The Australian Signals Directorate says Russian cyberattacks on public and private organisations are on the rise. Photo: Juice Flair.
Russian hackers are attacking key industries in Australia, trying to break into the systems of financial services, health care, energy, communications, government facilities and defence, according to a new Australian Signals Directorate (ASD) advisory.
Australia is not alone, however, with the rare advisory being issued jointly with two dozen international intelligence partners, including from the United States, United Kingdom, New Zealand, France, Canada, Sweden, Finland, Denmark, Poland, Italy, the Czech Republic and Estonia.
ASD has warned that hacking attempts from operatives linked to Russia’s Federal Security Service (FSB) are on the rise and targeting vulnerable network devices across sectors.
FSB cyberattack groups are also known by other names, including Ghost Blizzard, Berserk Bear, Crouching Yeti, Static Tundra and Dragonfly.
Poorly configured routers, outdated software, default passwords, and outdated devices are all being exploited in attempts to steal login credentials and other valuable information.
While many attempts fail, the sheer rise in their numbers indicates breaches are occurring, and the likelihood of even more successful hacks is growing.
“Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compromising multiple critical infrastructure sector networks,” the statement says.
“This joint Cybersecurity Advisory builds on FBI’s Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure Public Service Announcement of the decade-plus FSB Center 16 cyber activity by providing additional tactics, techniques, and procedures to enable defenders to more fully understand and counter the threat.
“The authoring and co-sealing agencies strongly urge device owners and network defenders to take mitigation and remediation actions against Russian government-sponsored exploitation of vulnerable routers.”
ASD says government and private-sector organisations need to ensure that software and hardware are updated and that passwords are robust and securely stored to counter hackers.
“They look for exposed management services, weak security settings and known vulnerabilities,” ASD said.
“They use these weaknesses to steal network information and user credentials.
“Cyber actors can use this information to carry out further malicious activity.”
The advisory provides a long list of technical guidance on which software and protocols to use.
Legacy protocols should no longer be needed or used on current devices, the advisory states.
It also recommends specific, high-level monitoring activities that should be implemented in order to stamp out successful incursions.
Australia’s national cyber security coordinator, Lieutenant General Michelle McGuinness, explained the development through a social media post.
“Australia joined Five Eyes and European partners in releasing a technical advisory highlighting the ongoing exploitation of vulnerable and poorly configured networking devices,” she said.
“The advisory encourages device owners and network defenders to review router configurations, reduce exposed management services, strengthen authentication practices, and prioritise remediation of vulnerable internet-facing devices.”
Russia always denies responsibility for any malicious cyberattacks in Australia or elsewhere in the world.
NATO issued its own condemnation of Russian hackers just a day before the joint international advisory.
“We strongly condemn Russia’s persistent malicious cyber activities, leveraging its cyber ecosystem to target Allies and NATO partners,” its statement said.
“These activities constitute a threat to allied security.
“We stand in unity and solidarity with all Allies affected by Russia’s malicious cyber activities targeting critical national infrastructure and government entities.
“In this context, we take note of the statements by the UK and the EU denouncing these activities and Russia’s links to cyber criminals, as well as the sanctions imposed on individuals and entities that aid and abet Russia’s malicious cyber activities.
“We call on Russia to stop these destabilising activities, which disregard agreed international norms of responsible state behaviour in cyberspace.”
Original Article published by Chris Johnson on Region Canberra.
