>
Russian hacking groups are expected to face a long and productive winter, chasing Ukrainian targets as well as those of its Western allies with new and improved malware attacks, Microsoft says.
In a recent blog post (opens in new tab), the software giant said Russia will try to use disinformation and cyberattacks to undermine the support Ukraine receives from its Western allies — both humanitarian and military. It further said it observed “targeted attacks” on Ukrainian infrastructure followed by missile strikes.
The threat actor apparently used for this is called Sandworm.
Elite threat actor
We believe these recent trends suggest the world should be prepared for several possible Russian attacks in the digital domain over the course of this winter.
“Russia will seek to exploit cracks in popular support for Ukraine to undermine coalitions essential to Ukraine’s resilience, in hopes of damaging the humanitarian and military aid flowing to the region. We must also be prepared on cyber-assisted influence operations targeting Europe in parallel with cyber threat activity.”
Sandworm is an elite threat actor that has been active for about 20 years. It has been involved in a cyberwar against Ukraine in the past, most notably the blackouts of 2015 and 2016. In addition, the group was behind the KillDisk wiper that targeted banks in the country, as well as the dreaded NotPetya ransomware (opens in new tab).
This is not the first time that Microsoft has warned of increasing cyber activity from Russian state-sponsored actors. In June it said the country’s intelligence services had upped the ante in attacks on Ukraine’s allies. These were mostly cyber espionage campaigns, with the aim of obtaining as much sensitive information as possible.
In addition, Sandworm has also been blamed for recent ransomware attacks against Ukrainian targets, which took place last month.
In April of this year, the FBI reported that it had taken down a large Sandworm botnet.
Through: Beeping computer (opens in new tab)