Russian Hacker Breaches Companies, Sells Their Access and Spies on Ukrainian Military Sites

The Russian-speaking hacker has been associated with a large-scale operation that has targeted organizations around the world from education, healthcare, financial services, telecommunications, government bodies, and others with internet-facing systems. Russian Hackers Attacked Companies They carefully crafted exploits for at least a dozen vulnerabilities affecting a variety of popular technologies, including Fortinet, F5, SonicWall, Sophos, Citrix, SAP, Roundcube, vBulletin, Hikvision and others. There was an overlap of tunnels and infrastructure between the criminal and espionage activities and they used similar tools.

When a domain compromise is suspected, defenders should reset the krbtgt account twice with a full replication interval, disable RC4-HMAC encryption and investigate abnormally long Kerberos tickets.

Camera operators are required to: - Change default password. - Upgrade firmware - Disable public internet access to cameras - Do not position devices to expose sensitive operations Indicators of Compromise (IoCs) Type Indicator Description 46.8.236 IPv4 Value of operator VPS provided in source IPv4:Port 129.146.8 Value provided in source supplied IPv4:Port 107.189.1 Operator jumpbox. Value in supplied source IPv4 185.217.9 Chisel reverse SOCKS endpoint.

File Transfer Service value rendered in the supplied source SHA-256 b2d46bfc2612593ac4 Sliver Linux implant hash value rendered in the supplied source SHA-256 16f83f056db777a3ff Vulnerable signed driver bundled with credential dumper, value rendered in the supplied source Enhance Resistance to Malware & Phishing ANY – Power SOC – Look into IoCs in a secure environment.RUN