Russia’s GRU Exploits Energy Sector with Targeted Hacks on Unsecured Network Edge Devices

Key Takeaways:

• Prominent Russian government hackers have shifted their tactics from exploiting novel vulnerabilities to targeting misconfigured network edge devices.
• The hacking group, known as APT44 or Sandworm, has been tied to Russia’s Main Intelligence Directorate (GRU) and has targeted Western critical infrastructure, particularly the energy sector.
• Amazon researchers detected the campaign through its network of honeypots and found that the hackers compromised customer network edge devices hosted on AWS, stole credentials, and established persistent access.
• The campaign represents a significant evolution in critical infrastructure targeting, with a tactical pivot towards exploiting misconfigured devices rather than vulnerabilities.
• The shift in tactics is likely due to the increased effectiveness of security programs, which have made traditional exploitation more expensive and risky.

Introduction to the Threat
The cybersecurity landscape is constantly evolving, with threat actors adapting their tactics to evade detection and exploit vulnerabilities. A recent report by Amazon security researchers has shed light on a significant shift in the tactics employed by a prominent Russian government hacking group, known as APT44 or Sandworm. The group, which has been tied to Russia’s Main Intelligence Directorate (GRU), has been targeting Western critical infrastructure, particularly the energy sector. According to CJ Moses, CISO of Amazon Integrated Security, the number of victim organizations is more than 10, and the attacks have been ongoing since 2021.

The Shift in Tactics
The hacking group has shifted its focus from exploiting novel vulnerabilities to targeting misconfigured network edge devices. This tactical pivot is significant, as it represents a change in the way the group is attempting to gain access to critical infrastructure networks. According to Amazon researchers, the group is now compromising customer network edge devices hosted on AWS, stealing credentials, and establishing persistent access. This allows the group to move laterally within the network, potentially gaining access to sensitive information and systems. The campaign has been detected through Amazon’s network of honeypots, known as Amazon MadPot, which has provided valuable insights into the group’s tactics and techniques.

The Evolution of Critical Infrastructure Targeting
The campaign represents a significant evolution in critical infrastructure targeting, with a tactical pivot towards exploiting misconfigured devices rather than vulnerabilities. This shift is likely due to the increased effectiveness of security programs, which have made traditional exploitation more expensive and risky. According to Aaron Beardslee, a security expert at Securonix, security teams have gotten dramatically better at vulnerability management, and patch cycles have compressed from months to weeks. Additionally, cyber protection platforms now catch exploitation artifacts reliably, making it more difficult for threat actors to exploit vulnerabilities. As a result, sophisticated actors have pivoted to the path of least resistance, targeting misconfigured devices instead.

The Impact of the Campaign
The campaign has had a significant impact on the energy sector, with multiple organizations affected. Amazon researchers have found that the hackers accessed endpoints for multiple sectors, including electric utility organizations, energy providers, and managed security service providers specializing in energy sector clients. The campaign has also involved attacks targeting telecom providers and technology companies. Amazon has notified affected customers and shared its findings with industry partners and affected vendors. The company has also emphasized the importance of proper configuration and security controls to prevent similar attacks in the future.

The Wider Cultural Shift
The shift in tactics employed by the hacking group is representative of a wider cultural shift within the cybersecurity industry. According to Beardslee, the industry has gotten better at vulnerability management, and threat intelligence sharing has made exploits have shorter useful life spans before defenders adapt. As a result, traditional exploitation now requires more resources, carries higher detection risk, and yields diminishing returns. Sophisticated actors have adapted to this new landscape, pivoting to the path of least resistance. The problem is that configuration security has been treated as operational housekeeping instead of a critical security control, and that needs to change immediately.

Conclusion
In conclusion, the campaign detected by Amazon researchers highlights the evolving nature of cyber threats and the importance of adapting to new tactics and techniques. The shift in tactics employed by the hacking group is a significant development, and it is essential for organizations to prioritize configuration security and implement proper security controls to prevent similar attacks. The cybersecurity industry must continue to evolve and adapt to the changing threat landscape, and it is crucial for organizations to stay vigilant and proactive in their security efforts. By doing so, we can reduce the risk of cyber attacks and protect critical infrastructure from sophisticated threat actors.