Mandiant analysts: Russia-backed APTs likely to ramp up attacks

The developing international crisis in Ukraine – which has already seen government websites attacked – is likely to engender further offensive cyber attacks as it unfolds, and concerns are growing that future activity will spread to encompass targets outside of Ukraine, according to Mandiant, which today warned IT security teams across Europe to be on the lookout for malicious activity.

Last week’s cyber attacks saw a hacking group supposedly linked to Belarus, a key Russian ally, use multiple techniques to access their targets, including the compromise of an IT service supplier’s systems, exploits linked to the Log4Shell vulnerability in Apache Log4j2, and distributed denial of service (DDoS) attacks. These were accompanied by a wave of attacks that defaced Ukrainian government websites, supposedly to distract from attempts to manually inject malware into government systems.

Mandiant now believes advanced persistent threat (APT) groups linked to Russia and its allies will conduct further cyber intrusions, as the stand-off continues. Many of these will likely be linked to information gathering and espionage, but the possibility of more aggressive or even destructive cyber attacks should not be discounted, the firm’s analysts warned.

In a post laying out the potential scale of the threat to global organisations, John Hultquist, vice-president of Mandiant Threat Intelligence, said: “Cyber capabilities are a means for states to compete for political, economic and military advantage without the violence and irreversible damage that is likely to escalate to open conflict.

“While information operations and cyber attacks such as the 2016 US election operations and the NotPetya incident can have serious political and economic consequences, Russia may favour them because they can reasonably expect that these operations will not lead to a major escalation in conflict.

“Mandiant recommends that defenders take proactive steps to harden their networks against [destructive attacks] and has provided a guide to this process…for free to the public,” wrote Hultquist.

Hultquist said Kremlin-backed cyber espionage APTs such as UNC2452, Turla and APT28 would “almost certainly” have received tasking to gather intelligence around the crisis, leveraging their expertise in penetrating government, military and diplomatic targets to gather intelligence for Moscow. Other groups, including some that operate out of the separatist Donbass region of Ukraine, and Crimea, which was annexed by Russia in 2014 and has been illegally occupied since then, may also be pressed into service.

Meanwhile, information, or rather dis- and misinformation operations, including the creation of fabricated content and the manipulation of social media platforms, are likely already happening, and one can expect to see more such campaigns targeting countries in Eastern Europe – such as Nato members Romania and Bulgaria, from which Russia is now demanding the alliance withdraw.

Information campaigns have become a regular feature of Russian cyber activity, seeking to control narratives and implant new ones that advance Moscow’s interests by exploiting divisions within and between the nation states it is targeting, undermining confidence in democratic institutions, and sewing distrust within blocs such as Nato and the European Union (EU).

Such campaigns have included the use of forged documents and doctored photographs, which were successfully used against Estonia in a recent campaign dubbed Secondary Infektion. In other cases, Russian information operations have leant on third parties, including journalists and activists, to try to “launder” falsehoods.