Russian APT Map: Although Russia still has an undiversified and stagnant economy, it was one of the first countries in the world to realize the value of remote hacking attacks
In recent years, several Russian hacking groups have emerged as some of the most sophisticated threats in cyberspace, using specialized hacking techniques and toolkits for government espionage.
Over the past three decades, several high-profile hacking incidents – such as the US presidential election hack, the NotPetya ransomware, the Kiev blackout and the Pentagon – have been attributed to Russian hacking groups, including Fancy Bear, Turla, Cozy Bear, Sandworm Team and Berserk Bear.
In addition to the constant expansion of its cyber capabilities, Russian APT groups have evolved into a very complex structure, making it more difficult to understand who is who in Russian government espionage.
Therefore, to illustrate the big picture and make it easier for everyone to understand Russian hackers and their operations, researchers at Intezer and Check Point Research are collaborating to release an interactive map of the internet that gives a complete picture of this ecosystem.
It's called the "Russian APT Map" and can be used by anyone to learn information about the connections between various APT malware samples, malware families, and hackers – all with a click on the map's nodes.
Essentially, the Russian APT Map is the result of a thorough investigation where researchers collected, categorized, and analyzed more than 2,000 malware attributed to Russian hacking groups and mapped nearly 22,000
The Russian APT Map also reveals that although most hacking groups reuse their own code in their own different tools and frameworks, no different groups were found using each other's code.
In this way, they overcome the risk of a failed hacking operation exposing other active campaigns, preventing the collapse of a well-structured “house of cards.”
In order to make it more efficient and up-to-date in the future, researchers also have open access to the map and data.
Apart from that, the researchers have also released a Yara rules-based scanning tool called “Russian APT Detector” which can be used by anyone to scan a specific file, folder, or an entire file system and look for attacks and infections by Russian hackers.
