Russia Released a Ukrainian App For Hacking Russia That Was Actually Malware (vice.com) 19
Russian government hackers tried to trick Ukrainian and international volunteers into using a malicious Android app disguised as an app to launch Distributed Denial of Service (DDoS) attacks against Russian sites, according to new research published by Google on Tuesday. Motherboard reports: Since the beginning of the Russian invasion, Ukraine has resisted not only on the ground, but also online. A loose collective of technologists and hackers has organized under an umbrella quasi-hacktivist organization called the IT Army, and they have launched constant and persistent cyberattacks against Russian websites. The Russian government tried to turn this volunteer effort around to unmask Ukrainian hackers, in a smart, but ultimately failed attempt.
Google researchers wrote in the report that the app was created by the hacking group known as Turla, which several cybersecurity companies believe works for the Kremlin. [Shane Huntley, the head of the Google research team Threat Analysis Group] said that they were able to attribute this operation to Turla because they have tracked the group for a long time and have good visibility into their infrastructure and link it to this app. The hackers pretended to be a "community of free people around the world who are fighting russia's aggression" -- much like the IT Army. But the app they developed was actually malware. The hackers called it CyberAzov, in reference to the Azov Regiment or Battalion, a far-right group that has become part of Ukraine's national guard. To add more credibility to the ruse they hosted the app on a domain "spoofing" the Azov Regiment: cyberazov[.]com.
The app actually didn't DDoS anything, but was designed to map out and figure out who would want to use such an app to attack Russian websites, according to Huntely. "Now that they have an app that they control, and they see where it came from, they can actually work out what the infrastructure looks like, and work out where the people that are potentially doing these sorts of attacks are," Huntley said. Google said the fake app wasn't hosted on the Play Store, and that the number of installs "was miniscule." Still, it was a smart attempt to trick unknowing Ukrainians or people interested in working with Ukrainians to fall into the trap.
Google researchers wrote in the report that the app was created by the hacking group known as Turla, which several cybersecurity companies believe works for the Kremlin. [Shane Huntley, the head of the Google research team Threat Analysis Group] said that they were able to attribute this operation to Turla because they have tracked the group for a long time and have good visibility into their infrastructure and link it to this app. The hackers pretended to be a "community of free people around the world who are fighting russia's aggression" -- much like the IT Army. But the app they developed was actually malware. The hackers called it CyberAzov, in reference to the Azov Regiment or Battalion, a far-right group that has become part of Ukraine's national guard. To add more credibility to the ruse they hosted the app on a domain "spoofing" the Azov Regiment: cyberazov[.]com.
The app actually didn't DDoS anything, but was designed to map out and figure out who would want to use such an app to attack Russian websites, according to Huntely. "Now that they have an app that they control, and they see where it came from, they can actually work out what the infrastructure looks like, and work out where the people that are potentially doing these sorts of attacks are," Huntley said. Google said the fake app wasn't hosted on the Play Store, and that the number of installs "was miniscule." Still, it was a smart attempt to trick unknowing Ukrainians or people interested in working with Ukrainians to fall into the trap.
Re: (Score:1)
It's time, money, and stuff that you probably shouldn't touch with a 10-foot pole unless some 3-letter agency is paying you.
If your idea of hacktivism is running some wannabe LOIC from an unverified download source, you're a liability in any cyber fight because you're totally incompetent. I wouldn't take that to mean that competent people are in any serious danger. Russia sucks and anyone who puts in genuine effort has my admiration.
Yeah it depends (Score:3)
Agreed. I have a lab specifically designed to run malware.
I'm not the least bit concerned that Russia is going to get my location.
I AM concerned about them bombing random neighborhoods.
If I have to re-image a VM and while they are busy handling what I'm doing, that's three less Russians blowing kids' legs off, that's a win. I'll trade VMs for legs all day long.
Have to do something (Score:4, Funny)
to counter all those mutant troops created in secret biolabs [yahoo.com] in Ukraine.
Re: (Score:3)
Well, that's cute Yahoo, take the babblings of two known nutcases and pretend that's the official Russian position. May as well pretend Marjorie Taylor Green and Lauren Bobert are representatives of the official US position when they blab about child abuse rings in the basement of Ping Pong Pizza.
Re: (Score:2)
Well, as grandpa Litvak used to say (Score:2)
IT had to happen. (Score:1)
No problem (Score:2)
I ran it on hacked russian phones!
Law Enforcement Malware (Score:2)
This is what Russia gets for fining Google $37 mil (Score:2)
Putin gets his sneaky plans blown out of the water, much like his warships
DRAT, FOILED AGAIN !!