03-27-2021 , 03:40 AM
https://www.bleepingcomputer.com/news/se...e-hackers/ German Parliament targeted again by Russian state hackers
By Sergiu Gatlan
March 26, 2021 03:14 PM Email accounts of multiple German Parliament members were targeted in a spearphishing attack. It is not yet known if any data was stolen during the incident.
The attack was carried out by sending phishing emails sent to the German politicians' private emails, as Der Spiegel reported on Friday.
It is believed that the attackers were able to gain access to the email accounts of seven members of the German federal parliament (Bundestag) and 31 members of German regional parliaments. Most parliament members targeted in this attack are part of the CDU/CSU and SPD governing parties.
A Bundestag spokesperson said that the attackers didn't target the Bundestag's network. After the attack was detected, all targeted parliament members were immediately notified.
Russian state hackers likely behind attack
German security authorities suspect that a Russian military intelligence hacking group dubbed Ghostwriter was behind the attack.
According to cybersecurity firm FireEye, Ghostwriter has been running "information operations" pushing narratives aligned with Russian security interests since March 2017.
The hacking group has used fabricated personas posing as journalists and analysts to target Lithuanian, Latvian, and Polish audiences with anti-North Atlantic Treaty Organization (NATO) narratives disseminated using compromised websites and spoofed email accounts.
"The Ghostwriter campaign leverages traditional cyber threat activity and information operations tactics to promote narratives intended to chip away at NATO's cohesion and undermine local support for the organization in Lithuania, Latvia, and Poland," FireEye said.
APT28 members sanctioned for a similar attack
The Council of the European Union sanctioned multiple members of the Russian state-backed APT28 hacking group in October 2020 for their involvement in the hacking of several Bundestag members' email accounts in 2015.
In August 2020, Norway disclosed a strikingly similar attack which also led to the breach of several email accounts belonging to Norwegian Parliament representatives and employees.
Norway's Minister of Foreign Affairs Ine Eriksen Søreide later revealed that the August attack was coordinated by Russian state hackers who stole information from each of the hacked accounts. The Norwegian Police Security Service said that the APT28 was likely behind the intrusion.
Russian-sponsored state hackers were also linked to an attack targeting the Ukrainian government by the National Security and Defense Council of Ukraine (NSDC).
The NCSC said that the attackers attempted to breach state agencies after compromising the government's document management system.
US Cyber Command also shared info on malware implants used by Russian state hackers in attacks targeting national parliaments, ministries of foreign affairs, and embassies.
By Sergiu Gatlan
March 26, 2021 03:14 PM Email accounts of multiple German Parliament members were targeted in a spearphishing attack. It is not yet known if any data was stolen during the incident.
The attack was carried out by sending phishing emails sent to the German politicians' private emails, as Der Spiegel reported on Friday.
It is believed that the attackers were able to gain access to the email accounts of seven members of the German federal parliament (Bundestag) and 31 members of German regional parliaments. Most parliament members targeted in this attack are part of the CDU/CSU and SPD governing parties.
A Bundestag spokesperson said that the attackers didn't target the Bundestag's network. After the attack was detected, all targeted parliament members were immediately notified.
Russian state hackers likely behind attack
German security authorities suspect that a Russian military intelligence hacking group dubbed Ghostwriter was behind the attack.
According to cybersecurity firm FireEye, Ghostwriter has been running "information operations" pushing narratives aligned with Russian security interests since March 2017.
The hacking group has used fabricated personas posing as journalists and analysts to target Lithuanian, Latvian, and Polish audiences with anti-North Atlantic Treaty Organization (NATO) narratives disseminated using compromised websites and spoofed email accounts.
"The Ghostwriter campaign leverages traditional cyber threat activity and information operations tactics to promote narratives intended to chip away at NATO's cohesion and undermine local support for the organization in Lithuania, Latvia, and Poland," FireEye said.
APT28 members sanctioned for a similar attack
The Council of the European Union sanctioned multiple members of the Russian state-backed APT28 hacking group in October 2020 for their involvement in the hacking of several Bundestag members' email accounts in 2015.
In August 2020, Norway disclosed a strikingly similar attack which also led to the breach of several email accounts belonging to Norwegian Parliament representatives and employees.
Norway's Minister of Foreign Affairs Ine Eriksen Søreide later revealed that the August attack was coordinated by Russian state hackers who stole information from each of the hacked accounts. The Norwegian Police Security Service said that the APT28 was likely behind the intrusion.
Russian-sponsored state hackers were also linked to an attack targeting the Ukrainian government by the National Security and Defense Council of Ukraine (NSDC).
The NCSC said that the attackers attempted to breach state agencies after compromising the government's document management system.
US Cyber Command also shared info on malware implants used by Russian state hackers in attacks targeting national parliaments, ministries of foreign affairs, and embassies.