Russian state hackers swap malware with cloud-based attacks

By Vilius Petkauskas, Cybernews

Russian adversaries increasingly focus on targeting the cloud environment, Crowdstrike’s Global Threat Report on Cloud Security revealed.

Fancy Bear, a Russian adversary associated with Russia’s Main Intelligence Directorate (GRU), used to rely on malware-based spear-phishing attacks, the report claims. However, with their tactics exposed by the US Department of Justice (DoJ), hackers have refocused their attention on cloud service providers.

Since Fancy Bear’s primary source of intelligence comes from various credential harvesting practices that allow penetrating target organizations and individuals, it’s no surprise that the main targets are cloud-based email providers.

According to the report, Fancy Bear focused their attention on service providers such as Microsoft 365, Google’s GSuite, as well as webmail providers that individuals usually use.

Meanwhile, Cozy Bear, Russia’s state-sponsored hacker group controlled by the Federal Security service (FSB), has been busy snooping for ways to bypass multifactor authentication (MFA) practices their victims employ.

Report’s authors claim that Cozy Bear has been very effective in successful lateral movement operation within the cloud environments their tools penetrate. Crowdstrike’s researchers noted hackers using authentication cookies that allowed them to slit through MFA restrictions.

With the right keys, hackers manage to access user accounts in possession of enterprise cloud service privileges, allowing further movement deeper into the cloud. Researchers note that high on success, Cozy Bear affiliates will continue to focus on users with admin privileges in cloud environments.