British intelligence agencies have stated that Russia tried to hack security cameras on EU borders, stole passwords and conducted cyberattacks to disrupt the flow of Western aid to Ukraine. This is reported by The Guardian, reports UNN.
Details
British intelligence found that the unit of the Russian Federation 26165 gained access to cameras near crossings, military facilities and railway stations in key locations through which Western weapons are supplied to Ukraine.
Spies used a range of methods to attack organizations providing "foreign aid" by hacking CCTV and security cameras.
In addition, this unit of the Russian Federation was accused of sending phishing emails containing pornography and fake professional information, as well as stealing account passwords to penetrate systems.
It is known that the Russian special forces unit, also known as APT 28 and Fancy Bear, conducted a malicious cyber campaign against public and private organizations in NATO countries since 2022.
In its advisory note, the UK National Cyber Security Centre (NCSC), which is part of the Government Communications Centre, called on private companies involved in providing assistance to "take immediate action to protect themselves".
In addition to attacks on logistics companies, members of unit 26165 likely used access to private cameras in key locations, such as border crossings, military facilities and railway stations, to track the movement of materials to Ukraine. They also used legitimate municipal services, such as road cameras
British intelligence found that nearly 10,000 cameras were installed near military facilities and railway stations to track the movement of materials to Ukraine, of which 80% were located in Ukraine and 10% in Romania.
It is alleged that 4% of the cameras targeted were located in Poland, 2.8% in Hungary and 1.7% in Slovakia. The location of the remaining cameras is not specified. According to sources, the hacking would have provided access to "instant capture" images from the cameras.
Russian spies also tried to use other attempts to collect confidential information about cargo, including tracking train and other transport schedules.
In at least one case, the attackers attempted to use voice phishing to gain access to privileged accounts by posing as IT personnel
The subject of phishing emails was diverse and ranged from professional to adult topics. Phishing emails were often sent through compromised accounts or free webmail accounts. Emails were usually written in the victim's native language and sent to a single target recipient.
This malicious campaign by Russian military intelligence poses a serious threat to the organizations it targets. In particular, those involved in providing assistance to Ukraine. The UK and its partners are committed to raising awareness of the tactics used. We strongly encourage organizations to review the threat and mitigation advice contained in the guidance to help protect their networks
Proposed actions include increased monitoring, the use of multi-factor authentication with strong factors such as access keys, and ensuring timely application of security updates to manage vulnerabilities.
The advisory documentation was developed jointly with agencies from the United States, Germany, the Czech Republic, Poland, Australia, Canada, Denmark, Estonia, France and the Netherlands.
Addition
The Russian unit of the Russian Federation 26165 was previously accused of leaking data from the World Anti-Doping Agency, and also played a key role in the cyberattack on the US Democratic National Committee in 2016.
Recall
On the eve of the United Kingdom, the United States, France, Germany and a number of other NATO countries issued a joint warning about the increase in Russian cyber activity targeting organizations that provide support to Ukraine.