UnknownPublished 6 Sep 2024

tlp white · AA24-249A: Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure

Affects tlp whiteSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

AA24-249A: Russian Military Cyber Actors Target U.S.and Global Critical Infrastructure

Impact

For European organizations, particularly those operating critical infrastructure such as energy grids, transportation networks, telecommunications, and water treatment facilities, this threat poses a significant risk. Successful intrusions could lead to operational disruptions, data breaches, loss of service availability, and potential physical damage to infrastructure components. The geopolitical context of Russian cyber operations increases the likelihood of targeted attacks against European countries aligned with U.S. and NATO interests. Disruption or espionage in critical infrastructure could have cascading effects on national security, economic stability, and public safety. Additionally, the complexity and persistence of these actors mean that detection and remediation may be challenging, increasing the potential duration and impact of an incident. Even though the current severity is rated low, the strategic targeting and potential for escalation mean European organizations should treat this threat seriously and prioritize defensive measures.

Defensive guidance

European organizations should implement a multi-layered defense strategy tailored to critical infrastructure environments. Specific recommendations include: 1) Conducting comprehensive threat hunting and network monitoring focused on detecting tactics, techniques, and procedures (TTPs) associated with Russian military cyber actors, leveraging threat intelligence feeds and STIX indicators where available. 2) Enhancing segmentation between IT and OT networks to limit lateral movement opportunities. 3) Applying strict access controls and multi-factor authentication (MFA) for all remote and privileged access, especially for critical systems. 4) Implementing anomaly detection systems capable of identifying unusual network traffic or command and control communications. 5) Regularly updating and patching all systems where possible, and employing virtual patching or compensating controls when patches are unavailable. 6) Conducting regular incident response exercises simulating nation-state attacks to improve readiness. 7) Collaborating with national cybersecurity agencies and sharing intelligence within sector-specific Information Sharing and Analysis Centers (ISACs). 8) Reviewing and hardening supply chain security to prevent compromise via third-party vendors. These measures go beyond generic advice by focusing on the specific threat actor’s known behaviors and the critical infrastructure context.

Indicators of compromise

Domains 5

interlinks.top
3237.site
smm2021.net
nssm.cc
3proxy.ru

URLs 6

https://cdn.discordapp.com/attachments/945968593030496269/945970446149509130/Client.exe
https://cdn.discordapp.com/attachments/888408190625128461/895633952247799858/n.lashevychdirekcy.atom.gov.ua.zip
dns.test658324901domain.me
https://nssm.cc
https://3proxy.ru
https://cdn.discordapp.com/attachments/928503440139771947/930108637681184768/Tbopbh.jpg

IP addresses 25

81.17.24.130
194.26.29.251
194.26.29.84
185.245.85.251
185.245.84.227
179.43.189.218
179.43.187.47
179.43.175.108
179.43.175.38
179.43.162.55

Hashes 231

59da31da4db1aa5f9a5c7c0c151422c8
ddec2d79f460a881849037336ba8968f
64b9feeccf6c183b9f7138f8fc53acbb
993f01861aff306df44e6475f7886f37
143594597130e301499e5940a5fb798a
6a4fca88ee36fecc5113e188cc39d25c
56e0446a6d7175a0d09110bc483ddbed
2128361d8aaae1225d50c9add32006a1
b32e14a9b7de6c92cd16758fa6e23346
7fe7f33d9b5dbdf3d032d2a10e39f283

File 11

Ofewufeiy.dll
de1f9d1f0336ddcff832ad3900acd2f1
de1f9d1f0336ddcff832ad3900acd2f1_reversed_974e7c0b3660fbf18f29eac059f85ac0
Frkmlkdkdubkznbkmcf.dll
Tbopbh.jpg
stage2.exe
Tbopbh.exe
stage2.exe; Tbopbh.exe
stage1.exe
AA24-249A-Russian-Military-Cyber-Actors-Target-US-and-Global-Critical-Infrastructure.stix_.json

Size in bytes 4

438272
1772032
280064
280064

Text 6

2.1
Russian Military Cyber Actors Target US and Global Critical Infrastructure
Alert
The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and National Security Agency (NSA) assess that cyber actors affiliated with the Russian General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155) are responsible for computer network operations against global targets for the purposes of espionage, sabotage, and reputational harm since at least 2020. GRU Unit 29155 cyber actors began deploying the destructive WhisperGate malware against multiple Ukrainian victim organizations as early as January 13, 2022. These cyber actors are separate from other known and more established GRU-affiliated cyber groups, such as Unit 26165 and Unit 74455.
Russian Military Cyber Actors Target US and Global Critical Infrastructure
Alert

Link 2

https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf
https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a

Community reviews

Loading reviews…