Microsoft Removes Domains Used For Cyber Attacks On Ukraine

Microsoft has seized domains that it claims were part of ongoing cyber attacks appeared to be perpetrated by Russian advanced persistent threat actors that targeted Ukrainian-related digital access. Microsoft was able to obtain court orders to take over the domains, which it stated were used by Strontium, also known by the names APT28, Fancy Bear and Sofancy.

The court orders enabed Microsoft to take control of the domains  with the goal of neutralizing its attacks on Ukraine. “We recently observed attacks targeting Ukrainian entities from Strontium, a Russian GRU-connected actor we have tracked for years,” said Microsoft in a statement.

Microsoft reported that the domains were used to target organisations such as government institutions, media organisations, foreign policy think tanks and other key industries. Microsoft did not specify how the domains were specifically being abused, beyond identifying those targeted.

Although the specific usage of the domains was not clarified, Microsoft stated that the APT was attempting to establish persistent access to a target’s system that would have likely facilitated a second stage attack. This would have been a harmful attack that included the extraction of information such as credentials.

The APT28, considered to be state-sponsored hackers used by Russian  intelligence service, has been operating since 2009 and this group has worked under various different names  including as Sofacy, Sednit, Strontium, Storm, Iron Twilight, and Pawn as well as Fancy Bear.

“We obtained a court order authorising us to take control of seven internet domains Strontium was using to conduct these attacks,” said Tom Burt, corporate vice president of Customer Security and Trust at Microsoft. “We have since re-directed these domains to a sinkhole controlled by Microsoft, enabling us to mitigate Strontium’s current use of these domains and enable victim notifications,” Burt said.

Sinkhole is a security term that refers to the redirection of internet traffic from domains, at the domain-server network level, for analysis and mitigation by security researchers. Sinkholes are a method typically used for disrupting the operation of botnets and other malware activities. 

Researchers, said the APT was attempting to establish persistent, or long-term, access to a target’s system. This, they suggested, would facilitate a second stage attack that would likely include extraction of sensitive information such as credentials. “This disruption is part of ongoing long-term investment, started in 2016, to take legal and technical action to seize infrastructure being used by Strontium. We have established a legal process that enables us to obtain rapid court decisions for this work,” Microsoft said.

Prior to this, Microsoft seized 91 malicious domains as part of 15 separate court orders against what it asserts are Russian-language threat groups going as far back as 2014.

The use of court orders to obtain a temporary restraining order against those identified as behind the malicious domains has been the main method that Microsoft has used to disrupt malicious campaigns. The court order shuts down the malicious activity and gives Microsoft the legal authority to reroute traffic to domains Microsoft controls.

Researchers often work with hosting providers to reroute traffic from malicious domains to ones controlled by the researchers or by law enforcement, helping to cut off the lifeline of the criminal operations and allow for a forensic analysis of traffic used to establish the source, nature and scope of an attack. “The Strontium attacks are just a small part of the activity we have seen in Ukraine. Before the Russian invasion, our teams began working around the clock to help organisations in Ukraine, including government agencies, defend against an onslaught of cyber warfare that has escalated since the invasion began and has continued relentlessly." according to Microsoft.

“Since then, we have observed nearly all of Russia’s nation-state actors engaged in the ongoing full-scale offensive against Ukraine’s government and critical infrastructure, and we continue to work closely with government and organisations of all kinds in Ukraine to help them defend against this onslaught... In the coming weeks we expect to provide a more comprehensive look at the scope of the cyberwar in Ukraine,” says Microsoft’s blog.

Microsoft:      The Hacker News:      Threatpost:     Oodaloop:     PCGamer:     Security Boulevard

You Might Also Read: 

US Sanctions Russia In Retaliation For Cyber Attacks:

 

« EU Officials Targeted with Pegasus Spyware
Police Shut Down RaidForums Hackers »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 8,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Tines

Tines

The Tines security automation platform helps security teams automate manual tasks, making them more effective and efficient.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Gatewatcher

Gatewatcher

Gatewatcher is a digital breach detection platform targeting crafted attacks and protecting organizations against advanced cyber threats.

Sepio Cyber

Sepio Cyber

Sepio is the leading asset risk management platform that operates on asset existence rather than activity.

Digital Arts

Digital Arts

Digital Arts provides internet security software and appliance products for companies and individuals.

Trapmine

Trapmine

TRAPMINE is an innovative cybersecurity products company mainly focusing on protecting organizations from Advanced Persistent Threat & Zero-Day attacks.

Quantea

Quantea

Our multi-patented solutions - QP Series Network Analytics Accelerator appliance and PureInsight Analytics Software Suite allows you to capture, analyze, store, replay, network traffic data.

SecuLetter

SecuLetter

SecuLetter is able to detect unknown attacks with hybrid approaches, static and dynamic analysis.

ACET Solutions

ACET Solutions

ACET Solutions delivers a wide range of Automation, Cyber Security and Enterprise IT/OT Integration Solutions to industrial clients.

JM Search

JM Search

JM Search’s Information Technology Executives Practice sources the most sought-after technology roles including CIO, CTO, CISO, CDO and other senior posts.

ProofID

ProofID

ProofID is a specialist provider of Identity Access Management (IAM) solutions. We focus on the solving the complex needs of the modern enterprise.

Traced

Traced

At Traced, our aim is to redefine mobile cyber security to provide the best possible protection to everyone against breaches of privacy and security.

SECUINFRA

SECUINFRA

SECUINFRA has been supporting companies in detecting, analyzing and defending against cyber attacks since 2010.

ClosingLock

ClosingLock

ClosingLock is the leading provider of wire fraud prevention software for the real estate industry.

Commission Nationale de l'Informatique et des Libertés (CNIL) - France

Commission Nationale de l'Informatique et des Libertés (CNIL) - France

The mission of CNIL is to protect personal data, support innovation, and preserve individual liberties.

Elba

Elba

Employee security needs to be reinvented. SaaS security needs to involve end-user and awareness needs to be actionable. Meet elba, the 5-in-one cybersecurity hub with no compromises.

Orbis Cyber Security

Orbis Cyber Security

Orbis is one of the leading cybersecurity company in USA. Our cybersecurity specialist defends your data, combat threat, and modernize your compliance.

SITE Intelligence Group

SITE Intelligence Group

For over two decades, SITE Intelligence Group has provided customers with critical actionable intelligence and analysis on terrorist and violent extremist online networks.