Russian Intelligence Hackers Stalk Western Logistics Firms

A slew of Western cybersecurity agencies warned Wednesday that Russian intelligence is targeting logistics and technology companies in a prolonged hacking campaign that includes an emphasis on internet-connected cameras situated along border crossings and military installations.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

The advisory includes indicators of compromise typical of an attack by Unit 26165 of the Russian Main Intelligence Directorate. Threat intel firms track the unit variously as Forest Blizzard, Fancy Bear and APT 28.

U.S., British, Canadian, French, German, Danish, Czech, Polish, Estonian and Australian cyber agencies including the U.S. National Security Agency said logistics and IT firms have faced elevated risk of hacking by the Kremlin following its invasion of Ukraine in February 2022. Russian intelligence turned its attention to those firms after a military attempt to quickly vanquish Ukraine failed and Western countries began delivering aid.

Air, sea and rail transportation sectors have been targets, as have been IT services and the defense industry. Unit 26165 also looks for IP cameras at key locations to track the movement of materials into Ukraine.

Russian hackers deploy well-known techniques for gaining access, including guessing login credentials, using the Tor network or commercial VPNs to hide their digital infrastructure. They also send spear phishing emails leading to fake login pages, typically hosted on free third-party services or compromised small office devices. Some campaigns use multi-stage redirectors as an obfuscating technique, leading the agencies to suggest blocking outgoing internet traffic to a domains such as mockbin, webhook and Dynu. “Exceptions allowlisted for legitimate activity,” the advisory also says.

Flaws in Outlook are another vector, including a zero-day that Microsoft patched in March 2023. The vulnerability, tracked as CVE-2023-23397 can trigger Windows into transmitting hashed passwords by sending a backdated Microsoft Outlook appointment request containing a parameter for the sound the email client should play when the appointment is overdue. Rather than playing a cheery sound effect, the parameter allows hackers obtain the victim’s login name and password hash (see: Moscow Military Hackers Used Microsoft Outlook Vulnerability).

A WinRAR flaw patched in August 2023 additionally continues to pay dividends in Moscow. Tracked as CVE-2023-38831, the flaw allows attackers to subvert how WinRAR processes .zip files so that when a user double-clicks a file, the user instead opens malware (see: Nation-State Hackers Exploiting WinRAR, Google Warns).

Once inside a network, Russian hackers exfiltrate Active Domain databases and look for lists of Office 365 users and elevate the mailbox permission of a victim account. They enroll compromised accounts into multifactor authentication mechanism “to increase the trust-level.” They especially look for accounts that have access to train schedules or shipping manifests.

IP cameras in Ukraine and bordering states including Romania and Poland are also targets, which hackers penetrate using publicly-known default credentials and “generic attempts to brute force access.”

U.S. President Donald Trump and Russian President Vladimir Putin held a phone call Monday to discuss Ukraine, with Trump announcing afterward that Russia and Ukraine will “immediately” begin ceasefire negotiations. Putin reportedly said the call didn’t lead to a major breakthrough and pushed Ukraine to directly discuss a “possible future peace treaty.”

U.S. non-profit Institute for the Study of War reported Tuesday that Russian Security Council Secretary Dmitry Medvedev asserted that the Ukrainian government is illegitimate, continuing a long-standing Russian narrative used to justify a refusal to enter into good-faith negotiations with Kyiv. Medvedev also asserted that Russia’s annexation of Ukrainian territory is legitimate, “underscoring Russia’s unwillingness to make any concessions in peace negotiations to end the war in Ukraine.”