Russian hackers cloak attacks using Iranian group

hawki · Oct 21, 2019

"An Iranian hacking group was itself hacked by a Russian group to spy on multiple countries, UK and US intelligence agencies have revealed.

The Iranian group - codenamed OilRig - had its operations compromised by a Russian-based group known as Turla.

The Russians piggybacked on the Iranian group to target other victims...

...the Russian group had targeted the Iranian-based group and then used its tools and access to collect data and compromise further systems...

Attacks were discovered against more than 35 countries with the majority of the victims being in the Middle East. At least 20 were successfully compromised. The ambition was to steal secrets, and documents were taken from a number of targets, including governments...

Intelligence agencies said Turla was both getting hold of information the Iranians were stealing but also running their own operations using Iranian access and then hoping it would hide their tracks..."
Click to expand...

https://www.bbc.com/news/technology-50103378

guest · Oct 24, 2019

Russia dismisses hacking reports as 'unsavoury'
October 24, 2019
https://uk.reuters.com/article/uk-r...es-hacking-reports-as-unsavoury-idUKKBN1X32QZ

Moscow on Thursday dismissed media reports that Russian hackers piggybacked on an Iranian cyber-espionage operation to attack government and industry organisations in dozens of countries as an “unsavoury” interpretation of a security report.

British security officials have said the Russian group, known as “Turla” and accused by Estonian and Czech authorities of operating on behalf of Russia’s FSB security service, has used Iranian tools and computer infrastructure to successfully hack in to organisations in at least 20 different countries over the last 18 months.

“These publications are an unsavoury interpretation of a concise report of the British National Cyber Security Centre and the American National Security Agency,” a spokesman for the Russian embassy in the UK said on the mission’s website, referring to the media reports.
Click to expand...

hawki · Oct 25, 2019

mood said: ↑

Russia dismisses hacking reports as 'unsavoury'
October 24, 2019
https://uk.reuters.com/article/uk-r...es-hacking-reports-as-unsavoury-idUKKBN1X32QZ
Click to expand...

не отрицание отрицания

translation = "non-denial denial"

guest · Mar 12, 2020

Turla’s use of Iranian infrastructure probably opportunistic
March 12, 2020
https://www.computerweekly.com/news...Iranian-infrastructure-probably-opportunistic

In October 2019, the UK’s National Cyber Security Centre (NCSC) and the US’s National Security Agency (NSA) closed out a two-year investigation and published conclusive evidence that Turla was attacking its victims using implants that had been stolen from the APT34 or OilRig APT group, which is linked to the Iranian government.

Further research carried out by Insikt into Turla – which also goes by the names Snake, Waterbug and Venomous Bear – revealed that its hijacking of APT34’s resources has been unique among known threat actors to date, amounting effectively to a complete takeover of one nation state group’s assets by another.
Insikt said that although it was possible that this was due to some measure of collaboration, the available evidence did not support that conclusion.

“For example, while Turla had significant insight into APT34 tools and operations, they were required to scan for Iranian web shells in order to find where these tools were deployed,” wrote the report’s authors. “We assess that Turla’s interposition into Iranian operations was likely an uncoordinated and thus hostile act.
Click to expand...

“While Insikt Group assesses that Turla Group’s use of APT34 infrastructure was primarily opportunistic in nature, an added benefit for the operators was likely the deception of incident responders, who would potentially identify the tools as Iranian in origin.”
Click to expand...

Insikt Group: Swallowing the Snake’s Tail: Tracking Turla Infrastructure

Log in or Sign up

Russian hackers cloak attacks using Iranian group

hawki Registered Member

guest Guest

hawki Registered Member

guest Guest

Log in or Sign up

Russian hackers cloak attacks using Iranian group

hawki Registered Member

guest Guest

hawki Registered Member

guest Guest

Useful Searches