The Hacker News Logo
Subscribe to Newsletter
CrowdSec

The Hacker News - Cybersecurity News and Analysis: APT28

Microsoft Obtains Court Order to Take Down Domains Used to Target Ukraine

Microsoft Obtains Court Order to Take Down Domains Used to Target Ukraine

April 08, 2022Ravie Lakshmanan
Microsoft on Thursday disclosed that it obtained a court order to take control of seven domains used by APT28, a state-sponsored group operated by Russia's military intelligence service, with the goal of neutralizing its attacks on Ukraine. "We have since re-directed these domains to a sinkhole controlled by Microsoft, enabling us to mitigate Strontium's current use of these domains and enable victim notifications," Tom Burt, Microsoft's corporate vice president of customer security and trust,  said . APT28, also known by the names Sofacy, Sednit, Pawn Storm, Fancy Bear, Iron Twilight, and Strontium, is a  cyber espionage group  and an advanced persistent threat that's known to be active since 2009, striking media, governments, military, and international non-governmental organizations (NGOs) that often have a security focus. The tech giant noted that the sinkholed infrastructure was used by the threat actor to target Ukrainian institutions as well as gov
Russian APT28 Hackers Using COVID-19 as Bait to Deliver Zebrocy Malware

Russian APT28 Hackers Using COVID-19 as Bait to Deliver Zebrocy Malware

December 09, 2020Ravie Lakshmanan
A Russian threat actor known for its malware campaigns has reappeared in the threat landscape with yet another attack leveraging COVID-19 as phishing lures, once again indicating how adversaries are adept at repurposing the current world events to their advantage. Linking the operation to a sub-group of APT28 (aka Sofacy, Sednit, Fancy Bear, or STRONTIUM), cybersecurity firm Intezer said the pandemic-themed phishing emails were employed to deliver the Go version of Zebrocy (or Zekapab) malware. The cybersecurity firm told The Hacker News that the campaigns were observed late last month. Zebrocy is delivered primarily via phishing attacks that contain decoy Microsoft Office documents with macros as well as executable file attachments. First spotted in the wild in 2015 , the operators behind the malware have been found to overlap with GreyEnergy , a threat group believed to be the successor of BlackEnergy aka Sandworm , suggesting its role as a sub-group with links to Sofacy and
Online Courses and Software

Sign up for cybersecurity newsletter and get latest news updates delivered straight to your inbox daily.