Microsoft Corp. has warned that a notorious hacking group linked to Russia's GRU military intelligence agency could be preparing more ransomware attacks in and outside Ukraine.
Microsoft calls them Iridium, but they are better known as Sandworm. They have been blamed for attacking Ukraine’s power system and government services, the 2018 Winter Olympics, and businesses around the world. Now they appear to be preparing for a new destructive campaign, the software company said in a statement Thursday.
See also: Ukraine: Russian hackers Sandworm attacked Ukrinform
Russian hackers have been accused of bombarding Ukrainian institutions with malware and DDoS attacks, a campaign that began before Vladimir Putin's government ordered an invasion of Ukraine. However, Ukrainian defenses have avoided a major cyberwar with the help of foreign technology companies including Microsoft.
The ransomware attack on Polish and Ukrainian transport services in October, attributed to Sandworm, may be a test for additional attacks, the report says. Microsoft warned that it was a possible precursor to Russian hacks beyond Ukrainian territory.
Proposal: Sandworm hacking group failed to bring down Ukrainian energy provider
The attack "tested the international community's ability to hold Moscow accountable for espionage operations" or the response of Ukrainian allies to a targeted, destructive attack outside Ukraine using ransomware on Polish transportation systems, according to Microsoft.
In a February report on cyber threats in Ukraine, Alphabet Inc said Sandworm’s campaigns appeared to be designed to advance Russian strategic goals and respond to changing demands from Russian agencies throughout the conflict. The group, which has been active since 2009, targeted a Turkish drone manufacturer whose systems were used by Ukraine in the early weeks of the war, targeting sensitive information such as Ukrainian military communications and troop movements, according to Google.
Read also: Suspected Russian group “Sandworm” targeted NATO in Ukraine
source of information: bloomberg.com
