Security News > 2023 > October > France says Russian state hackers breached numerous critical networks
The Russian APT28 hacking group has been targeting government entities, businesses, universities, research institutes, and think tanks in France since the second half of 2021.
The Russian hackers have been compromising peripheral devices on critical networks of French organizations and moving away from utilizing backdoors to evade detection.
ANSSI has mapped the TTPs of APT28, reporting that the threat group uses brute-forcing and leaked databases containing credentials to breach accounts and Ubiquiti routers on targeted networks.
ANSSI has observed the threat actors retrieving authentication information using native utilities and stealing emails containing sensitive information and correspondence.
Finally, ANSSI has seen evidence that the attackers collect data using the CredoMap implant, which targets information stored in the victim's web browser, such as authentication cookies.
Lazarus hackers breach aerospace firm with new LightlessCan malware.
News URL
Related news
- Hackers target new MOVEit Transfer critical auth bypass bug (source)
- U.S. indicts Russian GRU hacker, offers $10 million reward (source)
- TeamViewer links corporate cyberattack to Russian state hackers (source)
- Hackers exploit critical D-Link DIR-859 router flaw to steal passwords (source)
- CloudSorcerer hackers abuse cloud services to steal Russian govt data (source)
- Critical Cisco bug lets hackers add root users on SEG devices (source)
- Two Russians sanctioned over cyberattacks on US critical infrastructure (source)