Agenţia Naţională de Securitate (NSA) a SUA a avertizat joi partenerii guvernamentali şi companiile private despre o operaţiune de hacking rusă care foloseşte o tehnică de intruziune specială pentru a viza sistemele de operare utilizate adesea de firmele industriale pentru gestionarea infrastructurii computerizate, transmite Reuters.
Avertismentul face parte dintr-o serie de rapoarte publice ale agenţiei de spionaj, care este responsabilă atât pentru colectarea informaţiilor externe, cât şi pentru protejarea sistemelor Departamentului de Apărare în ţară, pentru a împărtăşi informaţii legate de apărarea cibernetică.
Cress a refuzat să discute despre ce sectoare de afaceri au fost cele mai afectate, câte organizaţii au fost compromise folosind tehnica rusă sau dacă operaţiunea de spionaj cibernetic a vizat o anumită regiune geografică.
NSA a arătat că activitatea de hacking a fost legată direct de o unitate specifică din Direcţia principală de informaţii din Rusia, cunoscută şi sub denumirea de GRU, numită Centrul principal pentru tehnologii speciale. Comunitatea de cercetare în domeniul securităţii cibernetice se referă la acelaşi grup de hacking ca ”Sandworm” şi l-a corelat anterior cu atacuri cibernetice perturbatoare împotriva instalaţiilor de producţie a electricităţii din Ucraina.
Secretarul de stat Mike Pompeo a afirmat în februarie că aceeaşi unitate a GRU a efectuat un atac cibernetic împotriva Georgiei, scrie news.ro
NSA warns of ongoing Russian hacking campaign against U.S. systems
(Reuters) – The U.S. National Security Agency on Thursday warned government partners and private companies about a Russian hacking operation that uses a special intrusion technique to target operating systems often used by industrial firms to manage computer infrastructure.
“This is a vulnerability that is being actively exploited, that’s why we’re bringing this notification out,” said Doug Cress, chief of the cybersecurity collaboration center and directorate at NSA. “We really want… the broader cybersecurity community to take this seriously.”
The notice is part of a series of public reports by the spy agency, which is responsible for both collecting foreign intelligence and protecting Defense Department systems at home, to share actionable cyber defense information.
Cress declined to discuss which business sectors had been most affected, how many organizations were compromised using the Russian technique, or whether the cyber espionage operation targeted a specific geographic region.
The NSA said the hacking activity was tied directly to a specific unit within Russia’s Main Intelligence Directorate, also known as the GRU, named the Main Center for Special Technologies. The cybersecurity research community refers to this same hacking group as “Sandworm,” and has previously connected it to disruptive cyberattacks against Ukrainian electric production facilities.
Secretary of State Mike Pompeo also called out the same GRU unit in February for conducting a cyberattack against the country of Georgia.
ADVERTISEMENT
A security alert published by the NSA on Thursday explains how hackers with GRU, Russia’s military intelligence, are leveraging a software vulnerability in Exim, a mail transfer agent common on Unix-based operating systems, such as Linux. The vulnerability was patched last year, but some users have not updated their systems to close the security gap.
“Being able to gain root access to a bridge point into a network gives you so much ability and capability to read email, to navigate across and maneuver through the network,” said Cress, “so it’s more about the danger we’re trying to help people understand.”
Reporting by Christopher Bing; Editing by Dan Grebler
