Russian hackers have been mooching off existing OilRig infrastructure

Russian-linked hackers known as the Turla group have been piggybacking on Iranian hackers’ tools and infrastructure for years now to run their own attacks.

Russian-linked hackers known as the Turla group have been piggybacking on Iranian hackers’ tools and infrastructure for years now to run their own attacks, according to a joint announcement Monday from the National Security Agency and the U.K.’s National Cyber Security Centre.

A two-year long investigation revealed that the Turla group, which has been linked to Russian intelligence, scanned for the presence of Iranian-built backdoors, then used them to try gaining a foothold in victim networks in at least 35 countries, largely in the Middle East, according to the NSA. This announcement again demonstrates how hackers will use other attackers’ techniques, creating the false impression that one espionage group is behind an operation when, in fact, it’s another.

“Turla acquired access to Iranian tools and the ability to identify and exploit them to further their own aims,” the NCSC’s Director of Operations, Paul Chichester, said in a statement.

Turla would run its own cyber-espionage operations using that Iranian access, by deploying its own implants, such as a rootkit, to gather information on victims, namely government outfits, military and technology organizations, and energy and commercial entities.

In some cases, the implant in question appeared to have been deployed first from an IP address associated with the Iranian cyber-espionage group known as OilRig. The Turla group’s infrastructure would then access that.

It’s an indication that Turla has had access to the cryptographic keys in order to make connections with the implants, according to the NSA and the NCSC, an outfit of the U.K.’s Government Communications Headquarters, the U.K.’s signals intelligence agency.

But it doesn’t mean they’re working together

The NSA and NCSC assess it is almost certain that the Iranian cyber-espionage group has been unaware of the Russians’ hijacking of their implants, known as Neuron and Nautilus.

Meanwhile, Russians may not have initially known exactly where the OilRig implants were deployed, the NSA notes.

“Although they had a significant amount of insight into the Iranian tools, they did not have full knowledge of where they were deployed,” the advisory reads.

The joint investigation appears to confirm what the private sector has already revealed about Turla group. Symantec, for instance, reported in June that Turla apparent hijacked another group’s infrastructure to deliver malware on a victim’s network in the Middle East.

But this is a signal that government efforts to publicly identify hackers apparently will continue, even if they’re investigating apparent false flag operations.

“We want to send a clear message that even when cyber actors seek to mask their identity, our capabilities will ultimately identify them,” Chichester said.

It is also likely intended to send a signal to Russian intelligence that their efforts to hide their cyber-espionage weren’t successful, even though the NSA and NCSC didn’t directly link Turla to the Kremlin, tweeted Thomas Rid, a political scientist at Johns Hopkins’ School of Advanced International Studies.

“[C]atching Russian spies camouflaging as Iranian intel and using their gear is basically the digital equivalent of busting a crafty double agent in a third country, embarrassing two adversaries in one go,” Rid said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure