Narional: Code deployed in US cyber-attack linked to suspected Russian hackers | Andrew Roth/The Guardian
A Moscow-based cybersecurity company has reported that some of the malicious code employed against the US government in a cyber-attack last month overlaps with code previously used by suspected Russian hackers. The findings by Kaspersky investigators may provide the first public evidence to support accusations from Washington that Moscow was behind the biggest cyber-raid against the government in years, affecting 18,000 users of software produced by SolarWinds, including US government agencies. However, investigators from Kaspersky have cautioned that the code similarities do not confirm that the same group is behind both attacks. According to findings, published by the investigators Georgy Kucherin, Igor Kuznetsov, and Costin Raiu, a “backdoor” called Sunburst used to communicate with a server controlled by the hackers resembled another hacking tool called Kazuar, which had previously been attributed to the Turla APT (advanced persistent threat) group. Attacks by Turla have been documented from at least 2008, when the group was believed to have infiltrated US Central Command. Later, Turla was implicated in attacks on embassies in a number of countries, ministries, utilities, healthcare providers, and other targets. Several cybersecurity companies have said they believe the hacking team is Russian, and an Estonian intelligence report from 2018 says the group is “tied to the federal security service, FSB”. US intelligence agencies last week released a joint statement accusing Moscow of launching the attack, which they said was “ongoing” more than a month after being made public. Moscow has denied responsibility for the attack.
Full Article: Code deployed in US cyber-attack linked to suspected Russian hackers | Espionage | The Guardian
