Therefore, their tactics tend to be ‘noisier’ than their Chinese counterparts. “The Russian approach, meanwhile, has a much more short-term focus and is more concerned with gathering and exploiting data right now. Vince Warrington, CEO of infosec firm Dark Intelligence, added that “Chinese state-backed attacks tend to be concerned with long-term intelligence gathering, so they tend to be slow moving, methodical, and with the aim of being able to infiltrate an organisation and extract data over the long term – think years instead of days or months. “This adoption of a new technique could indicate a willingness to emulate the practices of other actors.” Indeed, technology supply chain campaigns are more typical of their Chinese counterparts. Paul Prudhomme, head of threat intelligence advisory at IntSights, explained: “Russian cyber espionage groups have not historically used such attack vectors on any significant scale. SOLARWINDS ATTACK Hackers could have launched supply chain attack months earlier than previously thought The recent SolarWinds campaign that drew so much attention to the threat of Russian cyber espionage was actually atypical for Russian actors in its use of a technology supply chain access vector, according to some threat intel experts. In comparison, very few other state-associated APT groups – probably only those linked to the People's Republic of China – have conducted supply chain attacks of similar scale,” Peh added. “This large-scale intrusion and the multiple techniques used to obfuscate their activity are testament to the technical prowess of these groups. “They have used techniques that enable them to remain undetected for long periods of time, such as in the supply chain attack leveraging SolarWinds’ Orion Platform (which likely began as early as Spring 2020 but was only made known publicly in December 2020).
Xueyin Peh, senior cyber threat intelligence analyst at Digital Shadows, told The Daily Swig: “Russia-linked APT groups are arguably some of the most technically advanced state-sponsored threat groups.
Russian state-sponsored actors typically have more sophisticated tactics, techniques, and procedures (TTPs) alongside custom malware development capabilities and tighter operational security when compared to other groups. What are the techniques and tactics of Russian threat actors? State-sponsored Russian cyber espionage groups are among the most sophisticated of the nation-state threat actors, with an added flair for deception that makes them the canniest of adversaries.Įxperts quizzed by The Daily Swig said that Russian cyber-threat actors are among the best in the world, on a par with the top groups operating out of China, and with similar capabilities to western intelligence agencies – especially those with close links to the Federal Security Service (FSB) or military. Unpacking the Matryoshka dolls behind Kremlin-backed cybercrime campaigns
0 kommentar(er)
