Russian Hackers Have New Weapons

The same hacker crew that the US has blamed for the 2016 hack of the Democratic National Committee is back with a new weapon at its disposal, cybersecurity researchers have warned.

The so-called Fancy Bear group, alleged by American intelligence to be an arm of the Russian government, has been spotted launching fresh attacks on the West, just as a closely linked unit, dubbed Cozy Bear, has gone on a mini-espionage rampage.

Fancy Bear has started using new malware called Cannon, cybersecurity company Palo Alto Networks said recently. While new, it uses old techniques. Namely, it’s using email as a way of transferring data from infected targets. 

Those hacked organisations are based in North America, Europe and a former USSR state, Palo Alto Networks researchers said, without revealing more specifics.

The Russian crew, also known as APT28 and Sofacy, has been sticking to its tried and tested email phishing attack methods. In the latest spate of hacks, emails promised information on the crash of a Lion Air 737 MAX plane in the sea off Indonesia on October 29, in which all 189 on board died. 

It’s been the subject of much contention, as plane manufacturer Boeing has been criticised for not providing enough information to pilots about certain safety features of the aircraft. Boeing has said the information was in flight manuals.
Fancy Bear has jumped on the news, using it to target a government organization dealing with foreign affairs in Europe with a malicious Microsoft Word document entitled “crash list(Lion Air Boeing 737).docx,” the researchers said. 

“It’s pretty common for Sofacy to use lures that are timely and in the news,” said Jen Miller-Osborn, deputy director of threat intelligence at Unit 42. Miller-Osborn wasn’t sure why Fancy Bear had reverted to using the old technique of email communications, but noted it could be an attempt to avoid detection. It can also be used to upload more malware to infected computers.

She said the group had been busy in recent months. But it was conspicuously quiet around the midterm elections in November, compared to the 2016 Presidential election where it caused so much carnage.

Posing As State Department Dignitaries

Meanwhile, the Cozy Bear group, also linked by cybersecurity researchers to Russia, launched a phishing blitz on Wednesday, November 14. According to cybersecurity company FireEye, it’s Cozy Bear’s first outing in a year. In their malicious email, the hackers posed as a public affairs official at the US Department of State, Susan Stevenson, the principal deputy assistant secretary for that branch of government.

To make their attacks appear even more legitimate, the hackers commandeered the email server of a hospital and the website of a consulting company from which to send their messages. 

Though they looked like they contained secure communications from the State Department employee and an official internship document, they were in fact laced with malware designed to snoop on targets.
FireEye said recently Cozy Bear’s latest hit list included at least 20 of its customers across multiple industries including think tanks, law enforcement, media, US military, imagery, transportation, pharmaceuticals, national government and defense contracting.

New Russian Hacking Tool is Extra Sneaky

Russian hackers also have a newly discovered tool in their arsenal to access your computer.
It's a piece of malicious software dubbed "Cannon" by researchers at Palo Alto Networks, who wrote about the hacking tool recently. 

Once the malware is on your computer, it takes screenshots of your homepage and then uses your email account to send the images to the hackers, all without your knowledge. The Cannon software essentially becomes a spy camera living on your computer.

According to Palo Alto Networks, the hackers behind this are part of the Russian military spy agency better known as Fancy Bear, the same group behind the 2016 hack of the Democratic National Committee. And who are these notorious Russian hackers targeting now? They have Cannon poised at U.S. and European governments, of course.

Naturally, this scheme all started with a few successful phishing attempts. The Russian hackers sent emails to their targets with blank Word documents attached. 

The blank documents didn't catch the attention of security software, but once the targets clicked to open them, they also unknowingly downloaded a remote template featuring malicious code. If this sounds scary, there are a few ways you can protect yourself and your networks by avoiding the phishing bait. Here's how to spot a phishing attempt and how to deal with it:

Prevent
Security experts may sound like a broken record at this point, but to prevent phishing attacks altogether, make sure to beef up password security and enable two-factor authentication, especially on email and financial accounts.
Tech users should also have external or cloud backup in place, so if they do fall victim to a phishing attack, their data won't be lost entirely.

When checking your email, always think twice before clicking any link, especially if it has a URL shortener, or downloading an attachment, even if it's from a friend. Why shouldn't you trust a friend? Your friend's email account could have been compromised.

If you're unsure of anything, get on the phone with your friend or colleague to verify they did send that message. And of course, never wire transfer money without extra, verbal verification, Cidon warned.

Spot
Many phishing attempts often create urgency and in a panic get you to click. These psychological tricks get you to act without thinking. If you get a strange email saying your account is overdrawn, stop, take a breath and check a few key things before proceeding.

First, try to verify the sender. Hackers will often disguise the email to make it look like it's from an established source, like a friend or a company. But click to find out the details, and you might see a slightly altered email address, Cidon said.
Sometimes, hackers will gain access to a legitimate email account and alter the reply-to email address. If something is suspicious, like your boss is urgently asking you to send company security information or wire thousands of dollars of company money to, find out what the email address is that you would reply to with the information.

React
If you were unfortunately duped, maybe you clicked that link that said your PayPal account was going to be closed, there are steps you can take.

First, immediately reset the password on all of your accounts, especially any financial accounts. You should also call your bank to let them know you've had a security breach and you have not authorised any money transfers. If this was a phishing attempt on your work account, immediately report it to the appropriate channels. Some users might want to wipe endpoints and format the computer and reinstall programs, Cidon cautioned.

Ultimately, being aware of the risks posed by phishing is a good step. Educating people about these threats is important, so they know what's possible and how to prepare for it.

NextGov 1:          NextGov 2:        PaloAlto Networks:          Forbes

You Might Also Read:

Spy vs Spy - Cozy Bear Hackers Hacked:

Just Who Are Russia's Cyber Warriors?:
 

« Russian Cyber Strategy And Tactics
From Machine Learning To Machine Reasoning »

Perimeter 81

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Perimeter 81

Perimeter 81

Perimeter 81 is a Zero Trust Network as a Service designed to simplify secure network, cloud and application access for the modern and distributed workforce.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Cylance Smart Antivirus

Cylance Smart Antivirus

An antivirus that works smarter, not harder, from BlackBerry. Lightweight, non-intrusive protection powered by artificial intelligence. BUY NOW - LIMITED DISCOUNT OFFER.

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Free Access: Cyber Security Supplier Directory listing 5,000+ specialist service providers.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Imperva

Imperva

Imperva is a leading provider of data and application security solutions including DDoS protection, Web application security, Data security and Cloud security.

Xyone Cyber Security

Xyone Cyber Security

Xyone Cyber Security services include penetration testing, compliance, training and consultancy.

National Cyber Security Centre (NCSC) Norway

National Cyber Security Centre (NCSC) Norway

NCSC is part of the Norwegian Security Authority, and is Norway's national cyber security hub and the national CERT.

SecuriThings

SecuriThings

SecuriThings is a User and Entity Behavioral Analytics (UEBA) solution for IoT security.

Industrial Cyber-Physical Systems Center (iCyPhy)

Industrial Cyber-Physical Systems Center (iCyPhy)

The goal of iCyPhy is to conduct pre-competitive research on architectures and design, modeling, and analysis techniques for cyber-physical systems.

Secure Innovations

Secure Innovations

Secure Innovations is a cybersecurity firm dedicated to providing top-tier cyber security solutions for the Defense and the Intelligence Community.

Verodin

Verodin

Verodin is a business platform that provides organizations with the evidence needed to measure, manage and improve their cybersecurity effectiveness.

GELLIFY

GELLIFY

GELLIFY is the first innovation platform dedicated to the high-tech B2B market, supporting start-ups and companies.