Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/27/2016
05:15 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Google Accounts Of US Military, Journalists Targeted By Russian Attack Group

The Threat Group 4127 that hit the Democratic National Committee also went after 1,800 other targets with info interesting to Russian government, says SecureWorks.

A Russian attack group used the Bitly URL-shortener to disguise malicious links in order to carry out spearphishing campaigns not only against the Democratic National Committee, but also against some 1,800 Google accounts of US military and government personnel and others.

Researchers at SecureWorks Counter Threat Unit today said the spearphishing campaign, carried out in mid-2015 by Threat Group 4127 (TG-4127), mostly targeted people inside Russia and former Soviet states, but it also targeted individuals who were publicly critical of the Russian Federation or who had information valuable to the Russian Federation. 

SecureWorks tracks them as Threat Group 4127 (TG-4127), but "components of their operations have been reported under the names APT28, Sofacy, Sednit, Fancy Bear, and Pawn Storm" by other security companies. SecureWorks assesses with "moderate confidence" that TG-4127 operates from the Russian Federation and gathers intelligence on behalf of the Russian government.

The group registered the domain "accoounts-google.com" to host a spoofed Google login page, and used the Bitly URL-shortener to cloak that location within the spearphishing messages. In all, some 1,881 Google account users were phished. Some were only sent one message, while others were sent several; the attackers used a total of 4,396 phishing URLs.

Betweeen March 2015 and September 2015, 59% of the malicious URLs were accessed, "suggesting that the recipients at least opened the phishing page," and were possibly compromised. 

SecureWorks believes that TG-4127's information-gathering efforts primarily focus on individuals and organizations inside Russia and former Soviet states However, certain groups in the US and Western Europe are also targeted.

The researchers break TG-4127's Western targets into two main groups: those who are publicly critical of Russia, including journalists, activists, NGOs, and authors; and those who have information that is useful to the Russian government, like current and former US military personnel, government personnel, and people in the defense supply chain.  

The group also targeted a considerable number of authors who write about being military spouses or family members -- 22% of the targeted authors and journalists fell into that category, compared to 53% who were experts on either Russia or Ukraine. SecureWorks theorized that the attackers might be looking for information on "broader military issues in the US or gain operational insight into the military activity of the target's spouse."

Of the current and former military and government personnel targeted (excluding the "military spouses"), 64% were American personnel, according to SecureWorks' report.

The cybersecurity industry was also in the bullseye. Other targets included a security consultant for NATO and the director of federal sales for the security arm of a multinational technology company. It is not clear how many organizations were actually compromised through this campaign. 

Related Content:

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-23534
PUBLISHED: 2021-02-25
A server-side request forgery (SSRF) vulnerability in Upgrade.php of gopeak masterlab 2.1.5, via the 'source' parameter.
CVE-2021-27330
PUBLISHED: 2021-02-25
Triconsole Datepicker Calendar <3.77 is affected by cross-site scripting (XSS) in calendar_form.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents.
CVE-2021-3124
PUBLISHED: 2021-02-25
Stored cross-site scripting (XSS) in form field in robust.systems product Custom Global Variables v 1.0.5 allows a remote attacker to inject arbitrary code via the vars[0][name] field.
CVE-2021-21064
PUBLISHED: 2021-02-25
Magento UPWARD-php version 1.1.4 (and earlier) is affected by a Path traversal vulnerability in Magento UPWARD Connector version 1.1.2 (and earlier) due to the upload feature. An attacker could potentially exploit this vulnerability to upload a malicious YAML file that can contain instructions which...
CVE-2021-21065
PUBLISHED: 2021-02-25
Adobe Bridge version 11.0 (and earlier) is affected by an out-of-bounds write vulnerability when parsing TTF files that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.