campaigns that are "

    Autosummary: The intrusions, attributed to APT29 (aka BlueBravo, Cloaked Ursa, Cozy Bear, Iron Hemlock, Midnight Blizzard, and The Dukes), involve the exploitation of the recently disclosed WinRAR vulnerability (CVE-2023-38831) via benign-looking lures that claim to offer BMWs for sale, a theme it has employed in the past. "

    ---

    Russian APT Gamaredon uses USB worm LitterDrifter against Ukraine

    rusia-ucrania
    2023-11-18 https://securityaffairs.com/154362/apt/gamaredon-apt-litterdrifter-usb.html
    Russia-linked cyberespionage group Gamaredon has been spotted propagating a worm called LitterDrifter via USB. Check Point researchers observed Russia-linked Gamaredon spreading the worm called LitterDrifter via USB in attacks against Ukraine. Gamaredon (aka Shuckworm, Actinium, Armageddon, Primitive Bear, UAC-0010, and Trident Ursa) has been active since 2014 and its activity focuses on Ukraine, the group was observed using the multistage backdoor Pteranodon/Pterodo. The Gamaredon APT group continues to carry out […] "

    Autosummary: Gamaredon (aka Shuckworm, Actinium, Armageddon, Primitive Bear, UAC-0010, and Trident Ursa) has been active since 2014 and its activity focuses on Ukraine, the group was observed using the multistage backdoor Pteranodon/Pterodo. Check Point researchers reported possible infections also in the U.S., Vietnam, Chile, Poland, Germany, and Hong Kong. "

    ---

    Russian Hackers Linked to "Largest Ever Cyber Attack" on Danish Critical Infrastructure

    rusia-ucrania
    2023-11-16 https://thehackernews.com/2023/11/russian-hackers-launch-largest-ever.html
    Russian threat actors have been possibly linked to what"s been described as the "largest cyber attack against Danish critical infrastructure," in which 22 companies associated with the operation of the country"s energy sector were targeted in May 2023.  "22 simultaneous, successful cyberattacks against Danish critical infrastructure are not commonplace," Denmark"s SektorCERT said [PDF]. "The "

    Autosummary: These attacks are suspected to have weaponized two more critical bugs in Zyxel gear (CVE-2023-33009 and CVE-2023-33010, CVSS scores: 9.8) as zero-days to co-opt the firewalls into Mirai and MooBot botnets, given that patches for them were released by the company on May 24, 2023. "

    ---

    U.S. Takes Down IPStorm Botnet, Russian-Moldovan Mastermind Pleads Guilty

    rusia-ucrania
    2023-11-15 https://thehackernews.com/2023/11/us-takes-down-ipstorm-botnet-russian.html
    The U.S. government on Tuesday announced the takedown of the IPStorm botnet proxy network and its infrastructure, as the Russian and Moldovan national behind the operation pleaded guilty. "The botnet infrastructure had infected Windows systems then further expanded to infect Linux, Mac, and Android devices, victimizing computers and other electronic devices around the world, including in Asia, "

    Autosummary: "

    ---

    Russian Hackers Sandworm Cause Power Outage in Ukraine Amidst Missile Strikes

    rusia-ucrania
    2023-11-10 https://thehackernews.com/2023/11/russian-hackers-sandworm-cause-power.html
    The notorious Russian hackers known as Sandworm targeted an electrical substation in Ukraine last year, causing a brief power outage in October 2022. The findings come from Google"s Mandiant, which described the hack as a "multi-event cyber attack" leveraging a novel technique for impacting industrial control systems (ICS). "The actor first used OT-level living-off-the-land (LotL) techniques to "

    Autosummary: "

    ---

    Russian hackers switch to LOTL technique to cause power outage

    rusia-ucrania
    2023-11-09 https://www.bleepingcomputer.com/news/security/russian-hackers-switch-to-lotl-technique-to-cause-power-outage/
    Russian state hackers have evolved their methods for breaching industrial control systems by adopting living-off-the-land techniques that enable reaching the final stage of the attack quicker and with less resources [...] "

    Autosummary: Inside the ISO file there were at least the following three files: “lun.vbs”, which runs n.bat “n.bat”, which likely runs the native scilc.exe utility “s1.txt”, which likely contains the unauthorized MicroSCADA commands The researcher found that the lun.vbs script had a September 23 timestamp, which suggests that the hackers had about two months to develop their OT capability since the initial access stage. "

    ---

    The largest Russian bank Sberbank hit by a massive DDoS attack

    financial rusia-ucrania
    2023-11-09 https://securityaffairs.com/153888/hacking/russian-bank-sberbank-massive-ddos-attack.html
    

    The largest and oldest bank in Russia Sberbank faced the record-breaking DDoS attack that reached 1 million RPS. Sberbank , the Russian banking and financial services giant, announced that it was recently hit by a record-breaking distributed denial of service (DDoS) attack that reached 1 million RPS. After the invasion of Ukraine, most Russian organizations […]

    The post The largest Russian bank Sberbank hit by a massive DDoS attack appeared first on Security Affairs.

    "

    Autosummary: That is, some new, very qualified criminals appeared on the market who began to systematically attack the largest Russian resources,” Gref said that Sberbank faces about ten attacks per month, but threat actors have never breached the systems at the bank.The largest Russian bank Sberbank hit by a massive DDoS attack Pierluigi Paganini November 09, 2023 November 09, 2023 The largest and oldest bank in Russia Sberbank faced the record-breaking DDoS attack that reached 1 million RPS. "

    ---

    Russian Sandworm disrupts power in Ukraine with a new OT attack

    rusia-ucrania
    2023-11-09 https://securityaffairs.com/153920/apt/russian-sandworm-ot-attacks.html
    

    Mandiant reported that Russia-linked Sandworm APT used a novel OT attack to cause power outages during mass missile strikes on Ukraine. Mandiant researchers reported that Russia-linked APT group Sandworm employed new operational technology (OT) attacks that caused power outages while the Russian army was conducting mass missile strikes on critical infrastructure in Ukraine in October. […]

    The post Russian Sandworm disrupts power in Ukraine with a new OT attack appeared first on Security Affairs.

    "

    Autosummary: In 2022, the Russian APT used multiple wipers in attacks aimed at Ukraine,including AwfulShred, CaddyWiper, HermeticWiper, Industroyer2, IsaacWiper, WhisperGate, Prestige, RansomBoggs, and ZeroWipe. The Sandworm group (aka BlackEnergy, UAC-0082, Iron Viking, Voodoo Bear, and TeleBots) has been active since 2000, it operates under the control of Unit 74455 of the Russian GRU’s Main Center for Special Technologies (GTsST). "

    ---

    Russian-speaking threat actor "farnetwork" linked to 5 ransomware gangs

    exploits ransomware rusia-ucrania
    2023-11-08 https://www.bleepingcomputer.com/news/security/russian-speaking-threat-actor-farnetwork-linked-to-5-ransomware-gangs/
    The operator of the Nokoyawa ransomware-as-a-service (RaaS), a threat actor known as "farnetwork", built experience over the years by helping the JSWORM, Nefilim, Karma, and Nemty affiliate programs with malware development and operation management. [...] "

    Autosummary: According to a report Group-IB shared with BleepingComputer, the threat actor has several usernames (e.g. farnetworkl, jingo, jsworm, razvrat, piparkuka, and farnetworkitand) and has been active on multiple Russian-speaking hacker forums trying to recruit affiliates for various ransomware operations. "

    ---

    Russian state-owned Sberbank hit by 1 million RPS DDoS attack

    financial government rusia-ucrania
    2023-11-08 https://www.bleepingcomputer.com/news/security/russian-state-owned-sberbank-hit-by-1-million-rps-ddos-attack/
    Russian financial organization Sberbank states in a press release that two weeks ago it faced the most powerful distributed denial of service (DDoS) attack in recent history. [...] "

    Autosummary: A more recent blow sufferend by Russia’s financial system concerns the National Payment Card System (NSPK), the Mir card operator, whose website became unavailable on October 30, 2023, and was later defaced to post messages about a client-impacting data breach. "

    ---

    U.S. Treasury Sanctions Russian Money Launderer in Cybercrime Crackdown

    financial rusia-ucrania
    2023-11-06 https://thehackernews.com/2023/11/us-treasury-targets-russian-money.html
    The U.S. Department of the Treasury imposed sanctions against a Russian woman for taking part in the laundering of virtual currency for the country"s elites and cybercriminal crews, including the Ryuk ransomware group. Ekaterina Zhdanova, per the department, is said to have facilitated large cross border transactions to assist Russian individuals to gain access to Western financial markets and "

    Autosummary: Ryuk, a predecessor to the Conti ransomware, first emerged on the threat landscape in 2018, and has compromised governments, academia, healthcare, manufacturing, and technology organizations worldwide. "

    ---

    US sanctions Russian who laundered money for Ryuk ransomware affiliate

    financial exploits ransomware rusia-ucrania
    2023-11-06 https://www.bleepingcomputer.com/news/security/us-sanctions-russian-who-laundered-money-for-ryuk-ransomware-affiliate/
    The U.S. Department of the Treasury"s Office of Foreign Assets Control (OFAC) has sanctioned Russian national Ekaterina Zhdanova for laundering millions in cryptocurrency for various individuals, including ransomware actors. [...] "

    Autosummary: "

    ---

    US govt sanctioned a Russian woman for laundering virtual currency on behalf of threat actors

    rusia-ucrania
    2023-11-05 https://securityaffairs.com/153649/breaking-news/russian-woman-virtual-currency-money-laundering.html
    

    The Treasury Department sanctioned a Russian woman accused of laundering virtual currency on behalf of cybercriminals. The Department of the Treasury’s Office of Foreign Assets Control (OFAC) on Friday sanctioned Ekaterina Zhdanova, a Russian national, for her role in laundering and managing virtual currency on behalf of Russian elites, ransomware operators, and other threat actors. “Through […]

    The post US govt sanctioned a Russian woman for laundering virtual currency on behalf of threat actors appeared first on Security Affairs.

    "

    Autosummary: “Through key facilitators like Zhdanova, Russian elites, ransomware groups, and other illicit actors sought to evade U.S. and international sanctions, particularly through the abuse of virtual currency,” said Under Secretary of the Treasury for Terrorism and Financial Intelligence Brian E. Nelson. "

    ---

    Russian FSB arrested Russian hackers who supported Ukrainian cyber operations

    rusia-ucrania
    2023-11-03 https://securityaffairs.com/153539/cyber-warfare-2/fsb-arrested-russian-hackers-supported-ukraine.html
    

    The FSB arrested two Russian hackers who are accused of having helped Ukrainian entities carry out cyberattacks on critical infrastructure targets. The Russian intelligence agency Federal Security Service (FSB) arrested two individuals who are suspected of supporting Ukrainian entities to carry out cyberattacks to disrupt Russian critical infrastructure. The two men are facing high treason […]

    The post Russian FSB arrested Russian hackers who supported Ukrainian cyber operations appeared first on Security Affairs.

    "

    Autosummary: Russian FSB arrested Russian hackers who supported Ukrainian cyber operations Pierluigi Paganini November 03, 2023 November 03, 2023 The FSB arrested two Russian hackers who are accused of having helped Ukrainian entities carry out cyberattacks on critical infrastructure targets. "

    ---

    FSB arrests Russian hackers working for Ukrainian cyber forces

    rusia-ucrania
    2023-11-01 https://www.bleepingcomputer.com/news/legal/fsb-arrests-russian-hackers-working-for-ukrainian-cyber-forces/
    Russia"s security agency published a press release on Tuesday saying that its officers detained two hackers who either assisted or joined Ukraine"s hackers in cyber operations. [...] "

    Autosummary: "

    ---

    France says Russian state hackers breached numerous critical networks

    government rusia-ucrania
    2023-10-26 https://www.bleepingcomputer.com/news/security/france-says-russian-state-hackers-breached-numerous-critical-networks/
    The Russian APT28 hacking group (aka "Strontium" or "Fancy Bear") has been targeting government entities, businesses, universities, research institutes, and think tanks in France since the second half of 2021. [...] "

    Autosummary: ANSSI also reports that APT28 uses a range of VPN clients, including SurfShark, ExpressVPN, ProtonVPN, PureVPN, NordVPN, CactusVPN, WorldVPN, and VPNSecure. "

    ---

    Hackers backdoor Russian state, industrial orgs for data theft

    government industry rusia-ucrania
    2023-10-24 https://www.bleepingcomputer.com/news/security/hackers-backdoor-russian-state-industrial-orgs-for-data-theft/
    Several state and key industrial organizations in Russia were attacked with a custom Go-based backdoor that performs data theft, likely aiding espionage operations. [...] "

    Autosummary: Search disk for files of specific extensions (.doc, .docx, .pdf, .xls, .xlsx, .ppt, .pptx, .zip, .rar, .7z, .odt, .ods, .kdbx, .ovpn, .pem, .crt, .key) and transfer them to the C2. "

    ---

    Google links WinRAR exploitation to Russian, Chinese state hackers

    exploits government rusia-ucrania
    2023-10-18 https://www.bleepingcomputer.com/news/security/google-links-winrar-exploitation-to-russian-chinese-state-hackers/
    Google says that several state-backed hacking groups have joined ongoing attacks exploiting a high-severity vulnerability in WinRAR, a compression software used by over 500 million users, aiming to gain arbitrary code execution on targets" systems. [...] "

    Autosummary: "In recent weeks, Google"s Threat Analysis Group"s (TAG) has observed multiple government-backed hacking groups exploiting the known vulnerability, CVE-2023-38831, in WinRAR, which is a popular file archiver tool for Windows," Google TAG said today. "

    ---

    Pro-Russian Hackers Exploiting Recent WinRAR Vulnerability in New Campaign

    exploits rusia-ucrania
    2023-10-16 https://thehackernews.com/2023/10/pro-russian-hackers-exploiting-recent.html
    Pro-Russian hacking groups have exploited a recently disclosed security vulnerability in the WinRAR archiving utility as part of a phishing campaign designed to harvest credentials from compromised systems. "The attack involves the use of malicious archive files that exploit the recently discovered vulnerability affecting the WinRAR compression software versions prior to 6.23 and traced as "

    Autosummary: "In 2023, the most active groups were UAC-0010 (Gamaredon/FSB), UAC-0056 (GRU), UAC-0028 (APT28/GRU), UAC-0082 (Sandworm/GRU), UAC-0144 / UAC-0024 / UAC-0003 (Turla), UAC-0029 (APT29/ SVR), UAC-0109 (Zarya), UAC-0100, UAC-0106 (XakNet), [and] UAC-0107 (CyberArmyofRussia)," the State Service of Special Communications and Information Protection of Ukraine (SSSCIP) said. "

    ---

    Russian Sandworm hackers breached 11 Ukrainian telcos since May

    rusia-ucrania Telcos
    2023-10-16 https://www.bleepingcomputer.com/news/security/russian-sandworm-hackers-breached-11-ukrainian-telcos-since-may/
    The state-sponsored Russian hacking group tracked as "Sandworm" has compromised eleven telecommunication service providers in Ukraine between May and September 2023. [...] "

    Autosummary: Additionally, the attackers use tools like "ffuf", "dirbuster", "gowitness", and "nmap" to find potential vulnerabilities in web services that can be exploited to gain access. "

    ---

    Russian zero-day broker is willing to pay $20M for zero-day exploits for iPhones and Android devices

    exploits rusia-ucrania
    2023-09-27 https://securityaffairs.com/151607/hacking/russian-zero-day-broker-offering.html
    

    A Russian zero-day broker is willing to pay $20 million for zero-day exploits for iPhones and Android mobile devices. The Russian zero-day broker firm Operation Zero is increasing payouts for top-tier mobile exploits. The company is willing to pay up to $20,000,000 for zero-day exploits for iPhone and Android devices. The Russian company pointed out […]

    The post Russian zero-day broker is willing to pay $20M for zero-day exploits for iPhones and Android devices appeared first on Security Affairs.

    "

    Autosummary: Russian zero-day broker is willing to pay $20M for zero-day exploits for iPhones and Android devices Pierluigi Paganini September 27, 2023 September 27, 2023 A Russian zero-day broker is willing to pay $20 million for zero-day exploits for iPhones and Android mobile devices. "

    ---

    Exiled Russian journalist claims “European state” hacked her iPhone with Pegasus spyware

    government rusia-ucrania
    2023-09-26 https://www.bitdefender.com/blog/hotforsecurity/exiled-russian-journalist-claims-european-state-hacked-her-iphone-with-pegasus-spyware/
    The founder of a news outlet outlawed in Russia for its independent reporting and stance on the war in Ukraine, believes that a country in the European Union was behind the hacking of her iPhone with military-grade spyware. Read more in my article on the Hot for Security blog. "

    Autosummary: "

    ---

    Government of Bermuda blames Russian threat actors for the cyber attack

    government rusia-ucrania
    2023-09-23 https://securityaffairs.com/151273/hacking/government-of-bermuda-cyberattack.html
    

    The Government of Bermuda believes that the recent cyberattack against its IT infrastructure was launched by Russian threat actors. This week a cyber attack hit the Government of Bermuda causing the interruption of internet/email and phone services. The attack impacted all the government departments. “The Department of Information and Digital Technology (IDT) is working quickly […]

    The post Government of Bermuda blames Russian threat actors for the cyber attack appeared first on Security Affairs.

    "

    Autosummary: Walter Roban, JP, MP:, JP, MP, provided an update on the cyberattack: “As a result of our network interruption, there will be no sitting of the House of Assembly,” a government spokeswoman had confirmed. "

    ---

    Government of Bermuda links cyberattack to Russian hackers

    government rusia-ucrania ciber
    2023-09-22 https://www.bleepingcomputer.com/news/security/government-of-bermuda-links-cyberattack-to-russian-hackers/
    The Government of British Overseas Territory Bermuda has linked a cyberattack affecting all its departments" IT systems since Thursday to hackers based out of Russia. [...] "

    Autosummary: "

    ---

    The Week in Ransomware - September 15th 2023 - Russian Roulette

    exploits ransomware rusia-ucrania
    2023-09-15 https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-september-15th-2023-russian-roulette/
    This week"s big news is the extortion attacks on the Caesars and MGM Las Vegas casino chains, with one having already paid the ransom and the other still facing operational disruptions. [...] "

    Autosummary: Finally, some interesting research was released this week: Contributors and those who provided new ransomware information and stories this week include: @Seifreed, @malwareforme, @serghei, @malwrhunterteam, @BleepinComputer, @demonslay335, @Ionut_Ilascu, @LawrenceAbrams, @billtoulas, @vxunderground, @BroadcomSW, @MsftSecIntel, @AlvieriD, @WilliamTurton, @GeeksCyber, @pcrisk, and @Mandiant. September 11th 2023 MGM Resorts International disclosed today that it is dealing with a cybersecurity issue that impacted some of its systems, including its main website, online reservations, and in-casino services, like ATMs, slot machines, and credit card machines. "

    ---

    Russian Journalist"s iPhone Compromised by NSO Group"s Zero-Click Spyware

    rusia-ucrania
    2023-09-14 https://thehackernews.com/2023/09/russian-journalists-iphone-compromised.html
    The iPhone belonging to Galina Timchenko, a prominent Russian journalist and critic of the government, was compromised with NSO Group"s Pegasus spyware, a new collaborative investigation from Access Now and the Citizen Lab has revealed. The infiltration is said to have happened on or around February 10, 2023. Timchenko is the executive editor and owner of Meduza, an independent news publication "

    Autosummary: Supercharge Your Skills The Committee to Protect Journalists (CPJ) said "journalists and their sources are not free and safe if they are spied on, and this attack on Timchenko underscores that governments must implement an immediate moratorium on the development, sale, and use of spyware technologies. "

    ---

    The iPhone of a Russian journalist was infected with the Pegasus spyware

    rusia-ucrania
    2023-09-14 https://securityaffairs.com/150816/intelligence/russian-journalists-iphone-pegasus-spyware.html
    

    The iPhone of a prominent Russian journalist, who is at odds with Moscow, was infected with NSO Group’s Pegasus spyware. The iPhone of the Russian journalist Galina Timchenko was compromised with NSO Group’s Pegasus spyware. A joint investigation conducted by Access Now and the Citizen Lab revealed that the journalist, who is at odds with the Russian government, […]

    The post The iPhone of a Russian journalist was infected with the Pegasus spyware appeared first on Security Affairs.

    "

    Autosummary: “Sophisticated spyware like Pegasus, which bypasses encryption and takes full control of the victim’s phone, including access to photos, messages, and contacts, as well as the phone’s camera and microphone, represents an existential threat to journalists and media freedom globally.” "

    ---

    Microsoft: North Korean hackers target Russian govt, defense orgs

    rusia-ucrania
    2023-09-07 https://www.bleepingcomputer.com/news/security/microsoft-north-korean-hackers-target-russian-govt-defense-orgs/
    Microsoft says North Korean hacking groups have breached multiple Russian government and defense targets since the start of the year. [...] "

    Autosummary: North Korean defense targeting (Microsoft) Defense firms in Brazil, Czechia, Finland, Italy, Norway, and Poland have also been subject to these intrusions, all as part of a coordinated endeavor to enhance the country"s military capabilities. "

    ---

    Russian State-Backed "Infamous Chisel" Android Malware Targets Ukrainian Military

    exploits government rusia-ucrania
    2023-09-01 https://thehackernews.com/2023/09/russian-state-backed-infamous-chisel.html
    Cybersecurity and intelligence agencies from Australia, Canada, New Zealand, the U.K., and the U.S. on Thursday disclosed details of a mobile malware strain targeting Android devices used by the Ukrainian military. The malicious software, dubbed Infamous Chisel and attributed to a Russian state-sponsored actor called Sandworm, has capabilities to “enable unauthorized access to compromised "

    Autosummary: A brief description of each of the modules is as follows - netd - Collate and exfiltrate information from the compromised device at set intervals, including from app-specific directories and web browsers - Collate and exfiltrate information from the compromised device at set intervals, including from app-specific directories and web browsers td - Provide TOR services - Provide TOR services blob - Configure Tor services and check network connectivity (executed by netd) - Configure Tor services and check network connectivity (executed by netd) tcpdump - Legitimate tcpdump utility with no modifications - Legitimate tcpdump utility with no modifications killer - Terminate thee netd process - Terminate thee netd process db - Contains several tools to copy files and provide secure shell access to the device via the TOR hidden service using a modified version of Dropbear - Contains several tools to copy files and provide secure shell access to the device via the TOR hidden service using a modified version of Dropbear NDBR - A multi-call binary similar to db that comes in two flavors to be able to run on Arm (ndbr_armv7l) and Intel (ndbr_i686) CPU architectures Persistence on the device is achieved by replacing the legitimate netd daemon, which is responsible for network configuration on Android, with a rogue version, enabling it to execute commands as the root user. "

    ---

    Russian Hackers Use Zulip Chat App for Covert C&C in Diplomatic Phishing Attacks

    financial rusia-ucrania
    2023-08-17 https://thehackernews.com/2023/08/russian-hackers-use-zulip-chat-app-for.html
    An ongoing campaign targeting ministries of foreign affairs of NATO-aligned countries points to the involvement of Russian threat actors. The phishing attacks feature PDF documents with diplomatic lures, some of which are disguised as coming from Germany, to deliver a variant of a malware called Duke, which has been attributed to APT29 (aka BlueBravo, Cloaked Ursa, Cozy Bear, Iron Hemlock, "

    Autosummary: The phishing attacks feature PDF documents with diplomatic lures, some of which are disguised as coming from Germany, to deliver a variant of a malware called Duke, which has been attributed to APT29 (aka BlueBravo, Cloaked Ursa, Cozy Bear, Iron Hemlock, Midnight Blizzard, and The Dukes). "

    ---

    Hacked electronic sign declares “Putin is a dickhead” as Russian ruble slumps

    rusia-ucrania
    2023-08-16 https://grahamcluley.com/hacked-electronic-sign-putin/
    Someone clearly isn"t very impressed with Vladimir Putin, as the Russian economy continues to tank in the wake of sanctions. "

    Autosummary: "

    ---

    North Korean hackers breached Russian missile development firm

    rusia-ucrania
    2023-08-08 https://www.helpnetsecurity.com/2023/08/08/north-korean-hackers-russia/
    

    North Korean state-sponsored hackers have breached Russian missile maker NPO Mashinostroyeniya, according to SentinelLabs researchers. North Korean hackers discovered The researchers came across leaked email communication between NPO Mashinostroyeniya’s IT staff that contained information about a possible cyber intrusion first detected in May 2022. According to the emails, the breached company’s IT staff discovered a suspicious DLL file within company systems, which SentinelLabs researchers identified as a version of the OpenCarrot Windows OS backdoor previously … More →

    The post North Korean hackers breached Russian missile development firm appeared first on Help Net Security.

    "

    Autosummary: "

    ---

    North Korean hackers "ScarCruft" breached Russian missile maker

    rusia-ucrania
    2023-08-07 https://www.bleepingcomputer.com/news/security/north-korean-hackers-scarcruft-breached-russian-missile-maker/
    The North Korean state-sponsored hacking group ScarCruft has been linked to a cyberattack on the IT infrastructure and email server for NPO Mashinostroyeniya, a Russian space rocket designer and intercontinental ballistic missile engineering organization. [...] "

    Autosummary: The backdoor supports a total of 25 commands, including: Reconnaissance: File and process attribute enumeration, scanning, and ICMP-pinging hosts in IP ranges for open TCP ports and availability. "

    ---

    North Korean Hackers Targets Russian Missile Engineering Firm

    rusia-ucrania
    2023-08-07 https://thehackernews.com/2023/08/north-korean-hackers-targets-russian.html
    Two different North Korean nation-state actors have been linked to a cyber intrusion against the major Russian missile engineering company NPO Mashinostroyeniya. Cybersecurity firm SentinelOne said it identified "two instances of North Korea related compromise of sensitive internal IT infrastructure," including a case of an email server compromise and the deployment of a Windows backdoor dubbed "

    Autosummary: "

    ---

    Microsoft Exposes Russian Hackers" Sneaky Phishing Tactics via Microsoft Teams Chats

    financial industry rusia-ucrania
    2023-08-03 https://thehackernews.com/2023/08/microsoft-exposes-russian-hackers.html
    Microsoft on Wednesday disclosed that it identified a set of highly targeted social engineering attacks mounted by a Russian nation-state threat actor using credential theft phishing lures sent as Microsoft Teams chats. The tech giant attributed the attacks to a group it tracks as Midnight Blizzard (previously Nobelium). It"s also called APT29, BlueBravo, Cozy Bear, Iron Hemlock, and The Dukes. "

    Autosummary: " Microsoft said the campaign, observed since at least late May 2023, affected less than 40 organizations globally spanning government, non-government organizations (NGOs), IT services, technology, discrete manufacturing, and media sectors. "

    ---

    Russian APT phished government employees via Microsoft Teams

    government rusia-ucrania
    2023-08-03 https://www.helpnetsecurity.com/2023/08/03/microsoft-teams-phishing/
    

    An APT group linked to Russia’s Foreign Intelligence Service has hit employees of several dozen global organizations with phishing attacks via Microsoft Teams, says Microsoft. A social engineering attack to bypass MFA protection “To facilitate their attack, the actor uses Microsoft 365 tenants owned by small businesses they have compromised in previous attacks to host and launch their social engineering attack. The actor renames the compromised tenant, adds a new onmicrosoft.com subdomain, then adds a … More →

    The post Russian APT phished government employees via Microsoft Teams appeared first on Help Net Security.

    "

    Autosummary: Microsoft says that the targets in this campaign were government and non-government organizations, and organizations in the IT services, technology, discrete manufacturing, and media sectors. "

    ---

    Russian APT29 conducts phishing attacks through Microsoft Teams

    financial rusia-ucrania
    2023-08-03 https://securityaffairs.com/149103/apt/apt29-microsoft-teams-phishing-attacks.html
    

    Russia-linked APT29 group targeted dozens of organizations and government agencies worldwide with Microsoft Teams phishing attacks. Microsoft Threat Intelligence reported that Russia-linked cyberespionage group APT29  (aka SVR group, Cozy Bear, Nobelium, Midnight Blizzard, and The Dukes) carried out Microsoft Teams phishing attacks aimed at dozens of organizations and government agencies worldwide. APT29 along with APT28 cyber espionage group was involved in […]

    The post Russian APT29 conducts phishing attacks through Microsoft Teams appeared first on Security Affairs.

    "

    Autosummary: Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, APT29) Share this: Email Twitter Print LinkedIn Facebook More Tumblr Pocket Share On "

    ---

    Russian Cyber Adversary BlueCharlie Alters Infrastructure in Response to Disclosures

    rusia-ucrania
    2023-08-02 https://thehackernews.com/2023/08/russian-cyber-adversary-bluecharlie.html
    A Russa-nexus adversary has been linked to 94 new domains, suggesting that the group is actively modifying its infrastructure in response to public disclosures about its activities. Cybersecurity firm Recorded Future linked the new infrastructure to a threat actor it tracks under the name BlueCharlie, a hacking crew that"s broadly known by the names Blue Callisto, Callisto (or Calisto), "

    Autosummary: "While the group uses relatively common techniques to conduct attacks (such as the use of phishing and a historical reliance on open-source offensive security tools), its likely continued use of these methods, determined posture, and progressive evolution of tactics suggests the group remains formidable and capable," the company said. "

    ---

    Russian hackers target govt orgs in Microsoft Teams phishing attacks

    financial rusia-ucrania
    2023-08-02 https://www.bleepingcomputer.com/news/security/russian-hackers-target-govt-orgs-in-microsoft-teams-phishing-attacks/
    Microsoft says a hacking group tracked as APT29 and linked to Russia"s Foreign Intelligence Service (SVR) targeted dozens of organizations worldwide, including government agencies, in Microsoft Teams phishing attacks. [...] "

    Autosummary: "The organizations targeted in this activity likely indicate specific espionage objectives by Midnight Blizzard directed at government, non-government organizations (NGOs), IT services, technology, discrete manufacturing, and media sectors. "

    ---

    Group-IB Co-Founder Sentenced to 14 Years in Russian Prison for Alleged High Treason

    rusia-ucrania
    2023-07-27 https://thehackernews.com/2023/07/group-ib-co-founder-sentenced-to-14.html
    A city court in Moscow on Wednesday convicted Group-IB co-founder and CEO Ilya Sachkov of "high treason" and jailed him for 14 years in a "strict regime colony" over accusations of passing information to foreign spies. "The court found Sachkov guilty under Article 275 of the Russian Criminal Code (high treason) sentencing him to 14 years of incarceration in a maximum-security jail, restriction "

    Autosummary: "

    ---

    Russian state hackers lure Western diplomats with BMW car ads

    government rusia-ucrania
    2023-07-12 https://www.bleepingcomputer.com/news/security/russian-state-hackers-lure-western-diplomats-with-bmw-car-ads/
    The Russian state-sponsored hacking group "APT29" (aka Nobelium, Cloaked Ursa) has been using unconventional lures like car listings to entice diplomats in Ukraine to click on malicious links that deliver malware. [...] "

    Autosummary: Fake PNG files contained in the ISO archive (Unit 42) Unit 42 reports that this campaign has targeted at least 22 of the 80 foreign missions in Kyiv, including those of the United States, Canada, Turkey, Spain, Netherlands, Greece, Estonia, and Denmark. "

    ---

    Microsoft Warns of Widescale Credential Stealing Attacks by Russian Hackers

    rusia-ucrania
    2023-06-26 https://thehackernews.com/2023/06/microsoft-warns-of-widescale-credential.html
    Microsoft has disclosed that it"s detected a spike in credential-stealing attacks conducted by the Russian state-affiliated hacker group known as Midnight Blizzard. The intrusions, which made use of residential proxy services to obfuscate the source IP address of the attacks, target governments, IT service providers, NGOs, defense, and critical manufacturing sectors, the tech giant"s threat "

    Autosummary: The intrusions, which made use of residential proxy services to obfuscate the source IP address of the attacks, target governments, IT service providers, NGOs, defense, and critical manufacturing sectors, the tech giant"s threat intelligence team said. "

    ---

    CISA orders govt agencies to patch bugs exploited by Russian hackers

    exploits rusia-ucrania
    2023-06-22 https://www.bleepingcomputer.com/news/security/cisa-orders-govt-agencies-to-patch-bugs-exploited-by-russian-hackers/
    On Thursday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six more security flaws to its known exploited vulnerabilities (KEV) list. [...] "

    Autosummary: "

    ---

    Russian APT28 hackers breach Ukrainian govt email servers

    rusia-ucrania
    2023-06-20 https://www.bleepingcomputer.com/news/security/russian-apt28-hackers-breach-ukrainian-govt-email-servers/
    A threat group tracked as APT28 and linked to Russia"s General Staff Main Intelligence Directorate (GRU) has breached Roundcube email servers belonging to multiple Ukrainian organizations, including government entities. [...] "

    Autosummary: In these attacks, the cyber-espionage group (also known as BlueDelta, Fancy Bear, Sednit, and Sofacy) leveraged news about the ongoing conflict between Russia and Ukraine to trick recipients into opening malicious emails that would exploit Roundcube Webmail vulnerabilities to hack into unpatched servers. "

    ---

    20-Year-Old Russian LockBit Ransomware Affiliate Arrested in Arizona

    exploits ransomware rusia-ucrania
    2023-06-16 https://thehackernews.com/2023/06/20-year-old-russian-lockbit-ransomware.html
    The U.S. Department of Justice (DoJ) on Thursday unveiled charges against a Russian national for his alleged involvement in deploying LockBit ransomware to targets in the U.S., Asia, Europe, and Africa. Ruslan Magomedovich Astamirov, 20, of Chechen Republic has been accused of perpetrating at least five attacks between August 2020 and March 2023. He was arrested in the state of Arizona last "

    Autosummary: Join the Session The DoJ statement also comes a day after cybersecurity authorities from Australia, Canada, France, Germany, New Zealand, the U.K., and the U.S. released a joint advisory warning of LockBit ransomware. "

    ---

    A Russian national charged for committing LockBit Ransomware attacks

    exploits ransomware rusia-ucrania
    2023-06-16 https://securityaffairs.com/147551/cyber-crime/lockbit-ransomware-member-arrested.html
    

    DoJ charged a Russian national with conspiring to carry out LockBit ransomware attacks against U.S. and foreign businesses. The Justice Department announced charges against the Russian national Ruslan Magomedovich Astamirov (20) for his role in numerous LockBit ransomware attacks against systems in the United States, Asia, Europe, and Africa. The US authorities arrested the man […]

    The post A Russian national charged for committing LockBit Ransomware attacks appeared first on Security Affairs.

    "

    Autosummary: The operation targeted many organizations in critical infrastructure sectors, including financial services, food and agriculture, education, energy, government and emergency services, healthcare, manufacturing, and transportation. In May, the US Justice Department charged Russian national Mikhail Pavlovich Matveev (30), aka Wazawaka, m1x, Boriselcin, and Uhodiransomwar, for his alleged role in multiple ransomware attacks. "

    ---

    Microsoft Warns of New Russian State-Sponsored Hacker Group with Destructive Intent

    government rusia-ucrania
    2023-06-15 https://thehackernews.com/2023/06/microsoft-warns-of-new-russian-state.html
    Microsoft on Wednesday took the lid off a "novel and distinct Russian threat actor," which it said is linked to the General Staff Main Intelligence Directorate (GRU) and has a "relatively low success rate." The tech giant"s Threat Intelligence team, which was previously tracking the group under its emerging moniker DEV-0586, has graduated it to a named actor dubbed Cadet Blizzard. "Cadet "

    Autosummary: The state-sponsored actor, per Microsoft, has a track record of orchestrating destructive attacks, espionage, and information operations aimed at entities located in Ukraine, Europe, Central Asia, and, periodically, Latin America. "

    ---

    Russian hackers use PowerShell USB malware to drop backdoors

    exploits rusia-ucrania
    2023-06-15 https://www.bleepingcomputer.com/news/security/russian-hackers-use-powershell-usb-malware-to-drop-backdoors/
    The Russian state-sponsored hacking group Gamaredon (aka Armageddon, or Shuckworm) continues to target critical organizations in Ukraine"s military and security intelligence sectors, employing a refreshed toolset and new infection tactics. [...] "

    Autosummary: The LNKs created by the script take a broad range of names, some selected specifically to pique the victim"s interest like: weapons_list.rtf.lnk secret.rtf.lnk pornophoto.rtf.lnk my_photos.rtf.lnk login_password.docx.lnk compromising_evidence.rtf.lnk instructions.rtf.lnk account_card.rtf.lnk bank_accоunt.rtf.lnk Once the victim launches those files, the PowerShell script enumerates all drives on the computer and copies itself to removable USB disks, increasing the likelihood of successful lateral movement within the breached network. "

    ---

    Microsoft links data wiping attacks to new Russian GRU hacking group

    rusia-ucrania
    2023-06-14 https://www.bleepingcomputer.com/news/security/microsoft-links-data-wiping-attacks-to-new-russian-gru-hacking-group/
    Microsoft has linked a threat group it tracks as Cadet Blizzard since April 2023 to Russia"s Main Directorate of the General Staff of the Armed Forces (also known as GRU). [...] "

    Autosummary: "

    ---

    WannaCry ransomware impersonator targets Russian "Enlisted" FPS players

    exploits ransomware rusia-ucrania
    2023-06-14 https://www.bleepingcomputer.com/news/security/wannacry-ransomware-impersonator-targets-russian-enlisted-fps-players/
    A ransomware operation targets Russian players of the Enlisted multiplayer first-person shooter, using a fake website to spread trojanized versions of the game. [...] "

    Autosummary: Malicious website spreading Crypter ransomware (BleepingComputer) The installer downloaded from the fake website is "enlisted_beta-v1.0.3.115.exe," which drops two executable files on the user"s disk if launched, namely "ENLIST~1" (the actual game) and "enlisted" (the Python ransomware launcher). "

    ---

    Two Russian Nationals Charged for Masterminding Mt. Gox Crypto Exchange Hack

    rusia-ucrania
    2023-06-13 https://thehackernews.com/2023/06/two-russian-nationals-charged-for.html
    The U.S. Department of Justice (DoJ) has charged two Russian nationals in connection with masterminding the 2014 digital heist of the now-defunct cryptocurrency exchange Mt. Gox. According to unsealed indictments released last week, Alexey Bilyuchenko, 43, and Aleksandr Verner, 29, have been accused of conspiring to launder approximately 647,000 bitcoins stolen from September 2011 through at "

    Autosummary: The three-year sting operation, dubbed Trojan Shield, led to more than 800 arrests across 18 countries following an analysis of over 27 million messages that involved discussions on narcotics concealment methods, shipments of narcotics, money laundering, and even violent threats. "

    ---

    Pro-Ukraine Cyber Anarchy Squad claims the hack of the Russian telecom provider Infotel JSC

    rusia-ucrania
    2023-06-11 https://securityaffairs.com/147307/hacktivism/cyber-anarchy-squad-hacks-infotel-jsc.html
    

    Pro-Ukraine hackers Cyber Anarchy Squad claimed responsibility for the attack that hit Russian telecom provider Infotel JSC. Pro-Ukraine hacking group Cyber.Anarchy.Squad claimed responsibility for an attack on Russian telecom provider Infotel JSC. The company provides connectivity services to the Russian banking system, for this reason, the attack had a severe impact on the operations of […]

    The post Pro-Ukraine Cyber Anarchy Squad claims the hack of the Russian telecom provider Infotel JSC appeared first on Security Affairs.

    "

    Autosummary: Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, cyberattack) Share this: Email Twitter Print LinkedIn Facebook More Tumblr Pocket Share On "

    ---

    Russians charged with hacking Mt. Gox crypto exchange, running BTC-e

    rusia-ucrania
    2023-06-09 https://www.bleepingcomputer.com/news/security/russians-charged-with-hacking-mt-gox-crypto-exchange-running-btc-e/
    Russian nationals Alexey Bilyuchenko and Aleksandr Verner have been charged with the 2011 hacking of the leading (at the time) cryptocurrency exchange Mt. Gox and the laundering of around 647,000 bitcoins they stole. [...] "

    Autosummary: "

    ---

    Ukrainian hackers take down service provider for Russian banks

    financial rusia-ucrania Telcos
    2023-06-09 https://www.bleepingcomputer.com/news/security/ukrainian-hackers-take-down-service-provider-for-russian-banks/
    A group of Ukrainian hackers known as the Cyber.Anarchy.Squad claimed an attack that took down Russian telecom provider Infotel JSC on Thursday evening. [...] "

    Autosummary: "In total, the company has about four hundred clients, a quarter of them are banks, the rest are credit institutions, car dealerships. "

    ---

    Russians charged with hacking Mt. Gox exchange and operating BTC-e

    rusia-ucrania
    2023-06-09 https://securityaffairs.com/147280/digital-id/mt-gox-russian-nations.html
    

    Two Russian nationals have been charged with the hack of the cryptocurrency exchange Mt. Gox in 2011 and money laundering. Russian nationals Alexey Bilyuchenko (43) and Aleksandr Verner (29) have been charged with the hack of the cryptocurrency exchange Mt. Gox in 2011 and the operation of the illicit cryptocurrency exchange BTC-e. The duo has […]

    The post Russians charged with hacking Mt. Gox exchange and operating BTC-e appeared first on Security Affairs.

    "

    Autosummary: "

    ---

    New Russian-linked CosmicEnergy malware targets industrial systems

    exploits industry rusia-ucrania
    2023-05-25 https://www.bleepingcomputer.com/news/security/new-russian-linked-cosmicenergy-malware-targets-industrial-systems/
    Mandiant security researchers have discovered a new OT known as CosmicEnergy that targets operational technology (OT), raising concerns about potential disruptions to electric power systems worldwide.  [...] "

    Autosummary: The list includes but is not limited to WhisperGate/WhisperKill, FoxBlade (aka HermeticWiper), SonicVote (aka HermeticRansom), CaddyWiper, DesertBlade, Industroyer2, Lasainraw (aka IsaacWiper), and FiberLake (aka DoubleZero). "

    ---

    U.S. Offers $10 Million Bounty for Capture of Notorious Russian Ransomware Operator

    exploits ransomware rusia-ucrania
    2023-05-17 https://thehackernews.com/2023/05/us-offers-10-million-bounty-for-capture.html
    A Russian national has been charged and indicted by the U.S. Department of Justice (DoJ) for launching ransomware attacks against "thousands of victims" in the country and across the world. Mikhail Pavlovich Matveev (aka Wazawaka, m1x, Boriselcin, and Uhodiransomwar), the 30-year-old individual in question, is alleged to be a "central figure" in the development and deployment of LockBit, Babuk, "

    Autosummary: Mikhail Pavlovich Matveev (aka Wazawaka, m1x, Boriselcin, and Uhodiransomwar), the 30-year-old individual in question, is alleged to be a "central figure" in the development and deployment of LockBit, Babuk, and Hive ransomware variants since at least June 2020. "

    ---

    US Gov offers a $10M reward for a Russian ransomware actor

    exploits ransomware rusia-ucrania
    2023-05-17 https://securityaffairs.com/146345/cyber-crime/russian-ransomware-actor-reward.html
    

    The US government is offering a $10M reward for Russian national Mikhail Pavlovich Matveev (30) charged for his role in ransomware attacks The US Justice Department charged Russian national Mikhail Pavlovich Matveev (30), aka Wazawaka, m1x, Boriselcin, and Uhodiransomwar, for his alleged role in multiple ransomware attacks. The DoJ unsealed two indictments charging the man […]

    The post US Gov offers a $10M reward for a Russian ransomware actor appeared first on Security Affairs.

    "

    Autosummary: “From Russia and hiding behind multiple aliases, Matveev is alleged to have used these ransomware strains to encrypt and hold hostage for ransom the data of numerous victims, including hospitals, schools, nonprofits, and law enforcement agencies, like the Metropolitan Police Department in Washington, D.C.,” said U.S. Attorney Philip R. Sellinger for the District of New Jersey. "

    ---

    Russian ransomware affiliate charged with attacks on critical infrastructure

    exploits ransomware rusia-ucrania
    2023-05-16 https://www.bleepingcomputer.com/news/security/russian-ransomware-affiliate-charged-with-attacks-on-critical-infrastructure/
    The U.S. Justice Department has filed charges against a Russian citizen named Mikhail Pavlovich Matveev (also known as Wazawaka or Boriselcin) for involvement in three ransomware operations that targeted victims across the United States. [...] "

    Autosummary: "

    ---

    FBI nukes Russian Snake data theft malware with self-destruct command

    exploits rusia-ucrania
    2023-05-09 https://www.bleepingcomputer.com/news/security/fbi-nukes-russian-snake-data-theft-malware-with-self-destruct-command/
    Cybersecurity and intelligence agencies from all Five Eyes member nations took down the infrastructure used by the Snake cyber-espionage malware operated by Russia"s Federal Security Service (FSB). [...] "

    Autosummary: Error. "

    ---

    Newspaper evades Russian censors, hides news in Counter-Strike map

    rusia-ucrania
    2023-05-05 https://www.malwarebytes.com/blog/news/2023/05/evading-russian-media-restrictions-with-custom-video-game-maps
    

    Categories: News Tags: Russia Tags: Ukraine Tags: censorship Tags: press Tags: freedom Tags: restrictions Tags: evade Tags: counter-strike: global offensive Tags: counter strike GO Tags: steam Tags: workshop Tags: map Tags: de_vonya We take a look at one newspaper"s innovative way of bypassing Russian media restrictions. (Read more...)

    The post Newspaper evades Russian censors, hides news in Counter-Strike map appeared first on Malwarebytes Labs.

    "

    Autosummary: This room contains independent journalism that is forbidden in Russia A sign on one wall states “Russian strikes on civilian targets 2022-2023,” above a map highlighting strike locations, next to several photographs of the damage inflicted.The plan: Hide a secret room underneath a map, which players can stumble upon and see facts, figures, and photographs of what’s been going on. Flashing lights indicate the presence of the room Inside the room The room itself is made up of several areas of information, with a main table located in the middle. If you click on the map to open its page, and then hit the green “Subscribe” button, the map will be available next time you load up the game. "

    ---

    Russian hackers use WinRAR to wipe Ukraine state agency’s data

    government rusia-ucrania
    2023-05-03 https://www.bleepingcomputer.com/news/security/russian-hackers-use-winrar-to-wipe-ukraine-state-agencys-data/
    The Russian "Sandworm" hacking group has been linked to an attack on Ukrainian state networks where WinRar was used to destroy data on government devices. [...] "

    Autosummary: "

    ---

    Russian APT Nomadic Octopus hacked Tajikistani carrier

    rusia-ucrania Telcos
    2023-05-01 https://securityaffairs.com/145536/apt/nomadic-octopus-targets-tajikistani-carrier.html
    

    Russian APT group Nomadic Octopus hacked a Tajikistani carrier to spy on government officials and public service infrastructures. Russian cyber espionage group Nomadic Octopus (aka DustSquad) has hacked a Tajikistani telecoms provider to spy on 18 entities, including high-ranking government officials, telecommunication services, and public service infrastructures. The cyberspies compromised a broad range of devices, […]

    The post Russian APT Nomadic Octopus hacked Tajikistani carrier appeared first on Security Affairs.

    "

    Autosummary: Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Nomadic Octopus) Share this: Email Twitter Print LinkedIn Facebook More Tumblr Pocket Share On Blogger Awards 2022 – VOTE FOR YOUR WINNERS Vote for me in the sections: The Teacher – Most Educational Blog The Entertainer – Most Entertaining Blog The Tech Whizz – Best Technical Blog Best Social Media Account to Follow (@securityaffairs) Please nominate Security Affairs as your favorite blog. "

    ---

    Ukrainian arrested for selling data of 300M people to Russians

    rusia-ucrania
    2023-04-26 https://www.bleepingcomputer.com/news/security/ukrainian-arrested-for-selling-data-of-300m-people-to-russians/
    The Ukrainian cyber police have arrested a 36-year-old man from the city of Netishyn for selling the personal data and sensitive information of over 300 million people, citizens of Ukraine, and various European countries. [...] "

    Autosummary: "

    ---

    Russian Hackers Suspected in Ongoing Exploitation of Unpatched PaperCut Servers

    exploits rusia-ucrania
    2023-04-24 https://thehackernews.com/2023/04/russian-hackers-suspected-in-ongoing.html
    Print management software provider PaperCut said that it has "evidence to suggest that unpatched servers are being exploited in the wild," citing two vulnerability reports from cybersecurity company Trend Micro. "PaperCut has conducted analysis on all customer reports, and the earliest signature of suspicious activity on a customer server potentially linked to this vulnerability is 14th April 01 "

    Autosummary: "

    ---

    Russian cybercrime group likely behind ongoing exploitation of PaperCut flaws

    exploits rusia-ucrania
    2023-04-24 https://securityaffairs.com/145190/hacking/russian-hackers-papercut-flaws-attacks.html
    

    Print management software provider PaperCut confirmed ongoing active exploitation of CVE-2023-27350 vulnerability. On April 19th, Print management software provider PaperCut confirmed that it is aware of the active exploitation of the CVE-2023-27350 vulnerability. The company received two vulnerability reports from the cybersecurity firm Trend Micro) for high/critical severity security issues in PaperCut MF/NG.  Trend Micro announced they will […]

    The post Russian cybercrime group likely behind ongoing exploitation of PaperCut flaws appeared first on Security Affairs.

    "

    Autosummary: Share this: Email Twitter Print LinkedIn Facebook More Tumblr Pocket Share On "

    ---

    Russian Hackers Tomiris Targeting Central Asia for Intelligence Gathering

    rusia-ucrania
    2023-04-24 https://thehackernews.com/2023/04/russian-hackers-tomiris-targeting.html
    The Russian-speaking threat actor behind a backdoor known as Tomiris is primarily focused on gathering intelligence in Central Asia, fresh findings from Kaspersky reveal. "Tomiris"s endgame consistently appears to be the regular theft of internal documents," security researchers Pierre Delcher and Ivan Kwiatkowski said in an analysis published today. "The threat actor targets government and "

    Autosummary: "More precisely, on September 13, 2022, around 05:40 UTC, an operator attempted to deploy several known Tomiris implants via Telemiris: first a Python Meterpreter loader, then JLORAT and Roopy," the researchers explained. "

    ---

    Google: Ukraine targeted by 60% of Russian phishing attacks in 2023

    financial rusia-ucrania
    2023-04-20 https://www.bleepingcomputer.com/news/security/google-ukraine-targeted-by-60-percent-of-russian-phishing-attacks-in-2023/
    Google"s Threat Analysis Group (TAG) has been monitoring and disrupting Russian state-backed cyberattacks targeting Ukraine"s critical infrastructure in 2023. [...] "

    Autosummary: Phishing page where victims land after an XSS redirection (Google) This week, a joint announcement by the UK NCSC, FBI, NSA, and CISA warned that APT28 is hacking Cisco Routers to install custom malware. "

    ---

    U.S. and U.K. Warn of Russian Hackers Exploiting Cisco Router Flaws for Espionage

    exploits rusia-ucrania
    2023-04-19 https://thehackernews.com/2023/04/us-and-uk-warn-of-russian-hackers.html
    U.K. and U.S. cybersecurity and intelligence agencies have warned of Russian nation-state actors exploiting now-patched flaws in networking equipment from Cisco to conduct reconnaissance and deploy malware against targets. The intrusions, per the authorities, took place in 2021 and targeted a small number of entities in Europe, U.S. government institutions, and about 250 Ukrainian victims. The "

    Autosummary: The activity has been attributed to a threat actor tracked as APT28, which is also known as Fancy Bear, Forest Blizzard (formerly Strontium), FROZENLAKE, and Sofacy, and is affiliated with the Russian General Staff Main Intelligence Directorate (GRU). "

    ---

    UK cyber-argency warns of a new ‘class’ of Russian hackers

    rusia-ucrania
    2023-04-19 https://www.bleepingcomputer.com/news/security/uk-cyber-argency-warns-of-a-new-class-of-russian-hackers/
    The United Kingdom"s NCSC (National Cyber Security Centre) is warning of a heightened risk from attacks by state-aligned Russian hacktivists, urging all organizations in the country to apply recommended security measures. [...] "

    Autosummary: Larger organizations should consider taking additional, advanced actions like accelerating security improvements, reassessing risk tolerance, temporarily reducing system functionality, aggressively patching vulnerabilities, delaying non-security system changes, and preparing for extended operational hours or incident response scaling. "

    ---

    Google TAG Warns of Russian Hackers Conducting Phishing Attacks in Ukraine

    financial rusia-ucrania
    2023-04-19 https://thehackernews.com/2023/04/google-tag-warns-of-russian-hackers.html
    Elite hackers associated with Russia"s military intelligence service have been linked to large-volume phishing campaigns aimed at hundreds of users in Ukraine to extract intelligence and influence public discourse related to the war. Google"s Threat Analysis Group (TAG), which is monitoring the activities of the actor under the name FROZENLAKE, said the attacks continue the "group"s 2022 focus "

    Autosummary: " The state-sponsored cyber actor, also tracked as APT28, Fancy Bear, Forest Blizzard, Iron Twilight, Sednit, and Sofacy, is both highly active and proficient. "

    ---

    Russian national sentenced to time served for committing money laundering for the Ryuk ransomware operation

    financial exploits ransomware rusia-ucrania
    2023-04-19 https://securityaffairs.com/145029/cyber-crime/russian-national-sentenced-money-laundering-ryuk-ransomware.html
    

    Russian national Denis Mihaqlovic Dubnikov has been sentenced to time served for committing money laundering for the Ryuk ransomware operation. Russian national Denis Dubnikov (30) has been sentenced to time served for committing money laundering for the Ryuk ransomware group. The man was also ordered to pay $2,000 in restitution.   On February 7, 2023, Dubnikov pleaded […]

    The post Russian national sentenced to time served for committing money laundering for the Ryuk ransomware operation appeared first on Security Affairs.

    "

    Autosummary: Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Ryuk ransomware) Share this: Email Twitter Print LinkedIn Facebook More Tumblr Pocket Share On "

    ---

    Russian hackers linked to widespread attacks targeting NATO and EU

    rusia-ucrania
    2023-04-13 https://www.bleepingcomputer.com/news/security/russian-hackers-linked-to-widespread-attacks-targeting-nato-and-eu/
    Poland"s Military Counterintelligence Service and its Computer Emergency Response Team have linked APT29 state-sponsored hackers, part of the Russian government"s Foreign Intelligence Service (SVR), to widespread attacks targeting NATO and European Union countries. [...] "

    Autosummary: "

    ---

    Twitter staff cuts leave Russian trolls unchecked

    rusia-ucrania
    2023-04-13 https://www.bbc.co.uk/news/technology-65067707?at_medium=RSS&at_campaign=KARANGA
    Troll farms are thriving after Elon Musk wiped out the team fighting them. "

    Autosummary: "

    ---

    Estonian National Charged in U.S. for Acquiring Electronics and Metasploit Pro for Russian Military

    industry rusia-ucrania
    2023-04-10 https://thehackernews.com/2023/04/estonian-national-charged-in-us-for.html
    An Estonian national has been charged in the U.S. for purchasing U.S.-made electronics on behalf of the Russian government and military. The 45-year-old individual, Andrey Shevlyakov, was arrested on March 28, 2023, in Tallinn. He has been indicted with 18 counts of conspiracy and other charges. If found guilty, he faces up to 20 years in prison. Court documents allege that Shevlyakov operated "

    Autosummary: "

    ---

    Ukrainian hackers spend $25,000 of pro-Russian blogger’s money on sex toys

    financial rusia-ucrania
    2023-04-06 https://www.bitdefender.com/blog/hotforsecurity/ukrainian-hackers-spend-25-000-of-pro-russian-bloggers-money-on-sex-toys/
    A pro-Russian blogger who raised $25,000 for drones to assist Russian troops fighting in Ukraine, has received a huge delivery of sex toys instead. Read more in my article on the Hot for Security blog. "

    Autosummary: "

    ---

    Leaked documents from Russian firm NTC Vulkan show Sandworm cyberwarfare arsenal

    rusia-ucrania ciber
    2023-04-02 https://securityaffairs.com/144340/apt/ntc-vulkan-sandworm-cyberwarfare-arsenal.html
    

    Files leaked by Russian IT contractor NTC Vulkan show that Russia-linked Sandworm APT requested it to develop offensive tools. Documents leaked from Russian IT contractor NTC Vulkan show it was likely involved in the development of offensive tools. The documents demonstrate that it also developed hacking tools for the Russia-linked APT group Sandworm. The Sandworm group […]

    The post Leaked documents from Russian firm NTC Vulkan show Sandworm cyberwarfare arsenal appeared first on Security Affairs.

    "

    Autosummary: In 2022, the Russian APT used multiple wipers in attacks aimed at Ukraine, including AwfulShred, CaddyWiper, HermeticWiper, Industroyer2, IsaacWiper, WhisperGate, Prestige, RansomBoggs, and ZeroWipe. "

    ---

    Russian APT group Winter Vivern targets email portals of NATO and diplomats

    rusia-ucrania
    2023-03-31 https://securityaffairs.com/144263/intelligence/winter-vivern-email-portals-nato.html
    

    Russian hacking group Winter Vivern has been actively exploiting Zimbra flaws to steal the emails of NATO and diplomats. A Russian hacking group, tracked Winter Vivern (aka TA473), has been actively exploiting vulnerabilities (CVE-2022-27926) in unpatched Zimbra instances to gain access to the emails of NATO officials, governments, military personnel, and diplomats. The CVE-2022-27926 flaw […]

    The post Russian APT group Winter Vivern targets email portals of NATO and diplomats appeared first on Security Affairs.

    "

    Autosummary: A Russian hacking group, tracked Winter Vivern (aka TA473), has been actively exploiting vulnerabilities (CVE-2022-27926) in unpatched Zimbra instances to gain access to the emails of NATO officials, governments, military personnel, and diplomats. "

    ---

    Trojanized Tor browsers target Russians with crypto-stealing malware

    exploits rusia-ucrania
    2023-03-28 https://www.bleepingcomputer.com/news/security/trojanized-tor-browsers-target-russians-with-crypto-stealing-malware/
    A surge of trojanized Tor Browser installers targets Russians and Eastern Europeans with clipboard-hijacking malware that steals infected users" cryptocurrency transactions. [...] "

    Autosummary: While the majority are targeting Russia and Eastern Europe, they have also been seen targeting the United States, Germany, China, France, the Netherlands, and the UK. "

    ---

    Microsoft Warns of Stealthy Outlook Vulnerability Exploited by Russian Hackers

    exploits rusia-ucrania
    2023-03-25 https://thehackernews.com/2023/03/microsoft-warns-of-stealthy-outlook.html
    Microsoft on Friday shared guidance to help customers discover indicators of compromise (IoCs) associated with a recently patched Outlook vulnerability. Tracked as CVE-2023-23397 (CVSS score: 9.8), the critical flaw relates to a case of privilege escalation that could be exploited to steal NT Lan Manager (NTLM) hashes and stage a relay attack without requiring any user interaction. "External "

    Autosummary: Dubbed Untitled Goose Tool, the Python-based utility offers "novel authentication and data gathering methods" to analyze Microsoft Azure, Azure Active Directory, and Microsoft 365 environments, the agency said. "

    ---

    Chinese and Russian Hackers Using SILKLOADER Malware to Evade Detection

    exploits rusia-ucrania
    2023-03-16 https://thehackernews.com/2023/03/chinese-and-russian-hackers-using.html
    Threat activity clusters affiliated with the Chinese and Russian cybercriminal ecosystems have been observed using a new piece of malware that"s designed to load Cobalt Strike onto infected machines. Dubbed SILKLOADER by Finnish cybersecurity company WithSecure, the malware leverages DLL side-loading techniques to deliver commercial adversary simulation software. The development comes as "

    Autosummary: BAILLOADER, for its part, is said to exhibit similarities with a crypter codenamed Tron that has been put to use by different adversaries to distribute Emotet, TrickBot, BazarLoader, IcedID, Conti ransomware, and Cobalt Strike. "

    ---

    Polish intelligence dismantled a network of Russian spies

    rusia-ucrania
    2023-03-16 https://securityaffairs.com/143564/intelligence/polish-intelligence-russian-spies.html
    

    Polish intelligence dismantled a cell of Russian spies that gathered info on military equipment deliveries to Ukraine via the EU member. Polish counter-intelligence has dismantled a cell of Russian spies that gathered information on the provisioning of military equipment to Ukraine via the EU member. “The ABW counter-intelligence agency has arrested nine people suspected of […]

    The post Polish intelligence dismantled a network of Russian spies appeared first on Security Affairs.

    "

    Autosummary: Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Polish intelligence) Share this: Email Twitter Print LinkedIn Facebook More Tumblr Pocket Share On "

    ---

    Microsoft sheds light on a year of Russian hybrid warfare in Ukraine

    rusia-ucrania
    2023-03-16 https://securityaffairs.com/143570/cyber-warfare-2/russian-hybrid-warfare-ukraine.html
    

    Russia-linked threat actors targeted at least 17 European nations in 2023, and 74 countries since the start of the invasion of Ukraine. Microsoft revealed that Russia-linked threat actors targeted at least 17 European nations between January and mid-February 2023. According to a report published by the IT giant, the state-sponsored hackers have targeted 74 countries […]

    The post Microsoft sheds light on a year of Russian hybrid warfare in Ukraine appeared first on Security Affairs.

    "

    Autosummary: Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Ukraine) Share this: Email Twitter Print LinkedIn Facebook More Tumblr Pocket Share On "

    ---

    STALKER 2 hacker demands Ukrainian game developer reinstates Russian language support, or else…

    government rusia-ucrania
    2023-03-14 https://grahamcluley.com/stalker-2-hacker-demands-ukrainian-game-developer-reinstates-russian-language-support-or-else/
    A Ukrainian video game developer has revealed that a hacker has leaked development material stolen from the company"s systems, and is threatening to release tens of gigabytes more if their unorthodox ransom demands are not met. "

    Autosummary: In a post on the Russian social media site VK (also known as VKontakte, effectively the Russian version of Facebook), a statement was posted demanding that the game have Russian voice acting reinstated (it was removed following the invasion of Ukraine), apologise to players based in Russia and Belarus, and unban an acount on the game’s Discord channel. The first-person shooter game, developed by Ukraine-based GSC Game World, is hotly anticipated by fans of its prequel “STALKER: Shadow of Chernobyl,” but isn’t scheduled to be released until December 2023. "

    ---

    Microsoft fixes Outlook zero-day used by Russian hackers since April 2022

    exploits rusia-ucrania
    2023-03-14 https://www.bleepingcomputer.com/news/microsoft/microsoft-fixes-outlook-zero-day-used-by-russian-hackers-since-april-2022/
    Microsoft has patched an Outlook zero-day vulnerability (CVE-2023-23397) exploited by a hacking group linked to Russia"s military intelligence service GRU to target European organizations. [...] "

    Autosummary: The hacking group (tracked as APT28, STRONTIUM, Sednit, Sofacy, and Fancy Bear) sent malicious Outlook notes and tasks to steal NTLM hashes via NTLM negotiation requests by forcing the targets’ devices to authenticate to attacker-controlled SMB shares. "

    ---

    STALKER 2 game developer hacked by Russian hacktivists, data stolen

    rusia-ucrania
    2023-03-13 https://www.bleepingcomputer.com/news/security/stalker-2-game-developer-hacked-by-russian-hacktivists-data-stolen/
    GSC Game World, the developer of the highly-anticipated "STALKER 2: Heart of Chornobyl" game, warned their systems were breached, allowing threat actors to steal game assets during the attack. [...] "

    Autosummary: Hackers complain about firm’s stance The hackers posted a message on the Russian social media platform VK, claiming to have stolen a “vast amount of STALKER 2 material,” including the entire storyline, cutscene descriptions, concept art, global maps, and more. "

    ---

    Pro-Ukraine hackers CH01 defaced tens of Russian websites on the invasion anniversary

    rusia-ucrania
    2023-02-26 https://securityaffairs.com/142713/hacktivism/ch01-defaced-russian-websites.html
    

    The group of hacktivists CH01 defaced at least 32 Russian websites to mark a protest over the one-year anniversary of the Russian invasion A group of hacktivists that goes online with the moniker CH01 defaced at least 32 Russian websites to mark a protest over the one-year anniversary of the Russian invasion. The news was […]

    The post Pro-Ukraine hackers CH01 defaced tens of Russian websites on the invasion anniversary appeared first on Security Affairs.

    "

    Autosummary: #Anonymous their affiliates and Pro-Ukrainian hackers have defaced at least 32 websites, showing the #Kremlin on fire, to mark a protest over the one-year anniversary of the #Russian invasion of #Ukraine during their #OpRussia campaign #WeStandWithUkraine #FckPutin pic.twitter.com/PUs0MiBeXo — Anonymous Operations (@AnonOpsSE) February 25, 2023 The hackers have uploaded a video showing the Kremlin burning on the defaced websites. "

    ---

    Russian malware dev behind NLBrute hacking tool extradited to US

    exploits rusia-ucrania
    2023-02-23 https://www.bleepingcomputer.com/news/security/russian-malware-dev-behind-nlbrute-hacking-tool-extradited-to-us/
    A Russian malware developer accused of creating and selling the NLBrute password-cracking tool was extradited to the United States after being arrested in the Republic of Georgia last year on October 4. [...] "

    Autosummary: "

    ---

    Ukraine says Russian hackers backdoored govt websites in 2021

    rusia-ucrania
    2023-02-23 https://www.bleepingcomputer.com/news/security/ukraine-says-russian-hackers-backdoored-govt-websites-in-2021/
    The Computer Emergency Response Team of Ukraine (CERT-UA) says Russian state hackers have breached multiple government websites this week using backdoors planted as far back as December 2021. [...] "

    Autosummary: "

    ---

    Russian women explain why they chose to give birth in Argentina

    latam rusia-ucrania
    2023-02-22 https://www.bbc.co.uk/news/world-latin-america-64722803?at_medium=RSS&at_campaign=KARANGA
    Thousands of pregnant Russian women are travelling to Argentina despite having no links to the country. "

    Autosummary: "

    ---

    Hackers blamed after Russian radio stations play warnings of missile strikes and air raids

    rusia-ucrania
    2023-02-22 https://grahamcluley.com/hackers-russian-radio-missile-strikes-and-air-raids/
    Russian media has blamed hackers after commercial radio stations in the country broadcast bogus warnings about air raids and missile strikes, telling listeners to head to shelters. "

    Autosummary: "

    ---

    Google Reveals Alarming Surge in Russian Cyber Attacks Against Ukraine

    rusia-ucrania
    2023-02-20 https://thehackernews.com/2023/02/google-reveals-alarming-surge-in.html
    Russia"s cyber attacks against Ukraine surged by 250% in 2022 when compared to two years ago, Google"s Threat Analysis Group (TAG) and Mandiant disclosed in a new joint report. The targeting, which coincided and has since persisted following the country"s military invasion of Ukraine in February 2022, focused heavily on the Ukrainian government and military entities, alongside critical "

    Autosummary: Some of the key actors involved in the efforts include FROZENBARENTS (aka Sandworm or Voodoo Bear), FROZENLAKE (aka APT28 or Fancy Bear), COLDRIVER (aka Callisto Group), FROZENVISTA (aka DEV-0586 or UNC2589), and SUMMIT (aka Turla or Venomous Bear). "

    ---

    Russian cybersecurity firm owner convicted of $90 million SEC earning reports hack

    rusia-ucrania ciber
    2023-02-16 https://www.tripwire.com/state-of-security/cybercriminal-convicted-90-million-sec-earning-reports-hack
    The owner of a Russian penetration-testing company has been found guilty of being part of an elaborate scheme that netted $90 million after stealing SEC earning reports. For nearly three years, 42-year-old Vladislav Klyushin - the owner of Moscow-based cybersecurity firm M-13 - and his co-conspirators had hacked into two US-based filing agents used by publicly-traded American companies to file earning reports to the Securities and Exchange Commission. Read more in my article on the Tripwire State of Security blog. "

    Autosummary: "

    ---

    Russian hacker convicted of $90 million hack-to-trade charges

    rusia-ucrania
    2023-02-15 https://www.bleepingcomputer.com/news/security/russian-hacker-convicted-of-90-million-hack-to-trade-charges/
    Russian national Vladislav Klyushin was found guilty of participating in a global scheme that involved hacking into U.S. computer networks to steal confidential earnings reports, which helped the criminals net $90,000,000 in illegal profits. [...] "

    Autosummary: "

    ---

    Russian Government evaluates the immunity to hackers acting in the interests of Russia

    government rusia-ucrania
    2023-02-12 https://securityaffairs.com/142139/cyber-warfare-2/russian-government-crooks-immunity.html
    

    The Russian Government proposed to give a sort of immunity to the hackers that operate in the interests of Moscow. Russian media reported that Alexander Khinshtein, the head of the Duma committee on information policy, announced that the Russian government is evaluating to avoid punishing hackers acting in the interests of Moscow. “The question of […]

    The post Russian Government evaluates the immunity to hackers acting in the interests of Russia appeared first on Security Affairs.

    "

    Autosummary: "

    ---

    Thousands of pregnant Russian women fly to Argentina

    latam rusia-ucrania
    2023-02-11 https://www.bbc.co.uk/news/world-64610954?at_medium=RSS&at_campaign=KARANGA
    The women are trying to ensure their children obtain Argentinian passports, officials say. "

    Autosummary: "

    ---

    U.K. and U.S. Sanction 7 Russians for TrickBot, Ryuk, and Conti Ransomware Attacks

    exploits ransomware rusia-ucrania
    2023-02-10 https://thehackernews.com/2023/02/uk-and-us-sanction-7-russians-for.html
    In a first-of-its-kind coordinated action, the U.K. and U.S. governments on Thursday levied sanctions against seven Russian nationals for their affiliation to the TrickBot, Ryuk, and Conti cybercrime operation. The individuals designated under sanctions are Vitaly Kovalev (aka Alex Konor, Bentley, or Bergen), Maksim Mikhailov (aka Baget), Valentin Karyagin (aka Globus), Mikhail Iskritskiy (aka "

    Autosummary: The individuals designated under sanctions are Vitaly Kovalev (aka Alex Konor, Bentley, or Bergen), Maksim Mikhailov (aka Baget), Valentin Karyagin (aka Globus), Mikhail Iskritskiy (aka Tropa), Dmitry Pleshevskiy (aka Iseldor), Ivan Vakhromeyev (aka Mushroom), and Valery Sedletski (aka Strix). "

    ---

    US and UK sanctioned seven Russian members of Trickbot gang

    rusia-ucrania
    2023-02-09 https://securityaffairs.com/142041/cyber-crime/us-uk-sanctioned-7-russian-trickbot.html
    

    The US and the UK have sanctioned seven Russian individuals for their involvement in the TrickBot operations. The US and the UK authorities have sanctioned seven Russian individuals for their involvement in the TrickBot operations. The US Treasury has frozen the assets belonging to the individuals and imposed travel bans against them. The US Treasury […]

    The post US and UK sanctioned seven Russian members of Trickbot gang appeared first on Security Affairs.

    "

    Autosummary: Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Trickbot) Share this: Email Twitter Print LinkedIn Facebook More Tumblr Pocket Share OnThese malicious cyber activities have targeted critical infrastructure, including hospitals and medical facilities during a global pandemic, in both the U.S. and the U.K.” This is the first time the UK government has imposed such kind of sanctions, its authorities collaborated with the U.S. Department of the Treasury’s Office of Foreign Assets Control and the U.K.’s Foreign, Commonwealth, and Development Office; National Crime Agency; and His Majesty’s Treasury.: “By sanctioning these cyber criminals, we are sending a clear signal to them and others involved in ransomware that they will be held to account.” said UK Foreign Secretary James Cleverly. "

    ---

    Seven Russians sanctioned over ransomware cyber-crime

    exploits ransomware rusia-ucrania
    2023-02-09 https://www.bbc.co.uk/news/technology-64586361?at_medium=RSS&at_campaign=KARANGA
    UK and US announce rare joint action against the men, including freezing their assets. "

    Autosummary: "

    ---

    SNP MP Stewart McDonald"s emails hacked by Russian group

    rusia-ucrania
    2023-02-08 https://www.bbc.co.uk/news/uk-politics-64562832?at_medium=RSS&at_campaign=KARANGA
    Stewart McDonald tells the BBC his emails have been stolen by a group linked to Russian intelligence. "

    Autosummary: "

    ---

    Russian Hackers Using Graphiron Malware to Steal Data from Ukraine

    exploits rusia-ucrania
    2023-02-08 https://thehackernews.com/2023/02/russian-hackers-using-graphiron-malware.html
    A Russia-linked threat actor has been observed deploying a new information-stealing malware in cyber attacks targeting Ukraine. Dubbed Graphiron by Broadcom-owned Symantec, the malware is the handiwork of an espionage group known as Nodaria, which is tracked by the Computer Emergency Response Team of Ukraine (CERT-UA) as UAC-0056. "The malware is written in Go and is designed to harvest a wide "

    Autosummary: "

    ---

    Russian Hacker Pleads Guilty to Money Laundering Linked to Ryuk Ransomware

    financial exploits ransomware rusia-ucrania
    2023-02-08 https://thehackernews.com/2023/02/russian-hacker-pleads-guilty-to-money.html
    A Russian national on February 7, 2023, pleaded guilty in the U.S. to money laundering charges and for attempting to conceal the source of funds obtained in connection with Ryuk ransomware attacks. Denis Mihaqlovic Dubnikov, 30, was arrested in Amsterdam in November 2021 before he was extradited from the Netherlands in August 2022. He is awaiting sentencing on April 11, 2023. "Between at least "

    Autosummary: "

    ---

    Russian hackers using new Graphiron information stealer in Ukraine

    rusia-ucrania
    2023-02-08 https://www.bleepingcomputer.com/news/security/russian-hackers-using-new-graphiron-information-stealer-in-ukraine/
    The Russian hacking group known as "Nodaria" (UAC-0056) is using a new information-stealing malware called "Graphiron" to steal data from Ukrainian organizations. [...] "

    Autosummary: Steal SSH known hosts Steal data from PuTTY Steal stored passwords Take screenshots Create a directory List a directory Run a shell command Steal an arbitrary file The malware uses the following PowerShell code to steal passwords from the Windows Vault, the system"s built-in password manager, where saved credentials are stored in AES-256 encrypted form. "

    ---

    Russian national pleads guilty to money laundering linked to Ryuk Ransomware operation

    financial exploits ransomware rusia-ucrania
    2023-02-08 https://securityaffairs.com/141980/cyber-crime/russian-national-pleads-guilty-money-laundering-ryuk-ransomware.html
    

    A Russian national pleaded guilty in the U.S. to money laundering charges linked to the Ryuk ransomware operation. On February 7, 2023, Russian national Denis Mihaqlovic Dubnikov (30) pleaded guilty in the U.S. to one count of conspiracy to commit money laundering for the Ryuk ransomware operation. Denis Mihaqlovic Dubnikov, 30, was arrested in Amsterdam in November […]

    The post Russian national pleads guilty to money laundering linked to Ryuk Ransomware operation appeared first on Security Affairs.

    "

    Autosummary: Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Ryuk ransomware) Share this: Email Twitter Print LinkedIn Facebook More Tumblr Pocket Share On "

    ---

    Russian e-commerce giant Elevel exposed buyers’ delivery addresses

    rusia-ucrania
    2023-02-08 https://securityaffairs.com/142000/data-breach/elevel-data-leak.html
    

    A leading electrical engineering company in Russia, Elevel, has exposed its customers’ personally identifiable information (PII,) including full names and addresses. Original post at hxxps://cybernews.com/privacy/russian-e-commerce-giant-data-leak/ Founded in 1991, Elevel (previously Eleko) positions itself as the leading Russian electrical engineering company that runs both an e-commerce business and wholesale stores. On January 24, the Cybernews research […]

    The post Russian e-commerce giant Elevel exposed buyers’ delivery addresses appeared first on Security Affairs.

    "

    Autosummary: "

    ---

    Anonymous leaked 128GB of data stolen from Russian ISP Convex revealing FSB’s warrantless surveillance

    rusia-ucrania
    2023-02-07 https://securityaffairs.com/141888/hacktivism/anonymous-fsb-surveillance.html
    

    The popular collective Anonymous has leaked 128 GB of data allegedly stolen from the Russian Internet Service Provider Convex. The collective Anonymous released last week 128 gigabytes of documents that were allegedly stolen from the Russian Internet Service Provider Convex. The huge trove of data was leased by an affiliate of Anonymous’s affiliate group called […]

    The post Anonymous leaked 128GB of data stolen from Russian ISP Convex revealing FSB’s warrantless surveillance appeared first on Security Affairs.

    "

    Autosummary: #Anonymous #OpRussia https://t.co/Q2DwUb3t3c, hacked they provide telecom services in #Russia, internet/telephone/cable Government, business Green Atom project exposed and used for spying on Internet/telephone traffic under an agreement with the FSS Credit- CAXXII#Ukraine pic.twitter.com/DTxNfa5Mpl — Anonymous Operations (@AnonOpsSE) January 31, 2023 Such surveillance activities are classified as unauthorized wiretapping, espionage, and warrantless surveillance of civilians, which are against the country’s laws. "

    ---

    Russian man pleads guilty to laundering Ryuk ransomware money

    financial exploits ransomware rusia-ucrania
    2023-02-07 https://www.bleepingcomputer.com/news/security/russian-man-pleads-guilty-to-laundering-ryuk-ransomware-money/
    Russian citizen Denis Mihaqlovic Dubnikov pleaded guilty on Tuesday to laundering money for the notorious Ryuk ransomware group for over three years. [...] "

    Autosummary: The conspirators, including Dubnikov, used various financial transactions, including international ones, to hide the origin, location, and identity of those who received the ransom payments. "

    ---

    New Russian-Backed Gamaredon"s Spyware Variants Targeting Ukrainian Authorities

    rusia-ucrania
    2023-02-02 https://thehackernews.com/2023/02/new-russian-backed-gamaredons-spyware.html
    The State Cyber Protection Centre (SCPC) of Ukraine has called out the Russian state-sponsored threat actor known as Gamaredon for its targeted cyber attacks on public authorities and critical information infrastructure in the country. The advanced persistent threat, also known as Actinium, Armageddon, Iron Tilden, Primitive Bear, Shuckworm, Trident Ursa, and UAC-0010, has a track record of "

    Autosummary: The advanced persistent threat, also known as Actinium, Armageddon, Iron Tilden, Primitive Bear, Shuckworm, Trident Ursa, and UAC-0010, has a track record of striking Ukrainian entities dating as far back as 2013. "

    ---

    Latvia says Russian hackers tried to phish its Ministry of Defence

    rusia-ucrania
    2023-01-30 https://www.bitdefender.com/blog/hotforsecurity/latvia-says-russian-hackers-tried-to-phish-its-ministry-of-defence/
    The Kremlin-backed Gamaredon hacking group is being blamed for an attempted phishing attack against the Latvian Ministry of Defence. Read more in my article on the Hot for Security blog. "

    Autosummary: "

    ---

    British Cyber Agency Warns of Russian and Iranian Hackers Targeting Key Industries

    rusia-ucrania
    2023-01-27 https://thehackernews.com/2023/01/british-cyber-agency-warns-of-russian.html
    The U.K. National Cyber Security Centre (NCSC) on Thursday warned of spear-phishing attacks mounted by Russian and Iranian state-sponsored actors for information-gathering operations. "The attacks are not aimed at the general public but targets in specified sectors, including academia, defense, government organizations, NGOs, think tanks, as well as politicians, journalists and activists," the "

    Autosummary: "The attacks are not aimed at the general public but targets in specified sectors, including academia, defense, government organizations, NGOs, think tanks, as well as politicians, journalists and activists," the NCSC said. "

    ---

    Iranian and Russian hackers targeting politicians and journalists, warn UK officials

    rusia-ucrania
    2023-01-26 https://www.bbc.co.uk/news/uk-64405220?at_medium=RSS&at_campaign=KARANGA
    Politicians and journalists are being targeted with espionage attacks, the UK government is warning. "

    Autosummary: "

    ---

    UK warns of increased attacks from Russian, Iranian hackers

    rusia-ucrania
    2023-01-26 https://www.bleepingcomputer.com/news/security/uk-warns-of-increased-attacks-from-russian-iranian-hackers/
    The U.K. National Cyber Security Centre (NCSC) has issued a warning of Russian and Iranian state-sponsored hackers increasingly targeting organizations and individuals. [...] "

    Autosummary: “The attacks are not aimed at the general public but targets in specified sectors, including academia, defense, government organizations, NGOs, think tanks, as well as politicians, journalists, and activists” - U.K. NCSC SEABORGIUM, also known as ‘TA446,’ is a Russian state-sponsored threat group that targeted NATO countries last summer. "

    ---

    Russian and Belarusian men charged with spying for Russian GRU

    rusia-ucrania
    2023-01-08 https://securityaffairs.com/140507/intelligence/poland-charged-russian-gru-spies.html
    

    Polish authorities charged Russian and Belarusian individuals with spying for the Russian military intelligence service (GRU). Polish authorities charged Russian and Belarusian individuals, who were arrested in April, with spying for the Russian military intelligence service (GRU) from 2017 to April 2022. The defendants gathered intelligence on military facilities critical for the defense of the […]

    The post Russian and Belarusian men charged with spying for Russian GRU appeared first on Security Affairs.

    "

    Autosummary: The defendants gathered intelligence on military facilities critical for the defense of the country, focusing on military units from the northeast, as well as information on the combat capability, morale, and functioning of military units. "

    ---