kremlin

us-charges-russian-military-officers-for-unleashing-wiper-malware-on-ukraine

US charges Russian military officers for unleashing wiper malware on Ukraine

Biz & IT, GRU, indictments, Justice Department, kremlin, Security / /

INDICTED —

WhisperGate campaign targeted Ukrainian critical infrastructure and allies worldwide.

–

US charges Russian military officers for unleashing wiper malware on Ukraine

Getty Images

Federal prosecutors on Thursday unsealed an indictment charging six Russian nationals with conspiracy to hack into the computer networks of the Ukrainian government and its allies and steal or destroy sensitive data on behalf of the Kremlin.

The indictment, filed in US District Court for the District of Maryland, said that five of the men were officers in Unit 29155 of the Russian Main Intelligence Directorate (GRU), a military intelligence agency of the General Staff of the Armed Forces. Along with a sixth defendant, prosecutors alleged, they engaged in a conspiracy to hack, exfiltrate data, leak information, and destroy computer systems associated with the Ukrainian government in advance of the Russian invasion of Ukraine in February 2022.

Targeting critical infrastructure with WhisperGate

The indictment, which supersedes one filed earlier, comes 32 months after Microsoft documented its discovery of a destructive piece of malware, dubbed WhisperGate, had infected dozens of Ukrainian government, nonprofit, and IT organizations. WhisperGate masqueraded as ransomware, but in actuality was malware that permanently destroyed computers and the data stored on them by wiping the master boot record—a part of the hard drive needed to start the operating system during bootup.

In April 2022, three months after publishing the report, Microsoft published a new one that said WhisperGate was part of a much broader campaign that aimed to coordinate destructive cyberattacks against critical infrastructure and other targets in Ukraine with kinetic military operations waged by Russian forces. Thursday’s indictment incorporated much of the factual findings reported by Microsoft.

“The GRU’s WhisperGate campaign, including targeting Ukrainian critical infrastructure and government systems of no military value, is emblematic of Russia’s abhorrent disregard for innocent civilians as it wages its unjust invasion,” Assistant Attorney General Matthew G. Olsen of the National Security Division said in a statement. “Today’s indictment underscores that the Justice Department will use every available tool to disrupt this kind of malicious cyber activity and hold perpetrators accountable for indiscriminate and destructive targeting of the United States and our allies.”

Later in the campaign, the Russian operatives targeted computer systems in countries around the world that were providing support to Ukraine, including the United States and 25 other NATO countries.

The six defendants are:

  • Yuriy Denisov, a colonel in the Russian military and commanding officer of Cyber Operations for Unit 29155
  • Vladislav Borokov, a lieutenant in Unit 29155 who works in cyber operations
  • Denis Denisenko, a lieutenant in Unit 29155 who works in cyber operations
  • Dmitriy Goloshubov, a lieutenant in Unit 29155 who works in cyber operations
  • Nikolay Korchagin, a lieutenant in Unit 29155 who works in cyber operations
  • Amin Stigal, an alleged civilian co-conspirator, who was indicted in June for his role in WhisperGate activities

Federal prosecutors said the conspiracy started no later than December 2020 and remained ongoing. The defendants and additional unindicted co-conspirators, the indictment alleged, scanned computers of potential targets around the world, including in the US, in search of vulnerabilities and exploited them to gain unauthorized access to many of the systems. The defendants allegedly would then infect the networks with wiper malware and, in some cases, exfiltrate the stored data.

Thursday’s charges came a day after Justice Department officials announced the indictments of two Russian media executives accused of funneling millions of dollars from the Kremlin to a company responsible for creating and publishing propaganda videos in the US that racked up millions of views on social media. Federal prosecutors said the objective was to covertly influence public opinion and deepen social divisions, including over Russia’s war in Ukraine.

Also on Wednesday, federal officials took other legal actions to counter what they said were other Russian psychological operations. The actions included seizing 32 Internet domains they said were being used to spread anti-Ukraine propaganda, sanctioning Russian individuals and entities accused of spreading Russian propaganda and indicting two individuals accused of conspiring to aid a Russian broadcaster violating US sanctions.

Unit 29155 is a covert part of the GRU that carries out coup attempts, sabotage, and assassinations outside Russia. According to WIRED, Unit 29155 recently acquired its own active team of cyberwarfare operators in a move that signals the fusing of physical and digital tactics by Russia more tightly than in the past. WIRED said that the unit is distinct from others within the GRU that employ more recognized Russian-state hacking groups such as Fancy Bear or APT28, and Sandworm.

The Justice Department announced a $10 million reward in exchange for any of the suspects’ locations or cyber activity. The wanted poster and Thursday’s indictment displayed photos of all six defendants. The move is intended to limit the travel options for the men and discourage other Russians from following their example.

US charges Russian military officers for unleashing wiper malware on Ukraine Read More »

google-abruptly-shuts-down-adsense-in-russia-as-tensions-with-kremlin-escalate

Google abruptly shuts down AdSense in Russia as tensions with Kremlin escalate

ad manager, ad monetization, AdSense, censorship, content monetization, Google, kremlin, online advertising, Policy, russia, Russian invasion of Ukraine, youtube / /

“Kind of strange” —

Russia-based YouTubers, in particular, will likely lose significant revenues.

–

Google abruptly shuts down AdSense in Russia as tensions with Kremlin escalate

Google announced Monday that it’s shutting down all AdSense accounts in Russia due to “ongoing developments in Russia.”

This effectively ends Russian content creators’ ability to monetize their posts, including YouTube videos. The change impacts accounts monetizing content through AdSense, AdMob, and Ad Manager, the support page said.

While Google has declined requests to provide details on what prompted the change, it’s the latest escalation of Google’s ongoing battle with Russian officials working to control the narrative on Russia’s war with Ukraine.

In February 2022, Google paused monetization of all state-funded media in Russia, then temporarily paused all ads in the country the very next month. That March, Google paused the creation of new Russia-based AdSense accounts and blocked ads globally that originated from Russia. In March 2022, Google also paused monetization of any content exploiting, condoning, or dismissing Russia’s war with Ukraine. Seemingly as retaliation, Russia seized Google’s bank account, causing Google Russia to shut down in May 2022.

Since then, Google has “blocked more than 1,000 YouTube channels, including state-sponsored news, and over 5.5 million videos,” Reuters reported.

For Russian creators who have still found ways to monetize their content amid the chaos, Google’s decision to abruptly shut down AdSense accounts comes as “a serious blow to their income,” Bleeping Computer reported. Russia is second only to the US in terms of YouTube web traffic, Similarweb data shows, making it likely that Russia-based YouTubers earned “significant” revenues that will now be suddenly lost, Bleeping Computer reported.

Russia-based creators—including YouTubers, as well as bloggers and website owners—will receive their final payout this month, according to a message from Google to users reviewed by Reuters.

“Assuming you have no active payment holds and meet the minimum payment thresholds,” payments will be disbursed between August 21 and 26, Google’s message said.

Google’s spokesperson offered little clarification to Reuters and Bleeping Computer, saying only that “we will no longer be able to make payments to Russia-based AdSense accounts that have been able to continue monetizing traffic outside of Russia. As a result, we will be deactivating these accounts effective August 2024.”

It seems likely, though, that Russia passing a law in March—banning advertising on websites, blogs, social networks, or any other online sources published by a “foreign agent,” as Reuters reported in February—perhaps influenced Google’s update. The law also prohibited foreign agents from placing ads on sites, and under the law, foreign agents could include anti-Kremlin politicians, activists, and media. With new authority, Russia may have further retaliated against Google, potentially forcing Google to give up the last bit of monetization available to Russia-based creators increasingly censored online.

State assembly member and Putin ally Vyacheslav Volodin said that the law was needed to stop financing “scoundrels” allegedly “killing our soldiers, officers, and civilians,” Reuters reported.

One Russian YouTuber with 11.4 million subscribers, Valentin Petukhov, suggested on Telegram that Google shut down AdSense because people had managed to “bypass payment blocks imposed by Western sanctions on Russian banks,” Bleeping Computer reported.

According to Petukhov, the wording in Google’s message to users was “kind of strange,” making it unclear what account holders should do next.

“Even though the income from monetization has fallen tenfold, it hasn’t disappeared completely,” Petukhov said.

YouTube still spotty in Russia

Google’s decision to end AdSense in Russia follows reports of a mass YouTube outage that Russian Internet monitoring service Sboi.rf reported is still impacting users today.

Officials in Russia claim that YouTube has been operating at slower speeds because Google stopped updating its equipment in the region after the invasion of Ukraine, Reuters reported.

This outage and the slower speeds led “subscribers of over 135 regional communication operators in Russia” to terminate “agreements with companies due to problems with the operation of YouTube and other Google services,” the Russian tech blog Habr reported.

As Google has tried to resist pressure from Russian lawmakers to censor content that officials deem illegal, such as content supporting Ukraine or condemning Russia, YouTube had become one of the last bastions of online free speech, Reuters reported. It’s unclear how ending monetization in the region will impact access to anti-Kremlin reporting on YouTube or more broadly online in Russia. Last February, a popular journalist with 1.64 million subscribers on YouTube, Katerina Gordeeva, wrote on Telegram that “she was suspending her work due to the law,” Reuters reported.

“We will no longer be able to work as before,” Gordeeva said. “Of course, we will look for a way out.”

Google abruptly shuts down AdSense in Russia as tensions with Kremlin escalate Read More »

microsoft-network-breached-through-password-spraying-by-russian-state-hackers

Microsoft network breached through password-spraying by Russian-state hackers

Biz & IT, kremlin, microsoft, russian hacking, Security / /
Microsoft network breached through password-spraying by Russian-state hackers

Getty Images

Russia-state hackers exploited a weak password to compromise Microsoft’s corporate network and accessed emails and documents that belonged to senior executives and employees working in security and legal teams, Microsoft said late Friday.

The attack, which Microsoft attributed to a Kremlin-backed hacking group it tracks as Midnight Blizzard, is at least the second time in as many years that failures to follow basic security hygiene has resulted in a breach that has the potential to harm customers. One paragraph in Friday’s disclosure, filed with the Securities and Exchange Commission, was gobsmacking:

Beginning in late November 2023, the threat actor used a password spray attack to compromise a legacy non-production test tenant account and gain a foothold, and then used the account’s permissions to access a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions, and exfiltrated some emails and attached documents. The investigation indicates they were initially targeting email accounts for information related to Midnight Blizzard itself. We are in the process of notifying employees whose email was accessed.

Microsoft didn’t detect the breach until January 12, exactly a week before Friday’s disclosure. Microsoft’s account raises the prospect that the Russian hackers had uninterrupted access to the accounts for as long as two months.

A translation of the 93 words quoted above: A device inside Microsoft’s network was protected by a weak password with no form of two-factor authentication employed. The Russian adversary group was able to guess it by peppering it with previously compromised or commonly used passwords until they finally landed on the right one. The threat actor then accessed the account, indicating that either 2FA wasn’t employed or the protection was somehow bypassed.

Furthermore, this “legacy non-production test tenant account” was somehow configured so that Midnight Blizzard could pivot and gain access to some of the company’s most senior and sensitive employee accounts.

As Steve Bellovin, a computer science professor and affiliate law prof at Columbia University with decades of experience in cybersecurity, wrote on Mastodon:

A lot of fascinating implications here. A successful password spray attack suggests no 2FA and either reused or weak passwords. Access to email accounts belonging to “senior leadership… cybersecurity, and legal” teams using just the permissions of a “test tenant account” suggests that someone gave that test account amazing privileges. Why? Why wasn’t it removed when the test was over? I also note that it took Microsoft about seven weeks to detect the attack.

While Microsoft said that it wasn’t aware of any evidence that Midnight Blizzard gained access to customer environments, production systems, source code, or AI systems, some researchers voiced doubts, particularly about whether the Microsoft 365 service might be or have been susceptible to similar attack techniques. One of the researchers was Kevin Beaumont, who has had a long cybersecurity career that has included a stint working for Microsoft. On LinkedIn, he wrote:

Microsoft staff use Microsoft 365 for email. SEC filings and blogs with no details on Friday night are great.. but they’re going to have to be followed with actual detail. The age of Microsoft doing tents, incident code words, CELA’ing things and pretending MSTIC sees everything (threat actors have Macs too) are over — they need to do radical technical and cultural transformation to retain trust.

CELA is short for Corporate, External, and Legal Affairs, a group inside Microsoft that helps draft disclosures. MSTIC stands for the Microsoft Threat Intelligence Center.

Microsoft network breached through password-spraying by Russian-state hackers Read More »