Security News > 2022 > February > U.S. Says Russian Hackers Stealing Sensitive Data from Defense Contractors

State-sponsored actors backed by the Russian government regularly targeted the networks of several U.S. cleared defense contractors to acquire proprietary documents and other confidential information pertaining to the country's defense and intelligence programs and capabilities.

Compromised entities include contractors that dabble in command, control, communications, and combat systems; surveillance and reconnaissance; weapons and missile development; vehicle and aircraft design; and software development, data analytics, and logistics.

The threat actors rely on "Common but effective" tactics to breach target networks such as spear-phishing, credential harvesting, brute-force attacks, password spray techniques, and exploitation of known vulnerabilities in VPN devices, before moving laterally to establish persistence and exfiltrate data.

CVE-2018-13379 - Path traversal vulnerability in Fortinet's FortiGate SSL VPN. CVE-2020-0688 - Microsoft Exchange validation key remote code execution vulnerability.

The advisory does not single out any Russian state actor by name.

"Over the last several years, Russian state-sponsored cyber actors have been persistent in targeting U.S. cleared defense contractors to get at sensitive information," said Rob Joyce, director of NSA Cybersecurity.

News URL

https://thehackernews.com/2022/02/us-says-russian-hackers-stealing.html