Microsoft warns of Russian- sponsored cyberattacks that will continue to target Ukrainian facilities and NATO allies in Europe throughout the winter. See also: Zero-day vulnerabilities and the urgent need to address them
In a report published over the weekend, Microsoft said it had observed a pattern of targeted attacks on Ukrainian facilities. The attacks appear to be carried out by the Russian GRU 's Sandworm cyber-military hacking group .
The attacks are part of a targeted propaganda campaign to undermine Western support (from the US , EU and NATO ) for Ukraine. Their aim is to sow discord between states, with the ultimate goal of cutting off aid and weapons to Ukraine. Microsoft says Europe should be prepared for “several ‘ lines ’ of potential Russian cyberattacks throughout the winter”. This means that the attacks are expected to continue and could extend beyond Ukraine’s borders, targeting countries and companies providing aid to Ukraine. Russia will look to exploit vulnerabilities in Ukraine’s support line, as well as undermine the alliances that are essential to their country. See also: Serious AMI MegaRAC vulnerabilities affect servers of many companies
The Russian elite
The Russian hacking group Sandworm, also known as Unit 74455 , is a group of elite hackers that has been active for at least two decades and is responsible for Russian military intelligence.
The group has also been linked to attacks on the Ukrainian power grid, as well as other ransomware attacks that have gone down in history – the KillDisk wiper attacks targeting Ukrainian banks and the NotPetya ransomware.
This report comes after Microsoft warned in June that Russian intelligence agencies (including the GRU, SVR, and FSB) have stepped up cyberattacks against governments of countries aiding Ukraine following the Russian invasion, attempting to compromise entities in dozens of countries worldwide.
The main focus of the attacks is to obtain sensitive information from governments of states that play a significant role in NATO and the Western powers' response to the war with Russia. Microsoft also said that the Sandworm group was behind the Prestige ransomware attacks that targeted transport and logistics companies in Ukraine and Poland in October.
In late March, TAG ( Google Threat Analysis Group) identified phishing attacks on NATO and European military forces coordinated by the Russian-based COLDRIVER group. In the same month, a more detailed report, related to the Russia-Ukraine war, exposed efforts by Russian, Chinese, and Belarusian state hackers to compromise organizations and officials in Ukraine and Europe. Source: bleepingcomputer.com
