The Kremlin in Moscow, Sept. 29, 2017. The elite Russian state hackers behind last year's massive SolarWinds cyberespionage campaign hardly eased up this year, managing plenty of infiltrations of U.S. and allied government agencies and foreign policy think tanks with consummate craft and stealth, a leading cybersecurity firm reported Monday. (AP Photo/Ivan Sekretarev, File)
ERIC TUCKER and FRANK BAJAK
Mon, December 6, 2021
WASHINGTON (AP) — The elite Russian state hackers behind last year's massive SolarWinds cyberespionage campaign hardly eased up this year, managing plenty of infiltrations of U.S. and allied government agencies and foreign policy think tanks with consummate craft and stealth, a leading cybersecurity firm reported.
Also Monday, Microsoft announced that it had disrupted the cyber-spying of a state-backed Chinese hacking group by seizing websites it used to gather intelligence from foreign ministries, think tanks and human rights organizations in the U.S. and 28 other countries, chiefly in Latin America and Europe.
Microsoft said a Virginia federal court had granted its request last Thursday to seize 42 web domains that the Chinese hacking group, which it calls Nickel but which is also known as APT15 and Vixen Panda, were using to access targets typically aligned with China's geopolitical interests. It said in a blog that “a key piece of the infrastructure the group has been relying on” in its latest wave of infiltrations was removed. The seized domains include “elperuanos.org,” “pandemicacre.com” and “cleanskycloud.com.”
The dual announcements, though unrelated, highlight the unrelenting drumbeat of digital spying by its top U.S. geopolitical rivals, whose cyber-intrusion skillset is matched only by that of the United States.
A year after it discovered the SolarWinds intrusions, Mandiant said the hackers associated with Russia's SVR foreign intelligence agency continue to steal data “relevant to Russian interests” with great effect using novel, stealthy techniques that it detailed in a mostly technical report aimed at helping security professionals stay alert. It was Mandiant, not the U.S. government, that disclosed SolarWinds.
While the number of government agencies and companies hacked by the SVR was smaller this year than last, when some 100 organizations were breached, assessing the damage is difficult, said Charles Carmakal, Mandiant's chief technical officer. Overall, the impact is quite serious. “The companies that are getting hacked, they are also losing information.”
“Not everybody is disclosing the incident(s) because they don’t always have to disclose it legally,” he said, complicating damage-assessment.
The Russian cyber spying unfolded, as always, mostly in the shadows as the U.S. government was consumed in 2021 by a separate, eminently “noisy” and headline-grabbling cyber threat — ransomware attacks launched not by nation-state hackers but rather criminal gangs. As it happens, those gangs are largely protected by the Kremlin.
The Mandiant findings follow an October report from Microsoft that the hackers, whose umbrella group it calls Nobelium, continue to infiltrate the government agencies, foreign policy think tanks and other organizations focused on Russian affairs through the cloud service companies and so-called managed services providers on which they increasingly rely. The Mandiant researchers said the Russian hackers “continue to innovate and identify new techniques and tradecraft” that lets them linger in victim networks, hinder detection and confuse attempts to attribute hacks to them.
Mandiant did not identify individual victims or describe what specific information may have been stolen but did say unspecified “diplomatic entities" that received malicious phishing emails were among the targets.
Often, the researchers say, the hackers' path of least resistance to their targets were cloud-computing services. From there, they used stolen credentials to infiltrate networks. The report describes how in one case they gained access to one victim's Microsoft 365 system through a stolen session token. And, the report says, the hackers routinely relied on advanced tradecraft to cover their tracks.
One clever technique discussed in the report illustrates the ongoing cat-and-mouse game that digital espionage entails. Hackers set up intrusion beachheads using IP addresses, a numeric designation that identifies its location on the internet, that were physically located near an account they are trying to breach — in the same address block, say, as the person's local internet provider. That makes it highly difficult for security software to detect a hacker using stolen credentials posing as someone trying to access their work account remotely.
Microsoft expressed no illusions that the website seizures it announced Monday would discourage the Chinese hackers, who it has been tracking since 2016. It said the takedowns were of infrastructure it has been tracking since 2019, much of it exploiting on-premises —- as opposed to cloud-based — Exchange Server and SharePoint systems. The company has used the legal takedown tactic in 24 lawsuits to date, Microsoft said, knocking out a total of 600 sites used by nation-state actors and 10,000 by cybercriminals.
The SolarWinds hack exploited vulnerabilities in the software supply-chain system and went undetected for most of 2020 despite compromises at a broad swath of federal agencies — including the Justice Department — and dozens of companies, primarily telecommunications and information technology providers and including Mandiant and Microsoft.
The hacking campaign is named SolarWinds after the U.S. software company whose product was exploited in the first-stage infection of that effort. The Biden administration imposed sanctions last April in response to the hack, including against six Russian companies that support the country's cyber efforts.
Microsoft seizes control of websites used by China-backed hackers
Carly Page
Mon, December 6, 2021
Microsoft has seized control of a number of websites that were being used by a Chinese government-backed hacking group to target organizations in 29 countries, including the U.S.
Microsoft’s Digital Crimes Unit (DCI) said on Monday that a federal court in Virginia had granted an order allowing the company to take control of the websites and redirect the traffic to Microsoft servers. These malicious websites were being used by a state-sponsored hacking group known as Nickel, or APT15, to gather intelligence from government agencies, think tanks and human rights organizations, according to the company.
Microsoft didn’t name Nickel’s targets, but said the group was targeting organizations in the U.S. and 28 other countries. It added that "there is often a correlation between Nickel’s targets and China’s geopolitical interests."
Microsoft, which has been tracking Nickel since 2016 and previously described it as one of the “most active” hacking groups targeting government agencies, said it observed “highly sophisticated” attacks that installed hard-to-detect malware that facilitates intrusion, surveillance and data theft. In some cases, Nickel’s attacks used compromised third-party virtual private network (VPN) suppliers and credentials obtained from spear-phishing campaigns, according to Microsoft, and in others, vulnerabilities in Microsoft’s own Exchange Server and SharePoint system were used to infiltrate companies. However, Microsoft noted that it has “not observed any new vulnerabilities in Microsoft products as part of these attacks."
“Obtaining control of the malicious websites and redirecting traffic from those sites to Microsoft’s secure servers will help us protect existing and future victims while learning more about Nickel’s activities,” wrote Tom Burt, Microsoft’s corporate vice president for customer security and trust. “Our disruption will not prevent Nickel from continuing other hacking activities, but we do believe we have removed a key piece of the infrastructure the group has been relying on for this latest wave of attacks.”
In addition to the U.S., Nickel also targeted organizations in Argentina, Barbados, Bosnia and Herzegovina, Brazil, Bulgaria, Chile, Colombia, Croatia, Czech Republic, Dominican Republic, Ecuador, El Salvador, France, Guatemala, Honduras, Hungary, Italy, Jamaica, Mali, Mexico, Montenegro, Panama, Peru, Portugal, Switzerland, Trinidad and Tobago, the United Kingdom and Venezuela.
Microsoft said its Digital Crimes Unit, through 24 lawsuits, had taken down more than 10,000 malicious websites used by cybercriminals and almost 600 used by nation-state actors. Earlier this year, the team took control of malicious web domains used in a large-scale cyberattack that targeted victims in 62 countries with spoofed email
Carly Page
Mon, December 6, 2021
Microsoft has seized control of a number of websites that were being used by a Chinese government-backed hacking group to target organizations in 29 countries, including the U.S.
Microsoft’s Digital Crimes Unit (DCI) said on Monday that a federal court in Virginia had granted an order allowing the company to take control of the websites and redirect the traffic to Microsoft servers. These malicious websites were being used by a state-sponsored hacking group known as Nickel, or APT15, to gather intelligence from government agencies, think tanks and human rights organizations, according to the company.
Microsoft didn’t name Nickel’s targets, but said the group was targeting organizations in the U.S. and 28 other countries. It added that "there is often a correlation between Nickel’s targets and China’s geopolitical interests."
Microsoft, which has been tracking Nickel since 2016 and previously described it as one of the “most active” hacking groups targeting government agencies, said it observed “highly sophisticated” attacks that installed hard-to-detect malware that facilitates intrusion, surveillance and data theft. In some cases, Nickel’s attacks used compromised third-party virtual private network (VPN) suppliers and credentials obtained from spear-phishing campaigns, according to Microsoft, and in others, vulnerabilities in Microsoft’s own Exchange Server and SharePoint system were used to infiltrate companies. However, Microsoft noted that it has “not observed any new vulnerabilities in Microsoft products as part of these attacks."
“Obtaining control of the malicious websites and redirecting traffic from those sites to Microsoft’s secure servers will help us protect existing and future victims while learning more about Nickel’s activities,” wrote Tom Burt, Microsoft’s corporate vice president for customer security and trust. “Our disruption will not prevent Nickel from continuing other hacking activities, but we do believe we have removed a key piece of the infrastructure the group has been relying on for this latest wave of attacks.”
In addition to the U.S., Nickel also targeted organizations in Argentina, Barbados, Bosnia and Herzegovina, Brazil, Bulgaria, Chile, Colombia, Croatia, Czech Republic, Dominican Republic, Ecuador, El Salvador, France, Guatemala, Honduras, Hungary, Italy, Jamaica, Mali, Mexico, Montenegro, Panama, Peru, Portugal, Switzerland, Trinidad and Tobago, the United Kingdom and Venezuela.
Microsoft said its Digital Crimes Unit, through 24 lawsuits, had taken down more than 10,000 malicious websites used by cybercriminals and almost 600 used by nation-state actors. Earlier this year, the team took control of malicious web domains used in a large-scale cyberattack that targeted victims in 62 countries with spoofed email
No comments:
Post a Comment