FireEye links Russia

A Russian lab very likely helped build tools used by an infamous hacking group known for its Trisis malware, FireEye says.

A Russian-owned research institute very likely helped build tools used by an infamous hacking group that caused a petrochemical plant in Saudi Arabia to shut down last year, cybersecurity company FireEye said Tuesday.

A series of clues implicates the Central Scientific Research Institute of Chemistry and Mechanics (CNIIHM), a Moscow-based lab, in developing tools used by the group known as Xenotime or TEMP.Veles, according to FireEye. The group is known for malware, dubbed Triton or Trisis, designed to disrupt industrial control system (ICS) software that allows industrial plants to safely shut down.

FireEye has tied the testing of malware used by TEMP.Veles to CNIIHM, specifically someone who has been identified as a professor at the institute. Further, an IP address registered to CNIIHM has been employed by Triton’s operators for multiple purposes, “including monitoring open-source coverage of Triton, network reconnaissance, and malicious activity in support of the Triton intrusion,” FireEye said in a blog post.

FireEye’s attribution of CNIIHM’s involvement with TEMP.Veles did not extend to the specific Triton attack framework: the company said it did not have evidence proving that CNIIHM developed that ICS-tailored toolset. However, the Russian lab likely does have “the institutional expertise needed to develop and prototype Triton,” the blog post states.

FireEye has not identified the target of last year’s incident, but reporting by CyberScoop and other news outlets has revealed it to be a petrochemical plant in Saudi Arabia. The Triton malware has turned heads in the ICS cybersecurity world because of its potential to cause physical harm. In May, CyberScoop reported that the hacking group behind Triton had expanded operations beyond the Middle East and was targeting U.S. companies.

CNIIHM could not be reached for comment.

FireEye was able to gather multiple attribution clues from the malware testing environment due to what appeared to be lax operational security precautions in that environment, according to John Hultquist, the company’s director of threat intelligence. TEMP.Veles went back and forth between the testing environment and the target until the group fine-tuned the malware, he said.

Hultquist said malicious hackers’ willingness to target ICS safety-related systems had raised the stakes in cyberspace. “We may yet see an incident that’s entirely accidental that appears to be a deliberate attack,” he told CyberScoop.

German newspaper Süddeutsche Zeitung was first to report on FireEye’s attribution.

FireEye’s linking of CNIIHM with TEMP.Veles comes at prolific time for Russian hackers.

Last week, cybersecurity company ESET published research showing that the broad set of hackers who disrupted the Ukrainian power grid in 2015 and 2016 had evolved while continuing to target Eastern European energy companies. Western governments have linked the group known as Sandworm, which was behind the 2015 Ukrainian grid attack, to Russia’s military intelligence directorate.

The Kremlin has denied being behind such cyberattacks on critical infrastructure.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure