Information Technology Security

By Bill Toulas,  Bleeping Computer The Main Intelligence Directorate (GUR) of Ukraine's Ministry of Defense claims that it breached the servers of the Russian Ministry of Defense (Minoborony) and stole sensitive documents. A press release published today on an official Ukrainian government domain describes the attack as a "special operation" carried out by GUR's cyber-specialists. As a result of the breach, the GUR claims to have obtained sensitive documents that contain secret service information, including: Software used by the Russian Ministry of Defense for protecting and encrypting data An array of secret service documents from the Russian Ministry of Defense, including orders, reports, directives, and various other documents, circulated among over 2000 structural units of the ministry. Information that allows establishing the complete structure of the system of the Minoborony and its links. Data that helped identify senior heads of structural units of the Minobo...

By Sergiu Gatlan,  Bleeping Computer The Council of the European Union (EU) said today that Russian hackers and hacker groups increasingly attacking "essential" organizations worldwide could lead to spillover risks and potential escalation. "This increase in malicious cyber activities, in the context of the war against Ukraine, creates unacceptable risks of spillover effects, misinterpretation and possible escalation," the High Representative on behalf of the EU said Tuesday. "The latest distributed denial-of-service (DDoS) attacks against several EU Member States and partners claimed by pro-Russian hacker groups are yet another example of the heightened and tense cyber threat landscape that EU and its Member States have observed." In this context, the EU reminded Russia that all United Nations member states must adhere to the UN's Framework of responsible state behavior in cyberspace to ensure international security and peace. The EU urged all states ...

By Nathan Wasson,  Hot Hardware Shortly after Russia invaded Ukraine near the beginning of this year, some prominent hacking groups announced that they would be joining the war within the digital realm. The hacking collective Anonymous declared cyberwar against the Russian government and has since been conducting cyberattacks on Russian and Belarusian government websites, news channels, and military operations systems. On the other side of the conflict is the Conti ransomware gang, which announced its full support of the Russian government and intention to strike back against Western cyber operations. The Russian-speaking ransomware group has since broken up and abandoned the Conti name, but other Russian-based hacking groups are still conducting cyberattacks on Ukraine and its Western allies. Microsoft is also participating in the conflict by joining the ongoing sanctions on Russia. Microsoft halted sales in Russia near the outset of the war, but, just last week, Microsoft began b...

by Jurgita Lapienytė,  Cybernews For the first time ever, we are witnessing a real cyber war, Denys Tsvaig, the president of Ukraine’s national cybersecurity association, told Cybernews. The war in Ukraine caused turmoil in the cyber realm, with many pro-Ukrainian and pro-Russian citizens worldwide joining various efforts to fight. Hacktivism gained momentum soon after the invasion, causing collateral damage. Recently, the pro-Russian Killnet group made headlines after attacking Ukraine ally Lithuania’s websites in response to the Baltic country following EU sanctions. Hacktivism aside, Ukraine and Russia have used cyber weapons to support their kinetic operations. For example, Russia resorted to disinformation before many major military strikes. In its turn, Ukraine allegedly was able to cause some physical damage to Russian infrastructure using its IT resources, as unverified reports say. Some say Russia’s cyber weapons are just as weak as its artillery. The State Service of Spec...

By Sean Lyngaas, CNN An "intense, ongoing" cyberattack has hit the websites of government agencies and private firms in Lithuania, the Baltic country's defense ministry said Monday. A Russian-speaking hacking group, known as Killnet , claimed responsibility for at least some of the hacks, saying they were in retaliation for Lithuania blocking the shipment of some goods to the Russian enclave of Kaliningrad, which is wedged between Lithuania and Poland. Monday's cyberattacks were aimed in part at Lithuania's Secure Data Transfer Network, a communications network for government officials that is built to withstand war and other crises, according to the defense ministry. "Part of the Secure National Data Transfer Network users have been unable to access services, work is in progress to restore it to normal," Lithuania's National Cyber Security Centre (NKSC) said in a statement issued by the defense ministry. "It is highly probable that such, or eve...

By Loukia Papadopoulos,  Interesting Engineering What is on the horizon in Russia's war plans? According to Neal Higgins, deputy national cyber director for national cybersecurity, there could be more cyber warfare. The cybersecurity professional spoke to DefenseNews on June 14 at an event hosted by Defense One and had some pretty revealing comments.

By Bill Toulas,  Bleeping Computer Ukraine's Computer Emergency Response Team (CERT) is warning that the Russian hacking group Sandworm may be exploiting Follina, a remote code execution vulnerability in Microsoft Windows Support Diagnostic Tool (MSDT) currently tracked as CVE-2022-30190. The security issue can be triggered by either opening or selecting a specially crafted document and threat actors have been exploiting it in attacks since at least April 2022. It is worth noting that Ukraine's agency assesses with medium confidence that behind the malicious activity is the Sandworm hacker group.

By Rachel Pannett and Brittany Shammas, Washington Post A Russian radio station’s news bulletin was interrupted Wednesday by the Ukrainian anthem and antiwar songs, in the latest example of Russian media outlets apparently being targeted by antiwar hackers. Kommersant FM’s online broadcast suddenly began playing the Ukrainian patriotic song “Oh, the Red Viburnum in the Meadow,” BBC Monitoring reporter Francis Scarr wrote on Twitter. The station’s editor in chief, Alexei Vorobyov, confirmed the incident to the Russian state-owned news agency Tass, saying it appeared the internet stream had been hacked. He said technicians were investigating the origin of the attack. While apparently under the control of hackers, the station also played the Ukrainian national anthem and the song “We Don’t Need War” by the Russian rock band Nogu Svelo. The station is owned by Uzbek-born billionaire Alisher Usmanov, who was sanctioned by the United States and the European Union following the invasion for h...

By Reuters Russia warned the West on Thursday that cyber attacks against its infrastructure risked leading to direct military confrontation, and that attempts to challenge Moscow in the cyber sphere would be met with targeted countermeasures. The warning comes after Russia’s housing ministry website appeared to be hacked over the weekend, with an internet search for the site leading to a “Glory to Ukraine” sign in Ukrainian. In a statement, the foreign ministry said that Russia’s critical infrastructure and state institutions were being hit by cyberattacks and pointed to figures in the United States and Ukraine as being responsible. “Rest assured, Russia will not leave aggressive actions unanswered,” it said. “All our steps will be measured, targeted, in accordance with our legislation and international law.” The statement, issued by the ministry’s head of international information security, said Washington was “deliberately lowering the threshold for the combat use” of cyberweaopns. “...

By Ryan Browne, CNBC Digital tools used by the military to conduct cyberwarfare could eventually end up in the hands of cybercriminals, a top Interpol official has warned. Jurgen Stock, the international police agency’s secretary general, said he’s concerned state-developed cyberweapons will become available on the darknet — a hidden part of the internet that can’t be accessed through search engines like Google — in a “couple of years.” “That is a major concern in the physical world — weapons that are used on the battlefield and tomorrow will be used by organized crime groups,” Stock said during a CNBC-moderated panel at the World Economic Forum in Davos, Switzerland, Monday. “The same applies for the digital weapons that, maybe today are used by the military, developed by military, and tomorrow will be available for criminals,” he added. Cyberweapons come in many forms, with ransomware — where hackers lock down a company’s computer systems and demand a ransom payment to restore contro...

by Jenna McLaughlin, NPR Microsoft's global ubiquity gives its cybersecurity experts a unique window into the Russian cyberwar against Ukraine. The software giant is involved in both monitoring and combatting attacks.

Plus: The Conti ransomware gang shuts down, Canada bans Huawei and ZTE, and more of the week’s top security news. By Matt Burgess, Wired As Russia's full-scale war in Ukraine heads towards its hundredth day, opposition from Ukrainian forces is as strong as ever. At the same time, hacktivists all around the world continue to breach Russian institutions and publish their files and emails. This week one hacktivist collective took a different—and slightly peculiar—approach: launching a service to prank-call Russian government officials. The new website uses leaked details to put two random Russian officials on a call with each other. It obviously won't make any difference to the outcome of the war, but the group that created it hopes the tool will cause some confusion and annoy those in Moscow. New research from Google’s Threat Analysis Group has delved into the surveillance-for-hire industry and found that spyware vendors are targeting Android devices with zero-day exploits. State...

A pro-Russian hacker group that targeted the Eurovision song contest declared 'war' against Italy and ten other countries. By Vilius Petkauskas, Cybernews Killnet, a pro-Russian hacker group, was not happy the Italian police announced successfully blocking distributed denial-of-service (DDoS) attacks on the Eurovision song contest hosted by Italy. The Italian police announced that hackers had unsuccessfully tried to infiltrate the opening night and the finals of the song contest. Ukrainian folk-rap band Kalush Orchestra (pictured in the lead photo) performed on both nights of the attacks. Despite the attempted attacks, however, Ukraine went on to win the Eurovision song contest. In contrast, Russia was barred from the event, boasting a viewership of 200 million, due to Moscow's invasion of Ukraine on 24 February. The Italian authorities claim that over 100 officers monitored the event, thus preventing attempts to hinder the contest that most European nations took part in. ...

A group of human rights lawyers and investigators has called on the Hague to bring the first-ever “cyber war crimes” charges against Russia’s most dangerous hackers. By Andy Grenberg, Wired For weeks, evidence has been piling up of the Russian military's apparent war crimes in the midst of its brutal invasion of Ukraine: mass graves, bombed hospitals, even makeshift torture chambers. But amidst those atrocities—and the push to hold the perpetrators accountable—one group is making the counterintuitive case that another arm of the Russian military should be included in any international war crimes charges: the Kremlin's most disruptive and dangerous hackers. In late March, a group of human rights lawyers and investigators in the Human Rights Center at UC Berkeley's School of Law sent a formal request to the Office of the Prosecutor for the International Criminal Court (ICC) in the Hague. It urges the ICC to consider war crime prosecutions of Russian hackers for their cyberatt...

By Sean Lyngaas, CNN The US, European Union and the UK have blamed Russia for a hack that knocked out internet service for tens of thousands of satellite modems in Ukraine and elsewhere in Europe at the onset of Russia's invasion on February 24. "The United States is joining with allies and partners to condemn Russia's destructive cyber activities against Ukraine," US Secretary of State Antony Blinken said in a statement Tuesday. The cyberattack on a satellite network owned by US-based telecommunications firm Viasat is one of the most consequential cyber incidents of the war in Ukraine. It disrupted communications in Ukraine an hour before Russia's full-scale invasion, according to an EU statement, and the collateral damage included knocking thousands of wind turbines offline in Germany that relied on the satellite network. A top Ukrainian cyber official, Victor Zhora, on March 15 called the hack "a really huge loss in communications in the very beginning of ...

By Bill Toulas,       Bleeping Computer Docker images with a download count of over 150,000 have been used to run distributed denial-of-service (DDoS) attacks against a dozen Russian and Belarusian websites managed by government, military, and news organizations. Behind the incidents are believed to be pro-Ukrainian actors such as hacktivists, likely backed by the country's IT Army. DDoS cyberattacks aim to cripple operations of by sending out more requests than the target can handle and becomes unavailable to legitimate clients. Targeting Docker APIs Among the 24 domains targeted include that of the Russian government, the Russian military, and Russian media like the TASS news agency. Two Docker images involved in the attacks were spotted by threat researchers at cybersecurity company CrowdStrike, who observed them being deployed between February and March 2022. Targeting exposed Docker APIs isn’t anything novel, as cryptocurrency mining gangs like Lemon_Duck and Te...

By Colin Demarest, Defense News WASHINGTON — Vigilante hacking, the sort seen as Ukraine confronts another Russian invasion, is inadvisable and raises broader questions of ethics and consequences in the digital domain, according to the National Security Agency’s director of cybersecurity. “I will tell you that the idea of the civil vigilantes joining in a nation-state attack is unwise, right? I really think it is,” the NSA’s Rob Joyce said May 4 at a Vanderbilt University security summit . “As you pointed out, it’s illegal. But it’s also unhelpful, because one of the things we talked about is we’re trying to get Russia to take account for the ransomware attacks and hacks that come out of Russia and emanate.” Hundreds of thousands of volunteers from across the world have reportedly coalesced around Ukraine’s call for digital talent and cyber specialists, forming a so-called IT army outside typical government oversight. “There will be tasks for everyone,” Mykhailo Fedorov, minister of di...

Is offense the best defense? Or would threats of retaliation keep an enemy in check? By: Katrina Manson, Bloomberg A common explanation for why the Soviet Union never used nuclear weapons during the Cold War was the expectation that any attack would likely prompt a devastating nuclear response. The fear of mutually assured destruction was enough to keep both the USSR and the U.S. from launching a nuclear attack, even as they spent decades building up huge stockpiles of weapons. Cyberweapons are different. Cyberattacks by both governments and private hackers have exploded in recent years. Many of these are financially motivated, but others involve espionage or, in several high-profile cases, the sabotage of physical infrastructure. There’s broad agreement that at some point a cyberattack would be considered an act of war. Yet no one knows quite where the line is. Read on...