• World
  • Business
  • Health
  • Politics
  • Science
  • Sports
  • Tech
  • Travel
Facebook Twitter Instagram
  • Home
  • About us
  • contact us
  • Privacy policy
  • Terms and conditions
Facebook Twitter Instagram
Ediwinaussie
  • World
  • Business
  • Health
  • Politics
  • Science
  • Sports
  • Tech
  • Travel
Ediwinaussie
Home » US charges four Russian spies for hacking Saudi oil facility and US nuclear power plant – TechCrunch
Tech

US charges four Russian spies for hacking Saudi oil facility and US nuclear power plant – TechCrunch

March 25, 20224 Mins Read
Facebook Twitter Pinterest LinkedIn Tumblr Email
Share
Facebook Twitter LinkedIn Pinterest Email

The U.S. Department of Justice has announced charges against four Russian government employees for a years-long hacking campaign targeting critical infrastructure, including a U.S. nuclear power operator and a Saudi petrochemical facility.

The first indictment, from June 2021, charges Evgeny Viktorovich Gladkikh, 36, a computer programmer at the Russian Ministry of Defense, and two co-conspirators, of planning to hack industrial control systems — the critical devices that keep industrial facilities operational — at global energy facilities. Gladkikh is believed to be behind the infamous Triton malware, which was used to target a petrochemical plant in Saudi Arabia in 2017. Hackers used the malware in an attempt to disable safety systems in the plant designed to prevent dangerous conditions that could lead to leaks or explosions. Triton was first linked to Russia in October 2018.

Following their failed plot to blow up the Saudi plant, the hackers attempted to hack the computers of a company that managed similar critical infrastructure entities in the U.S, according to the DOJ.

The second indictment, filed in August 2021, charges Pavel Aleksandrovich Akulov, Mikhail Mikhailovich Gavrilov and Marat Valeryevich Tyukov, all allegedly members of Military Unit 71330 of Russia’s Federal Security Bureau (FSB), with a number of attacks targeting the energy sector between 2012 and 2017. The hackers, better known to security researchers as “DragonFly,” “Energetic Bear” and “Crouching Yeti,” attempted to gain access to computer networks of companies in the international energy sector, including oil and gas firms, nuclear power plants and utility and power transmission companies, the DOJ said.

In the first stage of their attacks, which took place between 2012 and 2014, the threat actors compromised the networks of industrial control device makers and software providers, then hid Havex malware inside software updates. This, along with spearphishing and watering hole attacks — a form of attack that targets users by infecting websites that they commonly visit — enabled the attackers to install malware on more than 17,000 unique devices in the United States and abroad.

The second phase, “DragonFly 2.0,” ran from 2014 to 2017 and involved targeting more than 3,300 users at over 500 U.S. and international organizations, including the U.S. government’s Nuclear Regulatory Commission and the Wolf Creek Nuclear Operating Corporation.

“Russian state-sponsored hackers pose a serious and persistent threat to critical infrastructure both in the United States and around the world,” said U.S. Deputy Attorney General Lisa Monaco in a statement. “Although the criminal charges unsealed today reflect past activity, they make crystal clear the urgent ongoing need for American businesses to harden their defenses and remain vigilant.”

John Hultquist, vice president of intelligence analysis at Mandiant, said the indictments provide a glimpse of the FSB’s role in Russia’s state-sponsored hacking attempts, and come as a “warning shot” to the Russian intrusion groups who carry out these disruptive cyberattacks. “These actions are personal and are meant to signal to anyone working for these programs that they won’t be able to leave Russia anytime soon,” he said.

But Hultquist warned that the hackers likely retain access to these networks. “Notably, we have never seen this actor actually carry out disruptive attacks, just burrow into sensitive critical infrastructure for some future contingency,” he told TechCrunch. “Our concern with recent events is that this might be the contingency we have been waiting for.” 

Casey Brooks, a senior adversary hunter at Dragos, which calls the group behind the Triton malware “Xenotime,” told TechCrunch that the indictments are unlikely to deter the hackers.

“These activity groups are well-resourced and can conduct continuous complex operations. While the indictments detail some of these groups’ intrusion activity, their breadth is much greater,” said Brooks. “For example, we know that for Xenotime this is only a fraction of their overall activity. It’s essential to realize that these groups are still active and the indictments will probably do little to deter these adversary groups’ future operations.”

The unsealing of the indictments came three days after President Joe Biden warned of a growing Russian cyber threat against U.S. businesses in response to Western sanctions on Russia for its invasion of Ukraine. It also comes just days after the DOJ indicted six hackers working in the service of Russia’s military intelligence agency, the GRU. The hackers, known as Sandworm, are accused of a five-year spree of attacks, including the destructive NotPetya cyberattack that targeted hundreds of firms and hospitals worldwide in 2017 and a cyberattack that took down the Ukraine power grid.

Share. Facebook Twitter Pinterest LinkedIn Tumblr Email
Michael Christopher

Related Posts

The man who built his own ISP to avoid huge fees is expanding his service

August 11, 2022

Medical simulation platform FundamentalVR raises $20M to help surgeons learn through VR – TechCrunch

August 11, 2022

Ethereum's third and final proof-of-stake test merge goes live on the Goerli test network, a dress rehearsal for the eventual mainnet merge planned in September (Vishal Chawla/The Block)

August 11, 2022
Add A Comment

Leave A Reply Cancel Reply

We are social
  • Facebook
  • Twitter
  • Pinterest
  • Instagram
  • YouTube
  • Vimeo
Highlights
Business

Sovos Brands 8.5M share secondary priced at $14.00

By Michael ChristopherAugust 11, 20220

Sovos Brands 8.5M share secondary priced at $14.00

The man who built his own ISP to avoid huge fees is expanding his service

August 11, 2022

Blackstone agrees to acquire majority stake in CoreTrust

August 11, 2022

Pariah Solidarity Between Myanmar & Russia — Global Issues

August 11, 2022

Subscribe to Updates

Get the latest creative news from newspluck.

Categories
  • Business (9,722)
  • Health (768)
  • Politics (6,653)
  • Science (1,267)
  • Sports (6,136)
  • Tech (8,106)
  • Travel (207)
  • World (7,818)

https://t.ly/LZ9H

 

https://bit.ly/3Qu8z4K

 

https://rb.gy/b3yxgn

 

https://tinyurl.com/2p99krhh

 

https://tinyurl.com/2p99krhh

 

https://www.libeluladorada.com/profile/henri/profile

Categories
  • Business (9,722)
  • Health (768)
  • Politics (6,653)
  • Science (1,267)
  • Sports (6,136)
  • Tech (8,106)
  • Travel (207)
  • World (7,818)

Subscribe to Updates

Get the latest creative news from newspluck.

Latest Posts

Sovos Brands 8.5M share secondary priced at $14.00

August 11, 2022

The man who built his own ISP to avoid huge fees is expanding his service

August 11, 2022

Blackstone agrees to acquire majority stake in CoreTrust

August 11, 2022
Facebook Twitter Instagram Pinterest Vimeo YouTube
  • Home
  • About us
  • contact us
  • Privacy policy
  • Terms and conditions
© 2022 Designed by newspluck

Type above and press Enter to search. Press Esc to cancel.