Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Ukraine-Russia War. Show all posts
Ukraine-Russia War
British Cyber Attacks Killnet Royal Family Russia Ukraine Ukraine-Russia War

Royal Family’s Official Website Suffers Cyberattack, Following Remarks on Russia


The British Royal Family’s official website is suffering a cyberattack, following UK’s support for Ukraine that went public. A DoS attack, which is brought on by an influx of unnecessary traffic, caused the Royal Family website to be unavailable for an hour and a half on Sunday morning. An 'error' notice would have been displayed to anyone attempting to visit the site at this time, but by early afternoon it was fully working once more.

While Buckingham Palace insiders claim that it is impossible to determine who was behind the attack at this time, the pro-Kremlin group Killnet has taken responsibility for it in a message posted on the social media site Telegram. The 'Five Eye Alliance' (an intelligence alliance made up of the UK, the US, Canada, Australia, and New Zealand) has previously identified the group as a significant cyber-security threat, and the US Department of Health has previously noted that Killnet has made a number of threats to organizations, including the NHS.

Thankfully, the DoS attack on the royal family website only caused service disruption. No privileged information was accessed, and no control over the website was obtained. These kinds of attacks tend to be more disruptive than damaging, but they can still bring down websites, which can be disastrous in some circumstances.

However, this was not the first the royal family had suffered a cyberattack. The website was also taken down in November 2022 by Killnet, and the Met Police foiled a cyber plot to interrupt the royal wedding of the current Prince and Princess of Wales in 2011.

For many years, but particularly since the Ukraine war, there has been a looming threat of a cyberattack by Russia or by organizations that support Russia. Oliver Dowden, the deputy prime minister, stated at the April Cyber UK conference in Belfast that these attacks may now be motivated by "ideology." The royal family has consistently shown its support for the Ukrainian people. The Princess of Wales met privately with the First Lady of Ukraine in September of last year, and this year, the Prince of Wales paid a visit to Ukrainian troops stationed near the border. In February, King Charles convened meetings with President Zelensky at Buckingham Palace.

The attack came to light only two weeks after King Charles made a public remark over the war, in his speech on the royal visit to Paris. In his comment, he mentioned Russia’s ‘unprovoked aggression’ and said that ‘Ukraine must prevail.’  

Read more »
Ukraine-Russia War
attackers Cyber Attacks Cyber Warfare Data Data Safety data security Russian Government Russian Hackers Safety Security Ukraine Government Ukraine-Russia War

This Threat Actor Targeted NATO Summit Attendees

 

A Russia-linked threat actor known as RomCom has been targeting entities supporting Ukraine, including guests at the 2023 NATO Summit. The summit is taking place in Vilnius, Lithuania, and will discuss the war in Ukraine and new memberships in NATO, including Sweden and Ukraine itself.

RomCom has created malicious documents that are likely to be distributed to supporters of Ukraine. The threat actor appears to have dry-tested the delivery of these documents on June 22, a few days before the command-and-control (C&C) domain used in the campaign went live, BlackBerry explained.

The malicious documents are likely distributed via spear-phishing. They contain an embedded RTF file and OLE objects that initialize an infection chain that garners system information and delivers the RomCom remote access trojan (RAT).

At one stage in the infection chain, a flaw in Microsoft's Support Diagnostic Tool (MSDT) – CVE-2022-30190, also known as Follina – is exploited for remote code execution (RCE).

BlackBerry has identified the C&C domains and victim IPs used in this campaign. All of these were accessed from a single server that has been observed connecting to known RomCom infrastructure.

"Based on the nature of the upcoming NATO Summit and the related lure documents sent out by the threat actor, the intended victims are representatives of Ukraine, foreign organizations, and individuals supporting Ukraine,” BlackBerry says.

BlackBerry has alerted relevant government agencies of this campaign. RomCom is also known as Void Rabisu and Tropical Scorpius, and is associated with the Cuba ransomware. The group was previously believed to be financially motivated, but recent campaigns have shown a shift in tactics and motivation, suggesting that they are now working for the Russian government.

Since at least October 2022, the RomCom backdoor has been used in attacks targeting Ukraine. These attacks have targeted users of Ukraine's Delta situational awareness program and organizations in Ukraine's energy and water utility sectors.

Outside Ukraine, RomCom attacks have targeted a provincial local government helping Ukrainian refugees, a parliament member of a European country, attendees of the Munich Security Conference and the Masters of Digital conference, and a European defense company.
Read more »
Ukraine-Russia War
Chinese Hacker Cyber Attacks Ukraine Ukraine-Russia War

Chinese Hacker Scarab Targets Ukrainian System, CERT-UA Warns

 

Ukraine’s Computer Emergency Response Team (CERT-UA) released evidence last week regarding a malicious campaign tracked as UAC-0026, which SentinelLabs associated with China-linked Scarab APT. threat actors. 

Scarab APT was first spotted in 2015, but researchers believe it has been active since at least 2012, conducting surgical assaults against multiple nations across the globe, including Russia and the United States. 

Threat actors are targeting the Ukrainian system by distributing malware via phishing messages using weaponized documents that deploy the HeaderTip malware. The phishing texts employ a RAR-archive titled “On the preservation of video recordings of the criminal actions of the army of the Russian Federation.rar” which contains the EXE-file of the same name. The malicious document employed in the campaign spotted by CERT-UA mimics the National Police of Ukraine. 

“Running the executable file will create a lure document ‘# 2163_02_33-2022.pdf’ on the computer (applies to a letter from the National Police of Ukraine), as well as a DLL file with the MZ header ‘officecleaner.dat’ and the BAT file ‘officecleaner’ removed. .bat,’ which will ensure the formation of the correct DLL-file, run it and write to the Windows registry to ensure consistency. The mentioned DLL-file is classified as a malicious program HeaderTip, the main purpose of which is to download and execute other DLL-files.” 

The HeaderTip samples employed by Chinese hackers are 32-bit DLL files written in C++. The malware executes backdoor capabilities and is also used as a first-stage malware. CERT-UA, which did not mention China or Scarab in its alert, added that identical attacks were observed in September last year. According to SentinelOne, it was able to tie UAC-0026 to Scarab through an analysis of the malware employed in the assault. 

“Further relationships can be identified through the reuse of actor-unique infrastructure between the malware families associated with the groups,” SentinelOne explained, adding that there is sufficient evidence depicting that the author of the malware is employing the Windows operating system in a Chinese language setting. 

“Based on known targets since 2020, including those against Ukraine in March 2022, in addition to specific language use, we assess with moderate confidence that Scarab is Chinese speaking and operating under geopolitical intelligence collection purposes,” SentinelOne concluded.
Read more »
Ukraine-Russia War
Cyber Security security threat U.S. Firms Ukraine-Russia War

New Bipartisan Bill Would Require Firms to Report Cyber Incidents Within 72 hours

 

Financial institutions critical to U.S. national interests will now have to report substantial cyber assaults and ransom payments to the federal government, an Associated Press report said, under a bill passed by Congress and expected to be signed by President Joe Biden.

The move comes amid the escalating war in Ukraine and concerns of possible Russian cyber threats to the U.S. firms. Last year, multiple private and government organizations were jolted by a series of high-profile digital espionage campaigns and disruptive ransomware attacks. The reporting will provide federal government much greater visibility into hacking efforts that target private firms, which often have skipped going to the FBI or other agencies for assistance. 

The reporting requirement was approved by the House and Senate on Thursday. It is expected to be signed into law by President Biden soon. “It’s clear we must take bold action to improve our online defenses,” stated Sen. Gary Peters, a Michigan Democrat who leads the Senate Homeland Security and Government Affairs Committee.

AP wrote that the new rules require any entity considered part of America’s critical infrastructure, including finance, transportation, and energy, to report any “substantial cyber incident” within 72 hours, and any ransomware payment they make within 24 hours, to the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency. 

According to Heather Hogsett, a senior leader of the Bank Policy Institute’s technology policy division, the 36-hour notices of service disruption “allow bank regulators to keep a pulse on what is happening in the country’s financial services industry” while the 72- and 24-hour notices to CISA will allow the agency to “produce reports about threat actors and provide early warning of potential attack vectors.”

In recent years ransomware attacks have flourished beyond expectation and have targeted multiple high-profile organizations. Last year, the ransomware operators targeted the biggest U.S. fuel pipeline and the world’s biggest meat packing company. 

The state hackers based in Russia and China have had success in spying on and hacking U.S. targets, including those that are deemed critical infrastructure, Reuters reported.

Security experts and government officials are concerned that Russia's war in Ukraine has increased the threat of cyberattacks against U.S. entities, by either state or proxy actors. Many ransomware operators live and work in Russia. 

“As our nation rightly supports Ukraine during Russia’s illegal unjustifiable assault, I am concerned the threat of Russian cyber and ransomware attacks against U.S. critical infrastructure will increase. The federal government must be able to quickly coordinate a response and hold these bad actors accountable," said Sen. Rob Portman, a Republican from Ohio.
Read more »
Subscribe to: Posts (Atom)