Russian GRU cracks open logistic companies to spy on Ukranian military aid

Since 2022, Fancy Bear was targeting logistics organizations in the westThe goal was to monitor foreign aid coming to UkraineCCTV cameras at border crossings were monitored, as wellFancy Bear, the infamous Russian state-sponsored threat actor, has been spying on “dozens” of organizations from Western and NATO countries, monitoring foreign aid moving into Ukraine. This is according to a joint cybersecurity advisory [PDF], published by 21 government agencies from the US, UK, Canada, Germany, France, Czech Republic, Poland, Austria, Denmark, and the Netherlands.As per the report, Fancy Bear (also known as APT28) targeted logistics providers, technology companies, and government organizations involved in transporting aid to Ukraine.All transportation modes were covered, including air, sea, and rail, and the organizations spanned different industries, from defense, to transportation, to maritime and air traffic management, and ultimately - to IT services.60% off for Techradar readersWith Aura's parental control software, you can filter, block, and monitor websites and apps, set screen time limits. Parents will also receive breach alerts, Dark Web monitoring, VPN protection, and antivirus.Preferred partner (What does this mean?)View DealCredential stuffingThe targeted companies were operating in Bulgaria, Czech Republic, France, Germany, Greece, Italy, Moldova, Netherlands, Poland, Romania, Slovakia, Ukraine, and the United States. What’s more, the hackers were also monitoring CCTV cameras on border crossings for the same purpose.To gain initial access, APT28 relied on credential guessing and brute-force attacks. They also ran spearphishing campaigns, and took advantage of software vulnerabilities.By leveraging CVE-2023-23397, they targeted Microsoft Exchange, Roundcube Webmail, and WinRAR, allowing them to infiltrate the systems. Finally, they went for corporate VPNs and vulnerable SQL databases, and after compromising a network, moved laterally with tools such as PsExec and Impacket.The attackers manipulated email mailbox permissions, and used Tor and VPNs to remain hidden while keeping tabs on sensitive communication.The Russo-Ukrainian conflict demonstrated just how much warfare has changed in recent years. Besides the usual fronts - land, sea, and air, cyberspace has become a major battleground, with hackers and cybercriminals on both sides targeting sensitive information, and critical infrastructure.The attack should “serve as a reminder that cyber-physical systems are now strategic targets for adversaries,” commented Andrew Lintell, General Manager, EMEA, at Claroty. “To combat this, organisations need full visibility into these environments and a risk-based approach to securing them. Many of these devices, such as security cameras, weren’t designed with modern threats in mind, so are increasingly vulnerable entry points.”Via The RegisterYou might also likeRussian hackers are attacking innocent companies to get access to their neighborsTake a look at our guide to the best authenticator appWe've rounded up the best password managers