Thread by @desderamona

‘Tricks With a Notorious Russian Spy Group’

‘Security researchers have found links between the attackers and #Turla, a sophisticated team suspected of operating out of Moscow’s #FSB intelligence agency.’

#VenomousBear
#Snake
#malware
#UNC2452
#DarkHalo
wired.com/story/solarwin…

“…believe the SolarWinds #hackers and #Turla aren't one and the same. But … one #hacker group at the very least ‘inspired’ the other, and they may have common members between them or a shared #software developer building their #malware.”

wired.com/story/solarwin…

https://twitter.com/desderamona/status/1048239858739806210

“… That actually makes the connection more significant … ‘It’s more like handwriting. That handwriting or style propagates to different projects written by the same person.'"

#Turla
wired.com/story/solarwin…

https://twitter.com/desderamona/status/1048241318009421824

“…Barring the improbable scenario that the SolarWinds hackers saw an earlier version of the #Kazuar malware that no one else in the cybersecurity industry spotted, that suggests #Turla & SolarWinds hackers are instead using tools that are part of the same chain of development.”

https://twitter.com/desderamona/status/1107521823774785536

“#Turla (aka #VenomousBear and #Waterbug) has been coordinating information theft and espionage campaigns as far back as 1996 & is the main suspect behind attacks targeting the Pentagon and NASA, the U.S. Central Command, & the Finnish Foreign Ministry.”

bleepingcomputer.com/news/security/…

“The #Russian (specifically APT28, APT29, and #Turla) and North Korean (specifically Lazarus) threat actors are considered to be the most advanced groups of all due to their capability of using custom toolsets, adopting the latest attack techniques, & …”

portswigger.net/daily-swig/bey…

“#Turla is ‘still actively developing complex and custom pieces of #malware in order to achieve long-term #persistence in their target’s network’…

Rather than one continued operation, the #espionage has come in waves.”

cyberscoop.com/turla-espionag…

#Turla “is reported to be part of Russia’s #FSB (formerly KGB) and has carried out a series of operations targeting government and military agencies in at least 35 countries since 2008”

aka
#Belugasturgeon
#Ouroboros
#Snake
#VenomousBear
#Waterbug
bankinfosecurity.com/russian-hackin…

“…It is also not the first time the group has used legitimate tools and services as part of its malicious infrastructure.

In December 2020, security firm ESET uncovered a #cyberespionage campaign by #Turla that deployed a #backdoor called "#Crutch" that used Dropbox resources”

https://twitter.com/desderamona/status/957595174313578496

“The malware was serious business, Cyber Command officials said…& likely already had been used to target embassies, foreign affairs ministries & other targets in eastern Europe and central Asia. It was believed to be used to steal sensitive documents…”

military.com/daily-news/202…

“…from infected systems and execute its own programs…

U.S. intelligence agencies have repeatedly identified Russia and Russian-aligned agents as the source of hacking operations around the world, and the [U.S.] has levied or threatened sanctions to try to deter such attacks.”

https://twitter.com/esetresearch/status/1265213982035578880

"'The #APT customers, #Turla, APT28, and Buhtrap, are all commonly linked to Russia and it is interesting to find that even these advanced groups purchase exploits from exploit authors, instead of developing them in-house,’ the researchers say.”

zdnet.com/article/resear…

“The #cyber-intrusions are especially directed at those that focus on international affairs or national security policy … perhaps unsurprisingly, given the geopolitical nature of #APTs, which tend to be backed by nation-states.”

exfiltrate data
#Turla
threatpost.com/think-tanks-at…

“… #Turla, another Russian #APT, was attacking think-tanks & others by exploiting enterprise-friendly platforms — most notably Microsoft Exchange, Outlook Web Access and Outlook on the Web – in order to steal business credentials & other sensitive data.”

threatpost.com/think-tanks-at…

https://twitter.com/desderamona/status/982631593503346689

SolarWinds “is a perfect example of a state or state-sponsored actor turning their resources to cyberattack. Unlike typical cybercriminals, threats at this level have almost unlimited resources and target virtually anything that may forward their agenda.”

threatpost.com/feds-russia-cu…

“#Turla has also been known to use satellite-based Internet connections to cover its tracks. … researchers observed Turla using what was then a zero-day vulnerability in Window to infiltrate European government and military computers.”

arstechnica.com/information-te…