The US National Security Agency has warned government partners and private companies about a Russian hacking operation that uses a special intrusion technique to target operating systems often used by industrial firms to manage computer infrastructure.
- NSA warns government agencies and companies about a Russian hacking operation
- Hackers using a special intrusion technique to target operating systems used by industrial firms to manage computer infrastructure
- The NSA said the hacking activity was tied directly to a specific unit within Russia’s Main Intelligence Directorate
“This is a vulnerability that is being actively exploited, that’s why we’re bringing this notification out,” said Doug Cress, chief of the cybersecurity collaboration centre and directorate at NSA.
“We really want… the broader cybersecurity community to take this seriously.”
The notice is part of a series of public reports by the spy agency, which is responsible for both collecting foreign intelligence and protecting Defence Department systems at home, to share actionable cyber defence information.
Cress declined to discuss which business sectors had been most affected, how many organisations were compromised using the Russian technique, or whether the cyber espionage operation targeted a specific geographic region.
The NSA said the hacking activity was tied directly to a specific unit within Russia’s Main Intelligence Directorate, also known as the GRU, named the Main Center for Special Technologies. The cybersecurity research community refers to this same hacking group as “Sandworm,” and has previously connected it to disruptive cyberattacks against Ukrainian electric production facilities.
Secretary of State Mike Pompeo also called out the same GRU unit in February for conducting a cyberattack against the country of Georgia.
A security alert published by the NSA on Thursday explains how hackers with GRU, Russia’s military intelligence, are leveraging a software vulnerability in Exim, a mail transfer agent common on Unix-based operating systems, such as Linux. The vulnerability was patched last year, but some users have not updated their systems to close the security gap.
“Being able to gain root access to a bridge point into a network gives you so much ability and capability to read email, to navigate across and manoeuvre through the network,” said Cress, “so it’s more about the danger we’re trying to help people understand.”
The team at Platform Executive hope you have enjoyed the ‘The NSA warns of ongoing Russian hacking campaign against US systems‘ article. Automatic translation from English to a growing list of languages via Google AI Cloud Translation. Initial reporting via our official content partners at Thomson Reuters. Reporting by Christopher Bing. Editing by Dan Grebler.