China-linked cyber-spies infect Russian govt, IT sector
Chinese cyber-spies compromised Russian government and IT systems using malware, including GrewApacha and CloudSorcerer, through phishing emails and cloud services, indicating collaboration among state-sponsored hacking groups.
Read original article
Cyber-spies with suspected ties to China have compromised numerous computers within Russian government agencies and IT sectors, deploying malware known as EastWind. Kaspersky, a cybersecurity firm based in Russia, reported that the attacks began in late July and involved phishing emails that contained malicious attachments. The attackers utilized various cloud services, including GitHub and Dropbox, as command-and-control servers to facilitate the download of additional malware onto the infected systems. The malware includes a trojan named GrewApacha, previously linked to Chinese cyber groups APT31 and APT27, and a backdoor called CloudSorcerer. The latter has been modified to use social media and question-and-answer platforms as initial command servers. Kaspersky's analysis revealed that the attackers also introduced a new implant, dubbed PlugY, which can execute a wide range of commands, including file manipulation and keystroke logging. The ongoing investigation suggests that the EastWind campaign demonstrates collaboration among state-sponsored hacking groups, sharing tools and techniques to enhance their cyber operations.
- Chinese cyber-spies have infected Russian government and IT systems with malware.
- The attacks began in late July and involved phishing emails with malicious attachments.
- Cloud services were used as command-and-control servers for malware deployment.
- The malware includes the GrewApacha trojan and the CloudSorcerer backdoor.
- The campaign highlights collaboration among state-sponsored hacking groups.
Related
Microsoft tells yet more customers their emails have been stolen
Microsoft notifies customers of email theft by Russian criminals, expanding breach scope. Compromised accounts' correspondents informed. US auto dealers face disruptions from cyber incident linked to CDK software. Rabbit R1 AI devices' security flaw disclosed. EU sanctions Russians for cyber attacks.
How Russia-Linked Malware Cut Heat to 600 Ukrainian Buildings in Deep Winter
Russia-linked malware FrostyGoop disrupted Lviv heating utility, affecting 600 buildings for 48 hours in January. The attack manipulated temperature readings via Modbus protocol, showcasing evolving tactics in Russia's campaign against Ukraine.
Russia-Linked Malware Cut Heat to 600 Ukrainian Buildings in Deep Winter
Russia-linked malware FrostyGoop disrupted a heating utility in Lviv, Ukraine, affecting 600 buildings for 48 hours. The attack manipulated temperature readings, highlighting evolving cyber warfare tactics against Ukraine.
Threat Actor Abuses Cloudflare Tunnels to Deliver Rats
Proofpoint reported increased cybercriminal activity using Cloudflare Tunnels to deliver malware, particularly remote access trojans. Campaigns involve phishing emails and exploit temporary tunnels, necessitating adaptive cybersecurity defenses.
Hackers breach ISP to poison software updates with malware
A Chinese hacking group, StormBamboo, breached an ISP to inject malware into software updates, exploiting insecure mechanisms. They redirected requests to install malware on victims' devices, including a malicious Chrome extension.
3 commentsRelated
Microsoft tells yet more customers their emails have been stolen
Microsoft notifies customers of email theft by Russian criminals, expanding breach scope. Compromised accounts' correspondents informed. US auto dealers face disruptions from cyber incident linked to CDK software. Rabbit R1 AI devices' security flaw disclosed. EU sanctions Russians for cyber attacks.
How Russia-Linked Malware Cut Heat to 600 Ukrainian Buildings in Deep Winter
Russia-linked malware FrostyGoop disrupted Lviv heating utility, affecting 600 buildings for 48 hours in January. The attack manipulated temperature readings via Modbus protocol, showcasing evolving tactics in Russia's campaign against Ukraine.
Russia-Linked Malware Cut Heat to 600 Ukrainian Buildings in Deep Winter
Russia-linked malware FrostyGoop disrupted a heating utility in Lviv, Ukraine, affecting 600 buildings for 48 hours. The attack manipulated temperature readings, highlighting evolving cyber warfare tactics against Ukraine.
Threat Actor Abuses Cloudflare Tunnels to Deliver Rats
Proofpoint reported increased cybercriminal activity using Cloudflare Tunnels to deliver malware, particularly remote access trojans. Campaigns involve phishing emails and exploit temporary tunnels, necessitating adaptive cybersecurity defenses.
Hackers breach ISP to poison software updates with malware
A Chinese hacking group, StormBamboo, breached an ISP to inject malware into software updates, exploiting insecure mechanisms. They redirected requests to install malware on victims' devices, including a malicious Chrome extension.