Russia is once again being accused of being behind a series of high-profile cyber-attacks, including the one that knocked French TV station TV5Monde off the air last year.
Germany’s domestic secret service, known as the BfV, said that the country is behind the APT 28 attacks against NATO members, including a hack of German parliament, as well as the Sandstorm campaign that knocked out part of the Ukrainian power grid last year.
This series of nation-state attacks is motivated by highly nefarious aims, the intelligence service said. “Cyberspace is a place for hybrid warfare. It opens a new space of operations for espionage and sabotage,” said BfV head Hans-Georg Maassen, according to the Journal. “The campaigns being monitored by the BfV are generally about obtaining information, that is spying.”
The BfV also said the “cyberattacks carried out by Russian secret services are part of multi-year international operations that are aimed at obtaining strategic information”—going back as far as seven to 11 years.
APT 28 is believed to be a subset of the notorious Operation Pawn Storm initiative, which has been widely linked to Moscow. It’s been blamed for targeting NATO and the US government and military as well as Ukrainian activists and Russian dissidents. Kaspersky Lab said that the group is known for its speed and use of “multi-backdoor packages for extreme resilience”—infecting targets with both the SPLM and AZZY malware so that if one is detected, the other will provide continued access.
The operation “included the attempted hacking of the Dutch Safety Board’s computer systems by Russian spies seeking to access a sensitive final report into the July 2014 shooting down of flight MH17 over Ukraine,” according to security experts Trend Micro.
And, the TV5Monde hack was notable in that initial evidence suggested that the attack was carried out by pro-jihadist hackers. The attack is thought to be the first time hackers have managed to black out TV broadcasts. The state-founded network suffered disruption to its 11 channels.
Aside from the broadcasting disruption, hackers took over the firm’s social media properties and posted, among other propaganda messages, what they claimed were identity cards and CVs of French troops fighting ISIS abroad.
Photo © Monika Humackova