The U.S. and U.K. released details on Friday about how Russia’s foreign intelligence service operates in cyberspace, the latest effort to try to disrupt future attacks.
The report contains technical resources about the group’s tactics, including breaching email in order to find passwords and other information to further infiltrate organizations, in addition to providing software flaws commonly exploited by the hackers. It also offers details about how network administrators can counter the attackers’ tactics.
“The group uses a variety of tools and techniques to predominantly target overseas governmental, diplomatic, think-tank, health-care and energy targets globally for intelligence gain,” the two countries wrote in a Friday report authored jointly by the U.K.’s National Cyber Security Centre and three U.S. agencies, the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency and the National Security Agency.
The Russian Embassy in Washington didn’t immediately respond to a request for comment about the report.
The report comes a month after President Joe Biden imposed sanctions on Russia following a supply-chain attack that compromised popular software by the Texas-based firm SolarWinds Corp. in order to break into nine government agencies and at least 100 private-sector companies. Biden attributed the attack to the SVR, Russia’s civilian foreign intelligence service. SVR’s hacking group is known by different names, including APT29, Cozy Bear and The Dukes.
“The SVR is a technologically sophisticated and highly capable cyber actor. It has developed capabilities to target organizations globally, including in the U.K., U.S., Europe, NATO member states and Russia’s neighbors,” according to the report.
Last year, the two countries accused the same hacking group of targeting organizations involved in developing a vaccine for COVID-19. Cybersecurity analysts have also tied the group to attacks against governments and organizations across the globe, including an infamous attack on the Democratic National Committee’s servers ahead of the U.S. 2016 election.
The report revealed that the group also utilized a vulnerability in Microsoft Corp.’s Exchange software for email, a flaw which was previously exploited by suspected Chinese hackers to target thousands of organizations earlier this year.
___
©2021 Bloomberg L.P.
Distributed by Tribune Content Agency, LLC
