Attackers suspected of working for the Russian government masqueraded as a US State Department official in an attempt to infect dozens of organizations in government, military, defence contracting, media, and other industries, researchers from security firm FireEye have warned.
The tactics, techniques and procedures are akin to those used previously by the Russian APT group Cozy Bear, aka APT29.
At least 38 FireEye clients have been targeted so far in the spear-phishing campaign.
Commenting on the approach and possible intentions of the attack, and the US government’s need to protect it’s agencies, employees and citizens, is Tim Sadler, co-founder and CEO at Tessian.
Tim Sadler, Co-founder and CEO at Tessian:
The goal of such a campaign is to extract sensitive and valuable data from unwitting targets. The damage can be tremendous both financially and reputationally.
The failure of federal agencies to meet longstanding DMARC mandates, coupled with the sophisticated tactics demonstrated by the Russian APT29/ Cozy Bear group, should be a real cause of concern for the US government.
Rather than reactively responding to attacks after they’ve caused financial and infrastructural damage, the government and targeted organizations needs to adopt a more proactive approach to protecting its email networks, employees and the wider public.
It’s worth noting that the direct similarity between this attack and the one that hit the DNC in 2016 doesn’t mean that Russian APT groups will not evolve their techniques. On the contrary, they possess the nation-state resources to develop original, sophisticated and hard-to-detect attack forms, which agencies must anticipate and prepare for, especially if this incident marks the revival of aggressive and persistent Russian campaigning.”
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.