Microsoft: (Cyber) winter is coming as DDoS attack disrupts Russian bank
(2022/12/07)
- Reference: 1670397911
- News link: https://www.theregister.co.uk/2022/12/07/ddos_attack_russian_bank/
- Source link:
Microsoft has warned Europe to be on alert for cyber attacks from Russia this winter, just as a series of attacks hit Russian organizations – including the country's second-largest bank.
The government-controlled St Petersburg-based VTB finaincial institution announced on Tuesday it was facing an "unprecedented cyber attack from abroad," and added that the DDoS flood was the largest in the bank's history.
"Analysis of the DDoS attack indicates that it is planned and large-scale," the bank said in a [1]statement released to Russian media. "Its purpose is to cause inconvenience to the bank's customers by hindering the operation of banking services."
[2]
While "most" of the network-flooding traffic came from "foreign segments of the internet," some originated from Russian IP addresses, which the bank noted was "of particular concern."
[3]
[4]
"We do not exclude that some of these Russian addresses could be among the participants in the attack as a result of cyber fraud," VTB said. "All identified Russian IP addresses will be handed over to law enforcement agencies for verification, since organizing and participating in a DDoS attack is a criminal offense."
Wipers hit Russian courts
The DDoS attack against the bank's technical infrastructure follows reports of data-wiping software being deployed on Russian mayors' and courts' computers last week.
According to [5]local media reports , the wiper poses as ransomware, demands half a million rubles, and regardless of whether the organizations pay or not, it deletes files.
This type of [6]data-deleting malware has been prevalent since before Russia illegally invaded Ukraine. Kremlin-backed criminals were using wipers against Ukrainian infrastructure and organizations from January.
Summer's over
The latest round of wiper and DDoS attacks comes as Microsoft warns that Russia will likely expand its "hybrid-war" efforts beyond Ukraine, and suggests Europe look to Poland as a "harbinger" of what's to come.
In October, GRU-backed [7]Sandworm (Microsoft calls this cyber gang "Iridium") deployed [8]the Prestige ransomware against logistics and transportation networks in Poland and Ukraine, marking the first war-related cyber attack outside of Ukraine since the operation against Viasat took customers' satellites offline and knocked out the remote monitoring of 5,800 wind turbines [9]in Germany .
[10]
"The Prestige event in October may represent a measured shift in Russia's cyber attack strategy, reflecting a willingness by Moscow to use its cyber weapons against organizations outside Ukraine in support of its ongoing war," [11]observed Clint Watts, GM of Microsoft's Digital Threat Analysis Center, adding that the Kremlin might use these types of state-sponsored attacks to disrupt foreign supply chains.
European nations and the US should also brace for more Kremlin-backed influence operations – preying on citizens' concerns about rising energy prices and inflation, and pushing pro-Russian narratives, Watts wrote.
[12]Sandworm gang launches Monster ransomware attacks on Ukraine
[13]Europe calls for joint cyber defense to ward off Russia
[14]US Treasury thwarts DDoS attack from Russian Killnet group
[15]As Russia wages disinfo war, Ukraine's cyber chief calls for global anti-fake news fight
"Russia has and will likely continue to focus these campaigns on Germany, a country critical for maintaining Europe's unity and home to a large Russian diaspora, seeking to nudge popular and elite consensus toward a path favorable to the Kremlin," he argued.
While France is less vulnerable to energy-related disinformation campaigns than Germany or [16]Italy , according to Microsoft, there's a risk that Russia will attempt to use social media campaigns to meddle in French affairs, based on its [17]previous efforts .
"Ukraine has fought a brave defense both online and on the ground against a merciless Russian assault," Watts concluded. "With the help of its partner nations, companies and democratic citizens, we all can ensure that Ukraine and Europe's infrastructure is protected and democracy resilient in the face of authoritarianism this winter." ®
Get our [18]Tech Resources
[1] https://tass.ru/ekonomika/16511291
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y5ByURRQZehrtZ-XJ3e3qAAAAFQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y5ByURRQZehrtZ-XJ3e3qAAAAFQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y5ByURRQZehrtZ-XJ3e3qAAAAFQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://iz.ru/1433190/ivan-chernousov/stiratelnyi-pocherk-gosstruktury-atakoval-novyi-virus-shifrovalshchik?utm_source=substack&utm_medium=email
[6] https://www.theregister.com/2022/04/29/wiper_attacks_jump_500_percent/
[7] https://www.theregister.com/2022/11/29/russia_ransomboggs_ransomware_ukraine/
[8] https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
[9] https://www.theregister.com/2022/03/14/viasat_rosneft_ukraine_cyberattacks/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y5ByURRQZehrtZ-XJ3e3qAAAAFQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://blogs.microsoft.com/on-the-issues/2022/12/03/preparing-russian-cyber-offensive-ukraine/#_edn8
[12] https://www.theregister.com/2022/11/29/russia_ransomboggs_ransomware_ukraine/
[13] https://www.theregister.com/2022/11/11/eu_joint_cyber_defense/
[14] https://www.theregister.com/2022/11/02/killnet_us_treasury_ddos/
[15] https://www.theregister.com/2022/10/22/ukraine_cybersecurity_chief_mwise/
[16] https://www.reuters.com/business/energy/italys-regulated-household-electricity-prices-rise-59-q4-arera-2022-09-29/#:~:text=According%20to%20the%20regulator%2C%20the,inflation%20hit%209.1%25%20in%20August
[17] https://www.theregister.com/2022/09/27/meta_chinese_campaign/
[18] https://whitepapers.theregister.com/
The government-controlled St Petersburg-based VTB finaincial institution announced on Tuesday it was facing an "unprecedented cyber attack from abroad," and added that the DDoS flood was the largest in the bank's history.
"Analysis of the DDoS attack indicates that it is planned and large-scale," the bank said in a [1]statement released to Russian media. "Its purpose is to cause inconvenience to the bank's customers by hindering the operation of banking services."
[2]
While "most" of the network-flooding traffic came from "foreign segments of the internet," some originated from Russian IP addresses, which the bank noted was "of particular concern."
[3]
[4]
"We do not exclude that some of these Russian addresses could be among the participants in the attack as a result of cyber fraud," VTB said. "All identified Russian IP addresses will be handed over to law enforcement agencies for verification, since organizing and participating in a DDoS attack is a criminal offense."
Wipers hit Russian courts
The DDoS attack against the bank's technical infrastructure follows reports of data-wiping software being deployed on Russian mayors' and courts' computers last week.
According to [5]local media reports , the wiper poses as ransomware, demands half a million rubles, and regardless of whether the organizations pay or not, it deletes files.
This type of [6]data-deleting malware has been prevalent since before Russia illegally invaded Ukraine. Kremlin-backed criminals were using wipers against Ukrainian infrastructure and organizations from January.
Summer's over
The latest round of wiper and DDoS attacks comes as Microsoft warns that Russia will likely expand its "hybrid-war" efforts beyond Ukraine, and suggests Europe look to Poland as a "harbinger" of what's to come.
In October, GRU-backed [7]Sandworm (Microsoft calls this cyber gang "Iridium") deployed [8]the Prestige ransomware against logistics and transportation networks in Poland and Ukraine, marking the first war-related cyber attack outside of Ukraine since the operation against Viasat took customers' satellites offline and knocked out the remote monitoring of 5,800 wind turbines [9]in Germany .
[10]
"The Prestige event in October may represent a measured shift in Russia's cyber attack strategy, reflecting a willingness by Moscow to use its cyber weapons against organizations outside Ukraine in support of its ongoing war," [11]observed Clint Watts, GM of Microsoft's Digital Threat Analysis Center, adding that the Kremlin might use these types of state-sponsored attacks to disrupt foreign supply chains.
European nations and the US should also brace for more Kremlin-backed influence operations – preying on citizens' concerns about rising energy prices and inflation, and pushing pro-Russian narratives, Watts wrote.
[12]Sandworm gang launches Monster ransomware attacks on Ukraine
[13]Europe calls for joint cyber defense to ward off Russia
[14]US Treasury thwarts DDoS attack from Russian Killnet group
[15]As Russia wages disinfo war, Ukraine's cyber chief calls for global anti-fake news fight
"Russia has and will likely continue to focus these campaigns on Germany, a country critical for maintaining Europe's unity and home to a large Russian diaspora, seeking to nudge popular and elite consensus toward a path favorable to the Kremlin," he argued.
While France is less vulnerable to energy-related disinformation campaigns than Germany or [16]Italy , according to Microsoft, there's a risk that Russia will attempt to use social media campaigns to meddle in French affairs, based on its [17]previous efforts .
"Ukraine has fought a brave defense both online and on the ground against a merciless Russian assault," Watts concluded. "With the help of its partner nations, companies and democratic citizens, we all can ensure that Ukraine and Europe's infrastructure is protected and democracy resilient in the face of authoritarianism this winter." ®
Get our [18]Tech Resources
[1] https://tass.ru/ekonomika/16511291
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y5ByURRQZehrtZ-XJ3e3qAAAAFQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y5ByURRQZehrtZ-XJ3e3qAAAAFQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y5ByURRQZehrtZ-XJ3e3qAAAAFQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://iz.ru/1433190/ivan-chernousov/stiratelnyi-pocherk-gosstruktury-atakoval-novyi-virus-shifrovalshchik?utm_source=substack&utm_medium=email
[6] https://www.theregister.com/2022/04/29/wiper_attacks_jump_500_percent/
[7] https://www.theregister.com/2022/11/29/russia_ransomboggs_ransomware_ukraine/
[8] https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/
[9] https://www.theregister.com/2022/03/14/viasat_rosneft_ukraine_cyberattacks/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y5ByURRQZehrtZ-XJ3e3qAAAAFQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://blogs.microsoft.com/on-the-issues/2022/12/03/preparing-russian-cyber-offensive-ukraine/#_edn8
[12] https://www.theregister.com/2022/11/29/russia_ransomboggs_ransomware_ukraine/
[13] https://www.theregister.com/2022/11/11/eu_joint_cyber_defense/
[14] https://www.theregister.com/2022/11/02/killnet_us_treasury_ddos/
[15] https://www.theregister.com/2022/10/22/ukraine_cybersecurity_chief_mwise/
[16] https://www.reuters.com/business/energy/italys-regulated-household-electricity-prices-rise-59-q4-arera-2022-09-29/#:~:text=According%20to%20the%20regulator%2C%20the,inflation%20hit%209.1%25%20in%20August
[17] https://www.theregister.com/2022/09/27/meta_chinese_campaign/
[18] https://whitepapers.theregister.com/
jake
"Us right-wingers being Russian agents..."
What would you expect? They put a commie sympathizer in the Oval Office for four years.
Has anybody tapped McCarthy's grave yet? He must be spinning fast enough to light up the shoreline of Lake Michigan ...
Ukraine strikes back... Arrogant Russia didn't expect somebody could do that. Putin Kuyhlo is destroying Russia, despite the censors Russians will get the truth some day.
European nations and the US should also brace for more Kremlin-backed influence operations – preying on citizens' concerns about rising energy prices and inflation, and pushing pro-Russian narratives
[1]There are already US conservatives to do so . Us right-wingers being Russian agents... Stalin must be laughing in Hell.
(It isn't limited to the US, in Europe too the Far Right is licking Putin's boots.)
== Bring us Dabbsy back! ==
[1] https://www.theguardian.com/world/2022/dec/06/us-conservatives-pushing-russian-spin-ukraine-war