Intelligence and cybersecurity agencies from 10 countries has warned in a joint advisory that a cyberespionage group operated by the Russian military intelligence service, the GRU, has been targeting logistics and IT companies for the past three years. Known in the security industry as APT28 and Fancy Bear, the threat actor has been launching attacks against these targets using a variety of initial access tactics including password spraying, spearphishing and exploitation of vulnerabilities in popular software.
“As Russian military forces failed to meet their military objectives and Western countries provided aid to support Ukraine’s territorial defense, unit 26165 [of the Russian GRU 85th GTsSS] expanded its targeting of logistics entities and technology companies involved in the delivery of aid,” the advisory read. “These actors have also targeted Internet-connected cameras at Ukrainian border crossings to monitor and track aid shipments.”
The targets included dozens of government organizations and commercial entities involved in goods transportation on air, sea and rail. This included defense industry companies, shipping and logistics companies, air traffic management agencies and IT services firms. The countries targeted were Bulgaria, the Czech Republic, France, Germany, Greece, Italy, Moldova, the Netherlands, Poland, Romania, Slovakia, Ukraine and the US.
