Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/27/2016
05:15 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Google Accounts Of US Military, Journalists Targeted By Russian Attack Group

The Threat Group 4127 that hit the Democratic National Committee also went after 1,800 other targets with info interesting to Russian government, says SecureWorks.

A Russian attack group used the Bitly URL-shortener to disguise malicious links in order to carry out spearphishing campaigns not only against the Democratic National Committee, but also against some 1,800 Google accounts of US military and government personnel and others.

Researchers at SecureWorks Counter Threat Unit today said the spearphishing campaign, carried out in mid-2015 by Threat Group 4127 (TG-4127), mostly targeted people inside Russia and former Soviet states, but it also targeted individuals who were publicly critical of the Russian Federation or who had information valuable to the Russian Federation. 

SecureWorks tracks them as Threat Group 4127 (TG-4127), but "components of their operations have been reported under the names APT28, Sofacy, Sednit, Fancy Bear, and Pawn Storm" by other security companies. SecureWorks assesses with "moderate confidence" that TG-4127 operates from the Russian Federation and gathers intelligence on behalf of the Russian government.

The group registered the domain "accoounts-google.com" to host a spoofed Google login page, and used the Bitly URL-shortener to cloak that location within the spearphishing messages. In all, some 1,881 Google account users were phished. Some were only sent one message, while others were sent several; the attackers used a total of 4,396 phishing URLs.

Betweeen March 2015 and September 2015, 59% of the malicious URLs were accessed, "suggesting that the recipients at least opened the phishing page," and were possibly compromised. 

SecureWorks believes that TG-4127's information-gathering efforts primarily focus on individuals and organizations inside Russia and former Soviet states However, certain groups in the US and Western Europe are also targeted.

The researchers break TG-4127's Western targets into two main groups: those who are publicly critical of Russia, including journalists, activists, NGOs, and authors; and those who have information that is useful to the Russian government, like current and former US military personnel, government personnel, and people in the defense supply chain.  

The group also targeted a considerable number of authors who write about being military spouses or family members -- 22% of the targeted authors and journalists fell into that category, compared to 53% who were experts on either Russia or Ukraine. SecureWorks theorized that the attackers might be looking for information on "broader military issues in the US or gain operational insight into the military activity of the target's spouse."

Of the current and former military and government personnel targeted (excluding the "military spouses"), 64% were American personnel, according to SecureWorks' report.

The cybersecurity industry was also in the bullseye. Other targets included a security consultant for NATO and the director of federal sales for the security arm of a multinational technology company. It is not clear how many organizations were actually compromised through this campaign. 

Related Content:

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Exactly
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7734
PUBLISHED: 2020-09-22
All versions of package cabot are vulnerable to Cross-site Scripting (XSS) via the Endpoint column.
CVE-2020-6564
PUBLISHED: 2020-09-21
Inappropriate implementation in permissions in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of a permission dialog via a crafted HTML page.
CVE-2020-6565
PUBLISHED: 2020-09-21
Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVE-2020-6566
PUBLISHED: 2020-09-21
Insufficient policy enforcement in media in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2020-6567
PUBLISHED: 2020-09-21
Insufficient validation of untrusted input in command line handling in Google Chrome on Windows prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.