Before SolarWinds, US officials say SVR began stealthily targeting cloud services in 2018

U.S. officials have now released multiple public advisories on alleged SVR hacking tools.

U.S. national security agencies on Monday continued their concerted efforts to expose hacking techniques used by the Russian intelligence agency allegedly responsible for a historic cyber-espionage campaign aimed at the U.S. government.

The latest public statement from the FBI and the Department of Homeland Security traces the evolution of Russia’s SVR foreign intelligence agency as a formidable cyber adversary capable of exploiting U.S. networks through a range of tools. A turning point, the advisory said, came in 2018 when the FBI saw the SVR begin to target email-based cloud computing resources in a likely effort to conceal the spies’ intelligence collection.

The SVR allegedly employed that tactic in the hacking effort that exploited software made by SolarWinds and other vendors to breach nine U.S. government agencies. The bugging of trusted SolarWinds software updates was “a notable departure from the SVR’s historic tradecraft,” the FBI and DHS’s Cybersecurity and Infrastructure Security Agency said.

The advisory follows the Biden administration’s move to blame the SVR on April 15 for the so-called SolarWinds campaign, which White House officials argued exceeded traditional espionage because of the cost it imposed on private firms cleaning up the breaches. U.S. security agencies have also published a series of other advisories on alleged SVR hacking in an effort to mitigate the exposure of U.S. private and public networks.

Along with Russia’s treatment of opposition figure Alexei Navalny, the hacking activity has been a major source of tension in U.S.-Russia relations in the first months of the Biden administration. The Biden administration also imposed sanctions on Russian tech companies for allegedly supporting Russian cyber-espionage operations, and expelled 10 Russian diplomats.

Moscow, which has denied involvement in the SolarWinds activity, retaliated by expelling 10 American diplomats and banning senior Biden administration officials from visiting Russia.

U.S. officials say the SVR is one of three main Russian intelligence agencies, along with the GRU and FSB, whose hacking groups continually target U.S. and allied computer networks. The SVR-linked APT29 was allegedly one of two Russian spying outfits that breached the Democratic National Committee in 2016 in an effort to upend the U.S. election.

But unlike the GRU, whose hacking groups have a reputation for brazen, high-profile operations like cutting power in Ukraine in 2015 and 2016, SVR operatives are known for their subtlety. The U.S. advisory published Monday sheds some light on those tactics.

The FBI and DHS, for example, accused the SVR of using fake identities and cryptocurrency to buy computing infrastructure to conduct its hacking. The SVR hackers have also used a common tactic known as password spraying to guess weak passwords, according to U.S. officials, but have done so with a lighter touch than other hacking groups, which bombard networks with guesses.

“The actors conducted the password spraying activity in a ‘low and slow’ manner, attempting a small number of passwords at infrequent intervals, possibly to avoid detection,” the FBI-DHS advisory reads.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Election official says Tina Peters would be consultant, won’t have access to election systems