Microsoft claims it recently took down seven domains that Russian cybercriminals were using in cyberattacks against Ukrainian target.
The Ukrainian targets were being hit by APT28 (also known as Strontium), a Russian state-sponsored hacking group with links to the military intelligence service organization, GRU.
Among the targets were endpoints belonging to Ukrainian institutions and media organizations, Microsoft revealed in its report.
TechRadar needs you!
We’re looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn’t take more than 60 seconds of your time, and entrants from the UK and US will have the chance to enter a draw for a £100 Amazon gift card (or equivalent in USD). Thank you for taking part.
>> Click here to start the survey in a new window
Tactical support for the invasion
“On Wednesday, April 6th, we obtained a court order authorizing us to take control of seven internet domains Strontium was using to conduct these attacks,” said Tom Burt, Corporate Vice President of Customer Security & Trust at Microsoft.
“We have since re-directed these domains to a sinkhole controlled by Microsoft, enabling us to mitigate Strontium’s current use of these domains and enable victim notifications.
“We believe Strontium was attempting to establish long-term access to the systems of its targets, provide tactical support for the physical invasion and exfiltrate sensitive information.”
The domains have also been used in attacks against government institutions in the west, namely the EU and the US.
“This disruption is part of an ongoing long-term investment, started in 2016, to take legal and technical action to seize infrastructure being used by Strontium. We have established a legal process that enables us to obtain rapid court decisions for this work,” Burt also said.
> Fancy Bear hackers return to target sporting organizations
> Microsoft flags major cyberattacks on Covid-19 vaccine makers
> US, UK agencies say Russia is abusing Kubernetes to launch massive cyberattacks
APT28 is one of the most famous Russian state-sponsored cybercrime groups. It’s also known as Fancy Bear, and is most likely operational since the mid-2000s. It usually goes after government agencies, military and security organizations, in western countries.
So far, it’s been linked to cyberattacks against the German and Norwegian parliaments, the French TV station TV5Monde, the White House, NATO, the Democratic National Committee, the Organization for Security and Co-operation in Europe and the campaign of the French presidential candidate Emmanuel Macron.
It was also said the group tried to influence the 2016 US presidential elections.
- If you’re looking to defend your premises against hackers, you’ll need a strong firewall solution