Lost Russian Cyber Spies Return

The hackers, also known as Cozy Bear, who are linked to Russian intelligence, have been using Twitter and Reddit forums to send coded messages. The clandestine Russian cyber espionage ring known as The Dukes which disappeared for almost 3 years has come back into the cyber security agenda. 

The Dukes was probably testing and operating in different directions and now a cryptic Reddit post suggests that they are back as Russian hackers. Also called Cozy Bear and APT29, the Dukes have been linked to Russia’s Foreign Intelligence Service. 

Like other Russian hackers in the DNC’s network, the Dukes were ones who lurked quietly, undetected by the Democrats, for nearly a year before the GRU’s hackers barged in to carry out Putin’s 2016 election interference plan. In January 2017, as global concern about Russia’s state-sponsored hacking increased and the Dukes vanished. A phishing campaign against the government of Norway was the last hack attack strongly linked to the group. 

A year later a Dutch newspaper detailed a remarkable years-long counter-hack against the Dukes in the years before they went dark. 

The Dutch intelligence agency AIVD broke into the Dukes network in 2014 and spent years watching the Russians, at one point literally eyeballing them through the security cameras in the Moscow university the Dukes were operating from.  From their privileged perch, the Dutch relayed information to US officials in real time to help thwart the Dukes’ breach of US State Department systems and then tipped off the US again when the Dukes hit the DNC in 2015. 

The FBI later passed the warning to the DNC, which didn’t initially take it seriously. Experts speculated the Dukes had been shut down or were busy regrouping in the wake of unwanted publicity and the embarrassing Dutch counter-hack.

But a recent report by researchers at the European security firm ESET concludes that the Dukes never went away at all, they just retooled, developing new harder-to-spot versions of their custom malware. 

Based on code similarities, a common custom encryption algorithm and other indicators, ESET said it’s linked the Dukes to a continuous chain of hacks dating back to 2013, and still going on as of last June. 

“We spent months apparently chasing a ghost then, a few months ago, we were able to attribute several distinct intrusions to the Dukes,” reads the report by ESET researchers Matthieu Faou, Mathieu Tartare and Thomas Dupuy. 

The Russians’ targets include three unnamed European foreign affairs ministries and an unnamed European embassy in Washington all typical targets for cyber espionage.

The Dukes’ creative opsec is one reason they’ve stayed invisible for so long. The hackers often use coded messages broadcast on Twitter or dropped on Dropbox to communicate with their hacked machines secretly in plain sight, even posting Stegano-graphically-coded photos on public image boards.

ESET’s research adds Reddit to the list of sites co-opted into cyber espionage. The researchers identified two accounts dating to 2014 that were created for the sole purpose of posting coded messages on some subreddits, including the r/funny humor board. 

The hackers’ malware would check for new posts and decrypt a seemingly-nonsensical word in the comment to get the website address of one of the Dukes’ command-and-control servers. ESET conclude that for state-sponsored hackers “going dark for several years does not mean they have stopped spying. They might pause for a while and re-appear in another form, but they still need to spy.”

Daily Beast:       We Live Security:     F-Secure:

You Might Also Read:

Spy vs Spy - Cozy Bear Hackers Hacked:

 

 

« Cyber Security Service Supplier Directory
Cybersecurity And The EU's Regime For 5G Networks »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

IntSights

IntSights

IntSights is an intelligence driven security provider offering rapid, accurate cyberthreat intelligence and incident mitigation in real time

Nixu

Nixu

Nixu is the largest Nordic specialist company in information security consulting.

Cyberwrite

Cyberwrite

Cyberwrite was founded to provide underwriters around the world a unique and innovative Cyber Underwriting platform.

Sliced Tech

Sliced Tech

Sliced Tech provides enterprise grade managed Cloud services, including Security-as-a-Services, aimed at meeting the needs of commercial and government clients from within Australia.

Physec

Physec

Physec offers innovative security products and solutions for the Internet of Things ecosystem.

Echoworx

Echoworx

Echoworx primary and exclusive focus is providing organizations with secure email services.

BlackCloak

BlackCloak

BlackCloak provides Concierge Cyber Security for high-net-worth individuals and corporate executives to protect them from cybercrime, reputational risks, hacking and identity theft.

Sayata Labs

Sayata Labs

Sayata delivers a streamlined solution for processing cyber policies. Increase profitability with an easy and intuitive platform.

Kinetic Investments

Kinetic Investments

Kinetic Investments is a venture capital firm dedicated to early-stage companies that are transforming the digital landscape.

Center for Medical Device Cybersecurity (CMDC) - University of Minnesota

Center for Medical Device Cybersecurity (CMDC) - University of Minnesota

CMDC’s mission is to foster university-industry-government partnerships to assure that medical devices are safe and secure from cybersecurity threats.

TechMD

TechMD

TechMD (formerly ICS) is an award-winning IT solutions firm that specializes in cloud solutions, managed cybersecurity services, strategic IT consulting, and managed IT services.

UK Cyber Cluster Collaboration (UKC3)

UK Cyber Cluster Collaboration (UKC3)

UKC3 has been launched to support Cyber Clusters and encourage greater collaboration across regions and nations of the UK.

eMudhra

eMudhra

eMudhra is a leader in Identity and Transaction Management Solutions.

National Centre for Digital Security (CNSD) - Peru

National Centre for Digital Security (CNSD) - Peru

The National Center for Digital Security manages and supervises the operation of Digital Security in Peru in order to strengthen digital trust.

KTrust

KTrust

KTrust provides Continuous Threat Exposure Management for Kubernetes environments.

Precision Cybertechnologies & Digital Solutions (Precision-Cyber)

Precision Cybertechnologies & Digital Solutions (Precision-Cyber)

Precision-Cyber was founded on the philosophy of state-of-the-art cybersecurity and digital solutions. Our guiding principle is simply that we will provide and secure all your digital needs.