Tag Archive for: Sandworm

Sandworm hacker group behind cyber attack on Kyivstar – Security Service of Ukraine

/in


Sandworm hacker group behind cyber attack on Kyivstar – Security Service of Ukraine

The hacker group Sandworm, which is a regular unit of Russian military intelligence, was behind the cyber attack on the Ukrainian mobile operator Kyivstar at the end of December 2023, Head of the Security Service of Ukraine’s (SBU) cybersecurity department Illia Vitiuk said in an interview with Reuters.

“The SBU helped Kyivstar restore its systems within days and to repel new cyber attacks. After the major break, there were a number of new attempts aimed at dealing more damage to the operator,” the SBU press service quoted Vitiuk on its Telegram channel on Thursday.

According to the head of the department, the enemy planned to strike several times in a row, seeking to leave people without communication for as long as possible. “In this case, other operators might not be able to withstand a prolonged overload of their networks,” he said.

Vitiuk said that the SBU continues to investigate the case of a large-scale hack of Kyivstar under several articles of the Criminal Code of Ukraine.

“Currently, cyber specialists of the Security Service are already examining individual samples of malicious software used by the enemy. The attack was diligently prepared for many months,” the head of the SBU department said.

Vitiuk confirmed that the hacker group Sandworm, a regular unit of Russian military intelligence and has previously repeatedly carried out cyber attacks on Ukrainian targets, including telecom operators and Internet providers, is behind this attack. He also emphasized that this cyber attack had a significant impact on civilians but did not have a serious effect on military communications, since the Defense Forces use different algorithms and communication protocols.

In general, according to Vitiuk, since the beginning of the full-scale invasion, the SBU has detected about 9,000 cyber attacks on government resources and critical infrastructure facilities in Ukraine.

Source…

Ukrainian Telcos Targeted by Suspected Sandworm Hackers

/in


Cyberwarfare / Nation-State Attacks
,
Fraud Management & Cybercrime

Attackers’ MO: Data Exfiltration, Followed by Network and Hardware Disruption

Mathew J. Schwartz (euroinfosec) •
October 17, 2023    

Ukrainian Telcos Targeted by Suspected Sandworm Hackers
Communication gear on the TV tower of Central Television of Ukraine in Kyiv, Ukraine, in a photo from 2014 (Image: Shutterstock)

Russian hackers are targeting Ukrainian government agencies and critical infrastructure with a barrage of “destructive” malware designed to wipe or destroy IT systems, Kyiv cyber defenders said.

See Also: Challenges and Solutions in MSSP-Driven Governance, Risk, and Compliance for Growing Organizations

Between May and September, at least 11 Ukrainian telecommunications firms detected hacks that, in some cases, disrupted service, Ukraine’s Computer Emergency Response Team, CERT-UA, reported Monday.

Ukraine gave the codename UAC-0165 to the threat actor behind the attacks and said it has moderate confidence that the attacks are being perpetrated by the Sandworm hacking team, which has pummeled Ukraine with cyberattacks for more than half a decade. Western intelligence says that Sandworm – aka Seashell Blizzard, TeleBots and Voodoo Bear – is run by Russia’s GRU military intelligence agency.


In January, Ukraine’s top information protection agency warned that Russia continues to use data stealers and wiper malware for destruction and cyberespionage as it continues its war of aggression. The State Service of Special Communications and Information Protection of Ukraine reported that the sectors being most targeted are energy, security and defense, telecommunications, technology and development, finance, and logistics.


The SSSCIP recently said Moscow appeared to be stepping up its destructive attacks, especially against the energy sector,…

Source…

A year of wipers: How the Kremlin-backed Sandworm has attacked Ukraine during the war

/in


Last November, several Ukrainian organizations were targeted by a new type of ransomware called RansomBoggs. Its operators sent infected computers a ransom note written on behalf of James P. Sullivan — the main protagonist of the animated film Monsters, Inc. 

In the note Sullivan, whose job in the movie was to scare kids, asked for financial help in exchange for decrypting the organizations’ documents.

The hackers behind the attack are believed to be linked to Sandworm, a Russian nation-state threat actor working on behalf of the military intelligence agency GRU. But despite the attack wearing all the trappings of ransomware, Sandworm wasn’t out to make money — its primary goal was either to destroy Ukrainian networks or steal valuable data, according to researchers from the Slovak cybersecurity company ESET, which first spotted the RansomBoggs attack.

While Sandworm is not the Kremlin’s most important hacking group, it has perhaps become the most visible one, with an emphasis on disruptive cyberattacks. And its track record of successful attacks with a global impact – most notably the NotPetya malware and several attacks on Ukraine’s power supply – make it a grave concern to researchers.

In 2017, the group used NotPetya wiper malware disguised as ransomware to take down hundreds of networks across Ukrainian government agencies, banks, hospitals, and airports, causing an estimated $10 billion in global damage. By presenting destructive attacks as ransomware, Sandworm hackers may be trying to cover their tracks and make it more difficult for security researchers to attribute the attacks to a state-sponsored group.

In the case of the RansomBoggs attacks, the group was likely testing new techniques or training new workers on how to use their software, ESET senior malware researcher Anton Cherepanov told The Record.

Since the start of the war, Sandworm has been relentlessly targeting Ukraine with various malware strains. Some were highly sophisticated, while others contained bugs that made them easier to detect and prevent from spreading.

Researchers believe that Sandworm chose to experiment with malware in order to find strains that can bypass Ukraine’s improved…

Source…

Russian Sandworm Hackers Linked to New Ransomware Blitz

/in


An infamous Russian state-backed APT group could be behind a new wave of ransomware attacks against Ukrainian targets, according to researchers at ESET.

The security vendor claimed in a series of tweets that it alerted the Ukrainian Computer Emergency Response Team (CERT-UA) about the RansomBoggs variant it discovered targeting several local organizations.

The .NET malware is new, but deployed in a similar manner to previous campaigns linked to the Russian military intelligence (GRU) Sandworm group, it said.

There are apparently several references to Pixar movie Monsters Inc. in the malware.

“The ransom note (SullivanDecryptsYourFiles.txt) shows the authors impersonate James P. Sullivan, the main character of the movie, whose job is to scare kids. The executable file is also named Sullivan.exe and references are present in the code as well,” ESET explained.

“There are similarities with previous attacks conducted by Sandworm: a PowerShell script used to distribute the .NET ransomware from the domain controller is almost identical to the one seen last April during the Industroyer2 attacks against the energy sector.”

That script has been dubbed “PowerGap” by CERT-UA and was also used to deploy the destructive CaddyWiper malware alongside Industroyer 2 at the time, using the ArguePatch loader.

“RansomBoggs generates a random key and encrypts files using AES-256 in CBC mode (not AES-128 like mentioned in the ransom note), and appends the .chsch file extension. The key is then RSA encrypted and written to aes.bin,” ESET continued.

“Depending on the malware variant, the RSA public key can either be hardcoded in the malware sample itself or provided as argument.”

The vendor also claimed the operation has similarities to a separate ransomware campaign launched last month against Ukrainian and Polish logistics providers using the “Prestige” variant.

“The Prestige campaign may highlight a measured shift in IRIDIUM’s destructive attack calculus, signaling increased risk to organizations directly supplying or transporting humanitarian or military assistance to Ukraine,” Microsoft wrote at the time.

“More broadly, it may represent…

Source…