Fancy Bear Is Trying to Brute-Force Hundreds of Networks
The discovery of Russia’s devastating SolarWinds spy campaign put the spotlight on the sophisticated supply chain hijacking techniques of Moscow’s foreign intelligence hackers. But it’s now apparent that, throughout that SolarWinds spying and its fallout, another group of Kremlin hackers has kept up up their usual daily grind, using basic but often effective techniques to pry open practically any vulnerable network they could find across the US and the global internet.
On Thursday the NSA, the FBI, the DHS’s Cybersecurity and Infrastructure Security Agency, and the UK’s National Cybersecurity Centre issued a joint advisory warning of hundreds of attempted brute-force hacker intrusions around the world, all carried out by Unit 26165 of Russia’s GRU military intelligence agency, also widely known as Fancy Bear or APT28. The hacking campaign has targeted a broad swath of organizations, including government and military agencies, defense contractors, political parties and consultancies, logistics companies, energy firms, universities, law firms, and media companies. In other words, practically every sector of interest on the internet.
The hacking campaign has used relatively basic techniques against those targets, guessing usernames and passwords en masse to gain initial access. But cybersecurity agencies warn that the Fancy Bear campaign has nonetheless successfully breached multiple entities and exfiltrated emails from them—and that it’s not over. “This lengthy brute force campaign to collect and exfiltrate data, access credentials and more, is likely ongoing, on a global scale,” the NSA’s director of cybersecurity Rob Joyce wrote in a statement accompanying the advisory.
The GRU’s Unit 26165, more than the SVR intelligence agency spies who carried out the SolarWinds campaign, have a history of highly disruptive hacking. Fancy Bear was behind the hack-and-leak operations that have targeted everyone from the Democratic National Committee and Clinton Campaign in 2016 to the Olympic International Organization Committee and the Worldwide Anti-Doping Agency. But there’s not yet any reason to believe that this latest effort’s intentions go beyond traditional espionage, says John Hultquist, vice president at security firm Mandiant and a longtime GRU tracker.
“These intrusions don’t necessarily presage the shenanigans that we think of when we think of the GRU,” says Hultquist. But that doesn’t mean that the hacking campaign isn’t significant. He sees the joint advisory, which names IP addresses and malware used by the hackers, as an attempt to add “friction” to a successful intrusion operation. “It’s a good reminder that GRU is still out there, carrying out this kind of activity, and it appears to be focused on more classic espionage targets like policymakers, diplomats, and the defense industry.”
The inclusion of energy sector targets in that hacking campaign raises an extra red flag, especially given that another GRU hacking team, Sandworm, remains the only hackers ever to trigger actual blackouts, sabotaging Ukrainian electric utilities in 2015 and 2016. The Department of Energy separately warned in early 2020 that hackers had targeted a US “energy entity” just before Christmas in 2019. That advisory included IP addresses that were later matched with GRU Unit 26165, as first reported by WIRED last year. “I’m always concerned when I see GRU in the energy space,” says Hultquist. Even so, he still sees simple espionage as a likely motivation. “It’s important to remember Russia is a petro state. They have a massive interest in the energy sector. That’s going to be part of their intelligence collection requirements.”
The GRU’s brute-force hacking may be “opportunistic” rather than targeted, argues Joe Slowik, who leads intelligence at security firm Gigamon and first spotted the connection between the Department of Energy alert and the GRU. He posits that the team may simply be gaining access to any network it can find before passing off that access to other Kremlin hackers with more specific missions, like espionage or disruption. “They’re tasked with ‘go forth and get us points of access in organizations of interest,'” says Slowik. “Then they sit on it or pass it on to parties who take care of more-involved intrusions, based on whatever access they’re able to turn up.”