Security News > 2021 > April > US warns of Russian state hackers still targeting US, foreign orgs

The FBI, the US Department of Homeland Security, and the Cybersecurity and Infrastructure Security Agency warned today of continued attacks coordinated by the Russian Foreign Intelligence Service against US and foreign organizations.

With access to the administrative account, the actors modified permissions of specific e-mail accounts on the network, allowing any authenticated network user to read those accounts.

Leveraging Zero-Day Vulnerability: In a separate incident, SVR actors used CVE-2019-19781, a zero-day exploit at the time, against a virtual private network appliance to obtain network access.

These intrusions, which mostly relied on targeting on-premises network resources, were a departure from historic tradecraft, and likely indicate new ways the actors are evolving in the virtual environment.

Tradecraft Similarities of SolarWinds-enabled Intrusions: During the spring and summer of 2020, using modified SolarWinds network monitoring software as an initial intrusion vector, SVR cyber operators began to expand their access to numerous networks.

Today's security advisory complements a previous one published on April 15th, sharing info on vulnerabilities exploited by the Russian-backed APT29 hacking group to breach national security and government-related networks in the US and worldwide.

News URL

https://www.bleepingcomputer.com/news/security/us-warns-of-russian-state-hackers-still-targeting-us-foreign-orgs/