UK exposes Russian cyber campaign targeting support for Ukraine

The UK has uncovered what it says is a “malicious cyber marketing campaign” focusing on a number of organisations, together with these concerned in delivering overseas help to Ukraine

After a joint investigation with allies together with the US, Germany and France, the UK’s Nationwide Cyber Safety Centre (NCSC) mentioned a Russian army unit had been focusing on each private and non-private organisations since 2022.

These embody organisations concerned in supplying defence, IT providers and logistics help.

The safety our bodies of 10 Nato international locations and Australia mentioned Russian spies had used a mix of hacking methods to realize entry to networks.

A few of the targets have been internet-connected cameras at Ukrainian borders which monitored assist shipments going into the nation.

The report additionally says a tough estimate of 10,000 cameras have been accessed close to “army installations, and rail stations, to trace the motion of supplies into Ukraine.

It provides the “actors additionally used professional municipal providers, corresponding to visitors cams.”

The Russian army unit blamed for the espionage is named GRU Unit 26165 however goes by numerous casual names, together with Fancy Bear.

The infamous hacking group is understood to have previously leaked World Anti-Doping Company knowledge, and performed a key function in the 2016 cyber-attack on the US’s Democratic Nationwide Committee, based on safety consultants.

“This malicious marketing campaign by Russia’s army intelligence service presents a severe danger to focused organisations, together with these concerned within the supply of help to Ukraine,” Paul Chichester, NCSC Director of Operations, mentioned in an announcement.

“We strongly encourage organisations to familiarise themselves with the menace and mitigation recommendation included within the advisory to assist defend their networks,” he added.

Anybody concerned in shifting items into Ukraine “ought to think about themselves focused” by Russian army intelligence, John Hultquist, chief analyst at Google Risk Intelligence Group, mentioned.

“Past the curiosity in figuring out help to the battlefield, there may be an curiosity in disrupting that help by means of both bodily or cyber means,” he mentioned.

“These incidents could possibly be precursors to different severe actions.”

The joint cyber-security advisory mentioned Fancy Bear had focused organisations linked to crucial infrastructure together with ports, airports, air visitors administration and the defence trade.

These have been in 12 mainland European international locations and the US.

The hackers used a mix of methods to realize entry, the report mentioned, together with guessing passwords.

One other technique used is named spearphishing, the place faux emails are focused at particular individuals who have entry to methods.

They’re introduced with a faux web page the place they enter their login particulars, or inspired to click on a hyperlink which then installs malicious software program.

“The topics of spearphishing emails have been numerous and ranged from skilled subjects to grownup themes,” the report mentioned.

A vulnerability in Microsoft Outlook was additionally exploited to gather credentials “by way of specifically crafted Outlook calendar appointment invites”.

These sorts of methods have been “a staple tactic of this group for over a decade,” Rafe Pilling, director of menace intelligence at Sophos Counter Risk Unit, mentioned.

Digicam entry “would help within the understanding of what items have been being transported, when, in what volumes and help kinetic [weapons] focusing on,” he added.