Microsoft says it took down a Russian cyberattack against Ukraine

News
By Sead Fadilpašić
last updated

Seven domains were seized in Microsoft action

Ukrainian cloud encrypted
(Image credit: Shutterstock)

Microsoft claims it recently took down seven domains that Russian cybercriminals were using in cyberattacks against Ukrainian target.

The Ukrainian targets were being hit by APT28 (also known as Strontium), a Russian state-sponsored hacking group with links to the military intelligence service organization, GRU. 

Among the targets were endpoints belonging to Ukrainian institutions and media organizations, Microsoft revealed in its report.

TechRadar needs yo...

We're looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn't take more than 60 seconds of your time. Thank you for taking part.

>> Click here to start the survey in a new window <<

Tactical support for the invasion

“On Wednesday, April 6th, we obtained a court order authorizing us to take control of seven internet domains Strontium was using to conduct these attacks," said Tom Burt, Corporate Vice President of Customer Security & Trust at Microsoft.

"We have since re-directed these domains to a sinkhole controlled by Microsoft, enabling us to mitigate Strontium's current use of these domains and enable victim notifications.

"We believe Strontium was attempting to establish long-term access to the systems of its targets, provide tactical support for the physical invasion and exfiltrate sensitive information."

The domains have also been used in attacks against government institutions in the west, namely the EU and the US. 

"This disruption is part of an ongoing long-term investment, started in 2016, to take legal and technical action to seize infrastructure being used by Strontium. We have established a legal process that enables us to obtain rapid court decisions for this work," Burt also said.

Read more

> Fancy Bear hackers return to target sporting organizations

> Microsoft flags major cyberattacks on Covid-19 vaccine makers

> US, UK agencies say Russia is abusing Kubernetes to launch massive cyberattacks

APT28 is one of the most famous Russian state-sponsored cybercrime groups. It’s also known as Fancy Bear, and is most likely operational since the mid-2000s. It usually goes after government agencies, military and security organizations, in western countries. 

So far, it’s been linked to cyberattacks against the German and Norwegian parliaments, the French TV station TV5Monde, the White House, NATO, the Democratic National Committee, the Organization for Security and Co-operation in Europe and the campaign of the French presidential candidate Emmanuel Macron.

It was also said the group tried to influence the 2016 US presidential elections.

Via: BleepingComputer

Sead Fadilpašić
Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.