Microsoft Removes Domains Used For Cyber Attacks On Ukraine

Microsoft has seized domains that it claims were part of ongoing cyber attacks appeared to be perpetrated by Russian advanced persistent threat actors that targeted Ukrainian-related digital access. Microsoft was able to obtain court orders to take over the domains, which it stated were used by Strontium, also known by the names APT28, Fancy Bear and Sofancy.

The court orders enabed Microsoft to take control of the domains  with the goal of neutralizing its attacks on Ukraine. “We recently observed attacks targeting Ukrainian entities from Strontium, a Russian GRU-connected actor we have tracked for years,” said Microsoft in a statement.

Microsoft reported that the domains were used to target organisations such as government institutions, media organisations, foreign policy think tanks and other key industries. Microsoft did not specify how the domains were specifically being abused, beyond identifying those targeted.

Although the specific usage of the domains was not clarified, Microsoft stated that the APT was attempting to establish persistent access to a target’s system that would have likely facilitated a second stage attack. This would have been a harmful attack that included the extraction of information such as credentials.

The APT28, considered to be state-sponsored hackers used by Russian  intelligence service, has been operating since 2009 and this group has worked under various different names  including as Sofacy, Sednit, Strontium, Storm, Iron Twilight, and Pawn as well as Fancy Bear.

“We obtained a court order authorising us to take control of seven internet domains Strontium was using to conduct these attacks,” said Tom Burt, corporate vice president of Customer Security and Trust at Microsoft. “We have since re-directed these domains to a sinkhole controlled by Microsoft, enabling us to mitigate Strontium’s current use of these domains and enable victim notifications,” Burt said.

Sinkhole is a security term that refers to the redirection of internet traffic from domains, at the domain-server network level, for analysis and mitigation by security researchers. Sinkholes are a method typically used for disrupting the operation of botnets and other malware activities. 

Researchers, said the APT was attempting to establish persistent, or long-term, access to a target’s system. This, they suggested, would facilitate a second stage attack that would likely include extraction of sensitive information such as credentials. “This disruption is part of ongoing long-term investment, started in 2016, to take legal and technical action to seize infrastructure being used by Strontium. We have established a legal process that enables us to obtain rapid court decisions for this work,” Microsoft said.

Prior to this, Microsoft seized 91 malicious domains as part of 15 separate court orders against what it asserts are Russian-language threat groups going as far back as 2014.

The use of court orders to obtain a temporary restraining order against those identified as behind the malicious domains has been the main method that Microsoft has used to disrupt malicious campaigns. The court order shuts down the malicious activity and gives Microsoft the legal authority to reroute traffic to domains Microsoft controls.

Researchers often work with hosting providers to reroute traffic from malicious domains to ones controlled by the researchers or by law enforcement, helping to cut off the lifeline of the criminal operations and allow for a forensic analysis of traffic used to establish the source, nature and scope of an attack. “The Strontium attacks are just a small part of the activity we have seen in Ukraine. Before the Russian invasion, our teams began working around the clock to help organisations in Ukraine, including government agencies, defend against an onslaught of cyber warfare that has escalated since the invasion began and has continued relentlessly." according to Microsoft.

“Since then, we have observed nearly all of Russia’s nation-state actors engaged in the ongoing full-scale offensive against Ukraine’s government and critical infrastructure, and we continue to work closely with government and organisations of all kinds in Ukraine to help them defend against this onslaught... In the coming weeks we expect to provide a more comprehensive look at the scope of the cyberwar in Ukraine,” says Microsoft’s blog.

Microsoft:      The Hacker News:      Threatpost:     Oodaloop:     PCGamer:     Security Boulevard

You Might Also Read: 

US Sanctions Russia In Retaliation For Cyber Attacks:

 

« EU Officials Targeted with Pegasus Spyware
Police Shut Down RaidForums Hackers »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Ripjar

Ripjar

Ripjar is a global company of talented technologists, data scientists and analysts designing products that will change the way criminal activities are detected and prevented.

Lumeta

Lumeta

Lumeta’s cyber situational awareness platform is the unmatched source for enterprise network infrastructure analytics and security monitoring for breach detection.

IPVanish

IPVanish

IPVanish has its roots in over 15 years of network management, IP services, and content delivery services. Now we're bringing these finely honed skills to VPN.

CYBERSEC Forum

CYBERSEC Forum

CYBERSEC Forum is an annual European Public Policy Conference dedicated to strategic aspects of cybersecurity.

RedLock

RedLock

The RedLock Cloud 360TM platform correlates disparate security data sets to provide a unified view of risks across fragmented cloud environments.

Cybersecurity Competence Center (C3)

Cybersecurity Competence Center (C3)

The Cybersecurity Competence Center was created to further strengthen the Luxembourg economy in the field of cybersecurity.

GulfTalent

GulfTalent

GulfTalent is the leading job site for professionals in the Middle East and Gulf region covering all sectors and job categories, including cybersecurity.

PeckShield

PeckShield

PeckShield is a blockchain security company which aims to elevate the security, privacy, and usability of entire blockchain ecosystem by offering top-notch, industry-leading services and products.

Smart Protection

Smart Protection

Smart Protection are experts in brand and trademark protection - we fight against counterfeits and unauthorized usages of brands with machine learning technology.

InterGuard

InterGuard

As the pioneer for Unified Insider Threat Prevention and productivity monitoring tools, InterGuard offers on premise and SaaS-based services that are easily available and affordable.

Infostream

Infostream

Infostream is a leading integrator of Digital Transformations Solutions (DTS); Public, Private, and Hybrid Cloud; Cybersecurity; Data Integrity; DevOps, DevSecOps, and Infrastructures.

Irys Technologies

Irys Technologies

Irys Technologies specialize in pioneering digital transformation solutions designed to streamline communications and enhance maintenance and operational efficiency for a variety of sectors.

AI or Not

AI or Not

AI or Not - Leverage AI to combat misinformation and elevate the landscape of compliance solutions.

Arculus Cyber Security

Arculus Cyber Security

Arculus Cyber Security enables customers to securely realise the benefits of digital transformation through pragmatic solutions, guidance and services.

Telenor Cyberdefence

Telenor Cyberdefence

Telenor Cyberdefence is a newly established (2024) cloud-born Managed Security Service Provider focused on the Nordic markets.

modePUSH

modePUSH

modePUSH is a cybersecurity company focused on end-to-end breach response from Digital Forensics to Restoration across the enterprise and cloud environments.