Ukraine Warns That Russia Is Planning for 'Massive' Critical Infrastructure Cyberattacks

Optus hacker says they no longer seek ransom, Chinese hacking group uses Sophos Firewall and Microsoft Office flaws to target Tibetan leadership, Apple removes app used in pig butchering, more

Sep 27

black car parked near white building during daytime — Photo by Romain Chollet on Unsplash

The Ukrainian Defense Intelligence agency said that the Russian government is planning “massive cyberattacks” against Ukrainian critical infrastructure facilities to “increase the effect of missile strikes on electrical supply facilities.”

The Russians also plan to “increase the intensity of the DDoS attacks on the critical infrastructure of Ukraine’s closest allies, primarily Poland and the Baltic state.” The agency said that Russia would bring to bear in upcoming attacks the knowledge it gained in the BlackEnergy attacks of 2015 and the Industroyer attack of 2016, which brought down Ukrainian power grids.

Ukraine’s warning follows Russian President Vladimir Putin's call-up of roughly 300,000 military reservists and a veiled threat by Putin to use nuclear weapons as Russia loses ground in the eastern and southern parts of Ukraine. (AJ Vicens / Cyberscoop)

Dustin Volz @dnvolz

This is an odd alert. There have been worries about these kinds of attacks since before the start of the land invasion in February. Unclear whether there is specific intelligence concerning Russian plans that prompted this warning.

John Hultquist🌻 @JohnHultquist

BREAKING: Ukrainian intel warning of cyberattacks against Ukraine and allies: "The Kremlin plans to carry out massive cyberattacks on critical infrastructure facilities of Ukrainian enterprises and critical infrastructure institutions of Ukraine's allies." https://t.co/XiQpnThv6d

The hacker who stole 10 million customer records from Australia’s second-largest telecommunications company Optus, who goes by the nickname “Optusdata,” posted 10,000 Optus customer records but later deleted the post along with three samples of the data.

In a post on a cybercrime forum, Optusdata said that they were no longer seeking a ransom from Optus. The new post says in rough grammar: “Too many eyes. We will not sale data to anyone. Sorry too 10.200 Australians whos data was leaked.”

Optus said it had not paid a ransom to the attacker. Optusdata was demanding AU$1.5 million in the monero cryptocurrency and threatened to sell the data to other cybercriminals if not paid.

Home Affairs Minister Claire O’Neil told ABC’s 7:30 news program that the basic personal details for 9.8 million Optus customers were compromised. She said that for 2.8 million people, extensive personal information such as a driver’s license or passport numbers had been exposed. (Jeremy Kirk / Bank Info Security)

Ciaran Martin @ciaranmartinoxf

Whatever else about the #Optus breach, good on the Government of Australia and Minister O’Neil for stamping on the usual narrative that “this was a highly sophisticated attack blah blah”. Properly understanding the way data breaches work is key to mitigating them in the future. https://t.co/5Njjof6JR8

Clare O'Neil MP @ClareONeilMP

What happened at Optus wasn't a sophisticated attack. We should not have a telecommunications provider in this country that has effectively left the window open for data of this nature to be stolen. #abc730 https://t.co/KamkiapcZl

Troy Hunt @troyhunt

At this stage, I don't intend to load any Optus data into @haveibeenpwned. Let me explain the reasoning: It looks like Optus has proactively reached out to impacted customers so in terms of answering "Have I Been Pwned?", disclosure and notification has already happened.

abc730 @abc730

Minister for Cyber Security @ClareONeilMP says Australia is "probably a decade behind" in privacy protections, and the government "has to be involved when the stakes are this high" following Optus' cyber security breach. Watch her full interview with Laura Tingle below. #abc730

Researchers at Recorded Future say that an alleged Chinese state-sponsored threat actor known as TA413 weaponized recently disclosed flaws in Sophos Firewall and Microsoft Office to deploy a never-before-seen backdoor called LOWZERO as part of an espionage campaign aimed at Tibetan entities.

The hackers posed at times a pro-independence political party and a prominent media organization, using phishing emails and customized malicious software to collect intelligence, likely on behalf of the Chinese government.

Targets of the campaign consisted of organizations associated with the Tibetan community, including enterprises related to the Tibetan government-in-exile. The intrusions involved the exploitation of CVE-2022-1040 and CVE-2022-30190 (aka "Follina"), two remote code execution vulnerabilities in Sophos Firewall and Microsoft Office, respectively. (Jamie Tarabay / Bloomberg)

The Russian cyber attacks on Viasat’s communications services at the outset of the Ukraine war did not, as previously believed, result in a massive loss of military communications for Ukraine.

Victor Zhora, deputy chairman and chief digital transformation officer at the State Service of Special Communications and Information Protection in Ukraine, now believes that the impact of the Viasat attacks was not severe because the Ukraine military primarily relies on landline communications. Despite pushback from experts who point out, among other things, that Ukrainian soldiers can’t use landlines in the field, Zhora stands by his most recent statement. (Kim Zetter / Zero Day)

Adrienne Fichter @adfichter

Interesting "It [Viasat-Hack] had a serious impact on [the] satellite component of communications. But this is not the primary way of communications in armed forces. Land lines are the priority."

zetter.substack.comViasat Hack “Did Not” Have Huge Impact on Ukrainian Military Communications, Official SaysContrary to initial reports that it resulted in a “really huge loss in communications in the very beginning of war,” the hack did not have a huge impact on ability to coordinate military operations.

Apple quietly removed from its app store a popular smartphone foreign exchange transaction app used to perpetrate a new type of cryptocurrency scam known as pig butchering known as MetaTrader (or MT4 or MT5, depending on the version).

Pig butchering is when a scammer builds a longer-term relationship with their victim before convincing them to invest money over time. Apple’s ban of MetaTrader comes two weeks after Forbes profiled one California-based scam victim, who lost over $1 million last year. (Cyrus Farivar / Forbes)

Vladimir Putin signed a decree granting Russian citizenship to the controversial U.S. whistleblower Edward Snowden.

The former intelligence contractor has been living in Russia since 2013 to escape prosecution in the US after leaking secret files that revealed vast domestic and international surveillance operations carried out by the US National Security Agency.

Putin’s decree quickly led to quips on social media that the whistleblower would soon be conscripted into the Russian army to fight in Ukraine as part of the country’s nationwide mobilization campaign. However, Snowden’s attorney said he could not be drafted because he has not previously served in the Russian armed forces. (Pjotr Sauer / The Guardian)

Oleg Shakirov @shakirov2036

From Citizenfour to my fellow citizen: Snowden is now a Russian national per president's executive order publication.pravo.gov.ru/Document/View/…

Alex Plitsas 🇺🇸 @alexplitsas

Edward Snowden isn’t a patriot. He’s a traitor. He compromised sources and methods that had nothing to do with his alleged complaints. He stole so many files that he couldn’t have even read the titles to know what damage he caused. He belongs in prison.

reuters.comPutin grants Russian citizenship to U.S. whistleblower SnowdenSnowden fled the United States and was given asylum in Russia after leaking secret files in 2013.

Lockbit ransomware hackers who crippled the Corbeil-Essonnes hospital near Paris a month ago and stole a trove of data last month have released personal records of patients online.

The cyber attackers demanded a multimillion-dollar ransom, but the hospital refused to pay. The hospital said the hackers have now dumped medical scans and lab analyses along with the national security numbers of patients. Cybersecurity researcher Damien Bancal, who revealed the leak and has seen the files, said the worry is that other criminals will now launch scams with the data that has already been divulged. (AFP)

Related: ET CIO, Bank Info Security

Researchers at threat intelligence company Cluster25 say that hackers believed to work for Russia’s APT28 (a.k.a. Fancy Bear) have started using a new code execution technique that relies on mouse movement in Microsoft PowerPoint presentations to trigger a malicious PowerShell script.

The hackers have used the new technique to deliver the Graphite malware as recently as September 9. The threat actor lures targets with a malware-laden PowerPoint (.PPT) file allegedly linked to the Organization for Economic Co-operation and Development (OECD), an intergovernmental organization working towards stimulating economic progress and trade worldwide. (Bill Toulas / Bleeping Computer)

Related: Reddit - cybersecurity, Cluster 25

In a breach notification filed with the Maine attorney general’s office, Elbit Systems of America, the U.S. arm of Israeli defense contractor Elbit, says its network was compromised in early June, and employees' personal information was stolen.

The company said 369 employees were affected by the data breach, which included employee names, addresses, dates of birth, direct deposit information, ethnicity, and Social Security numbers. In the notice, the Texas-based company shared few details, only that “someone attempted to interfere with Elbit America’s cyber operations” and that its investigation was ongoing. (Zack Whittaker / TechCrunch)

Related: Maine Attorney General

According to the second edition of the National Cyber Power Index, part of the Cyber Project within the Harvard Kennedy School Belfer Center, the U.S. rates number one in terms of cyber power.

The list ranks 30 nations across various factors, including offense and defense. It seeks to measure capabilities in eight objectives, such as foreign intelligence collection or the ability to destroy rivals’ infrastructure. Those that rank highly on the list demonstrate both capabilities with cyber power and the willingness to use it.

While No. 1 and No. 2 were the same as the inaugural edition of the index in 2020, the United States and China Russia have moved into the top three, and several nations, including Iran, Ukraine, Vietnam, and South Korea, have moved up the list. (Tim Starks and McKenzie Beard / Washington Post)

Related: Belfer Center

The Treasury Inspector General for Tax Administration (TIGTA) reported that a managed services provider to the IRS, eGain, failed to install high-severity rated updates to antivirus software and ran outdated software for more than a year in contravention of IRS information resource management rules for vendors.

The system in question, the Taxpayer Digital Communications (TDC) platform, enables taxpayers to communicate and share documents with IRS representatives in a variety of web-based chat formats. As a result, TIGTA auditors recommended that the IRS chief information officer take steps to make sure eGain monitors and ensure timely updates are made to antivirus software in keeping with the tax agency's own rules. IRS CIO Nancy Sieger concurred and said that the agency is now getting regular reports on patching and updates from eGain. (Adam Mazmanian / FCW)