Against backdrop of Russian-Ukraine war, researchers witness flurry of nation

Polish, Ukrainian and European targets are facing a barrage of cyber operations, researchers say.

Hackers believed to be associated with the governments of Russia, Belarus and China are targeting Ukraine, Poland and European governments, researchers say, ranging from espionage attempts to phishing campaigns and coinciding with the intensification of the Russian assault on Ukraine.

Shane Huntley, the director of Google’s Threat Analysis Group (TAG), said in a blog post Monday that the group has observed well-known Russian military hacking group Fancy Bear (also known as APT28) conducting several large credential phishing campaigns targeting UkrNet, a Ukrainian media company. Two recent campaigns, he said, involved newly created Blogspot domains as initial landing pages, which then redirected targets to credential phishing pages.

TAG also observed a hacking operation known as Ghostwriter, or UNC1151, running credential phishing campaigns over the past week against Polish and Ukrainian government and military organizations.

Ghostwriter refers to activity believed to be operating out of Belarus, researchers with cybersecurity firm Mandiant reported in November.

Separately, Ukraine’s Computer Emergency Response Team published details Monday about ongoing UNC1151 targeting of Ukrainian information sources with MicroBackdoor malware. That malware creates a backdoor, but also takes screenshots on target machines.

Google further said Monday that TAG identified malicious file attachments targeting European entities with lures related to the Ukrainian invasion, and attributed the activity to a China-based hacking group known variously as Mustang Panda or Temp.Hex. “Targeting of European organizations has represented a shift from Mustang Panda’s regularly observed Southeast Asian targets,” Huntley wrote.

Researchers with cybersecurity firm Proofpoint released their own detailed analysis of that Chinese activity on Monday, saying the group is targeting European diplomatic entities, including an individual involved in refugee and migrant services. While Google said the Mustang Panda hacking in Europe was a shift, Proofpoint’s analysis differed, suggesting a “multiyear campaign against diplomatic entities in Europe,” which “suggests a consistent area of responsibility.”

National Security Agency and Cyber Command chief Gen. Paul Nakasone, appearing Tuesday at a House Intelligence Committee hearing, said that overall he was surprised by the dearth of cyberattacks against Ukraine coming out of Moscow.

“In terms of Russia, they have conducted several attacks in the Ukraine, three or four primarily, which we’ve watched and and we’ve tracked very carefully,” he told the panel. “In terms of why they haven’t done more, I think that that’s obviously some of the work that the Ukrainians have done, some of the challenges that the Russians have encountered and some of the work that others have been able to prevent their actions.”

Suzanne Smalley contributed to this story.

Updated, 3/8/22: with comments from Nakasone.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure