Tag: Hafnium | SpinSafe

Sandworm targets Ukrainian power grid.

Sandworm, also known as Voodoo Bear, and in the org charts Unit 74455 of Russia’s GRU, has deployed CaddyWiper destructive malware and an Industroyer variant being called, simply, “Industroyer2.” ESET tweeted the results of its findings early Tuesday morning, and provided additional details in a report also published Tuesday. “ESET researchers collaborated with CERT-UA to analyze the attack against the Ukrainian energy company. The destructive actions were scheduled for 2022-04-08 but artifacts suggest that the attack had been planned for at least two weeks. The attack used ICS-capable malware and regular disk wipers for Windows, Linux and Solaris operating systems. We assess with high confidence that the attackers used a new version of the Industroyer malware, which was used in 2016 to cut power in Ukraine. We assess with high confidence that the APT group Sandworm is responsible for this new attack.”

The incident seems, at first look, an attempted repetition of the 2016 Russian cyberattacks against the Ukrainian grid that ESET mentioned in its report. CERT-UA offered a further description of the attack. It intended to use Industroyer2 against “high-voltage electrical substations” in a fashion tailored to the individual substations. CaddyWiper was used against Windows systems (including automated workstations), and other “destructive scripts” (OrcShred, SoloShred, and AwfulShred) were deployed against Linux systems.

The GRU’s attempt against the Ukrainian power grid appears to be the cyberattack most people were expecting back in February, especially because of the way it tracked earlier GRU takedowns of sections of Ukraine’s power grid. It also appears to have failed, and that failure may be attributed in part to successful Ukrainian defenses as well as to the methods Russia chose to use. In cyberspace as well as on the ground, Ukraine appears to have proved a tougher opponent than Russia expected.

In March, tens of thousands of organisations around the world discovered their private internal discussions had been cracked open and lain bare by a group of Chinese hackers.

a sign in front of a building: Photograph: Michel Euler/AP

© Provided by The Guardian
Photograph: Michel Euler/AP

Four previously undiscovered weaknesses in Microsoft’s Exchange software, known as “zero days” because of the amount of time the company had had to fix the flaws before they were exploited, lay behind the mass hack. The vulnerabilities, which affected software released from 2012 onwards, allowed the group to take permanent control of the corporate servers, siphoning emails, calendars, and anything else they desired.

Load Error

Even fully updated systems were vulnerable, until Microsoft released emergency updates to fix the holes on 2 March, just three days before the hacking campaign was publicly disclosed by security journalist Brian Krebs.

The mass hack started on 28 February, with thousands of companies falling victim every hour before it was even possible for them to defend against it. Many more were hit in the days following Microsoft’s deployment of an emergency fix, since companies are often wary about installing security updates the same day they are published in case critical functionality breaks.

The campaign was quickly identified as a potential espionage mission, due to the nature of the information at risk: Microsoft’s Exchange software handles all communications at companies that use it, allowing attackers to potentially seize usernames and passwords, confidential information, intellectual property, blackmail material and more.

Initially, the attack was attributed to a group known as “Hafnium”, thought by security researchers to be affiliated with the Chinese state. But that early attribution was not sufficient for the UK and its allies to publicly state that the Chinese government lay behind the attack. After months of investigation, the UK’s National Cyber Security Centre has now declared it “highly likely that Hafnium is associated with the Chinese state.”

a sign in front of a building: Vulnerabilities in Microsoft’s Exchange software allowed hackers to take control of corporate servers.

© Photograph: Michel Euler/AP
Vulnerabilities in Microsoft’s Exchange software allowed hackers to take control of corporate…

Source…

Tag Archive for: Hafnium

Sandworm targets Ukrainian power grid. CISA warns of ICS malware. Updates on Hafnium activity.

Sandworm targets Ukrainian power grid.

CISA warns of ICS malware.

What is the Hafnium Microsoft hack and why has the UK linked it to China?