UK exposes Russian cyber campaign targeting support for Ukraine

The UK has uncovered what it says is a “malicious cyber marketing campaign” focusing on a number of organisations, together with these concerned in delivering international help to Ukraine

After a joint investigation with allies together with the US, Germany and France, the UK’s Nationwide Cyber Safety Centre (NCSC) stated a Russian army unit had been focusing on each private and non-private organisations since 2022.

These embrace organisations concerned in supplying defence, IT companies and logistics assist.

The safety our bodies of 10 Nato nations and Australia stated Russian spies had used a mixture of hacking strategies to achieve entry to networks.

A number of the targets have been internet-connected cameras at Ukrainian borders which monitored assist shipments going into the nation.

The report additionally says a tough estimate of 10,000 cameras have been accessed close to “army installations, and rail stations, to trace the motion of supplies into Ukraine.

It provides the “actors additionally used authentic municipal companies, reminiscent of site visitors cams.”

The Russian army unit blamed for the espionage is known as GRU Unit 26165 however goes by quite a lot of casual names, together with Fancy Bear.

The infamous hacking crew is understood to have previously leaked World Anti-Doping Company knowledge, and performed a key position in the 2016 cyber-attack on the US’s Democratic Nationwide Committee, in accordance with safety consultants.

“This malicious marketing campaign by Russia’s army intelligence service presents a critical danger to focused organisations, together with these concerned within the supply of help to Ukraine,” Paul Chichester, NCSC Director of Operations, stated in a press release.

“We strongly encourage organisations to familiarise themselves with the risk and mitigation recommendation included within the advisory to assist defend their networks,” he added.

The joint cyber-security advisory stated Fancy Bear had focused organisations linked to crucial infrastructure together with ports, airports, air site visitors administration and the defence business.

These have been in 12 mainland European nations and the US.

The hackers used a mixture of strategies to achieve entry, the report stated, together with guessing passwords.

One other technique used is known as spearphishing, the place faux emails are focused at particular individuals who have entry to techniques.

They’re introduced with a faux web page the place they enter their login particulars, or inspired to click on a hyperlink which then installs malicious software program.

“The themes of spearphishing emails have been various and ranged from skilled subjects to grownup themes,” the report stated.

A vulnerability in Microsoft Outlook was additionally exploited to gather credentials “by way of specifically crafted Outlook calendar appointment invites”.