CISA Sounds Alarm on Cybersecurity Threats Amid Russia’s Invasion Anniversary

Feb 24, 2023Ravie LakshmananCyber War / Cybersecurity

The U.S. Cybersecurity and Infrastructure Security Agency (CISA)
is urging organizations and individuals to increase their cyber
vigilance, as Russia’s military invasion of Ukraine officially
enters one year^[1].

“CISA assesses that the United States and European nations may
experience disruptive and defacement attacks against websites in an
attempt to sow chaos and societal discord on February 24, 2023, the
anniversary of Russia’s 2022 invasion of Ukraine,” the agency
said^[2].

To that end, CISA is recommending^[3]
that organizations implement cybersecurity best practices, increase
preparedness, and take proactive steps to reduce the likelihood and
impact of distributed denial-of-service (DDoS) attacks.

The advisory comes as the Computer Emergency Response Team of
Ukraine (CERT-UA) revealed^[4]
that Russian nation-state hackers breached government websites^[5]
and planted backdoors as far back as December 2021.

CERT-UA attributed the activity to a threat
actor^[6] it tracks as UAC-0056,
which is also known under the monikers DEV-0586, Ember Bear,
Nodaria, TA471, and UNC2589.

The attacks entail the use of web shells as well as a number of
custom backdoors like CredPump, HoaxApe, and HoaxPen, adding to the
group’s arsenal of tools^[7]
like WhisperGate, SaintBot, OutSteel, GraphSteel, GrimPlant, and
more recently, Graphiron.

The agency, in a related advisory, also disclosed a phishing
campaign^[8] bearing RAR archives
that lead to the deployment of the Remos remote control and
surveillance software. It’s been linked to a threat actor known as
UAC-0050^[9]
(and UAC-0096).

The findings come as Fortinet reported a 53% increase in
destructive wiper attacks from Q3 to Q4 2022, primarily fueled by
Russia’s state-sponsored hackers striking an unprecedented variety
of data-destroying malware^[10] at Ukraine.

“These new strains are increasingly being picked up by
cybercriminal groups and used throughout the growing
cybercrime-as-a-service (CaaS) network,” the security vendor
said^[11].

“Cybercriminals are also now developing their own wiper malware
which is being used readily across CaaS organizations, meaning that
the threat of wiper malware is more widespread than ever and all
organizations are a potential target, not just those based in
Ukraine or surrounding countries.”