Microsoft Warns Russia May Plan More Ransomware Attacks Beyond Ukraine (bloomberg.com) 27
Microsoft warned an infamous hacking group that is tied to Russia's military intelligence agency GRU could be gearing up for more ransomware attacks both inside and outside of Ukraine. From a report: Microsoft calls the group Iridium, but it is perhaps best known as Sandworm. It has been accused of attacks on Ukraine's electric power grid and government agencies, the 2018 Winter Olympics and businesses across the globe. Now, it appears to be preparing for a renewed destructive campaign, the software company said in a threat intelligence report on Wednesday. Russian hackers have been accused of bombarding Ukrainian institutions with "wiper malware" and DDoS attacks, a campaign that began even before President Vladimir Putin ordered troops to invade more than a year ago. However, Ukraine's defenses have largely fended off a major cyberwar with the help of foreign tech companies including Microsoft. The ransomware attack on Polish and Ukrainian transport services in October, attributed to Sandworm, may have been "a trial balloon" for further attacks, the report said. Microsoft warned it was a potential precursor to further Russian hacks beyond Ukrainian soil.
Cut their ties... (Score:3, Insightful)
Why don't we just cut the lines and remove their internet access?
If they want to be a pariah, let them. But that doesn't mean we need to give them open access that they apparently want to abuse in a "burn everything to the ground" campaign...
Re: (Score:2)
The witches?
Re: (Score:3)
Re: (Score:2, Interesting)
Putin's already filtering what is getting into the country.
I'm just saying cut the lines to filter what is getting out of the country.
And it's not racist, I'm not asking for citizen tests or anything. I'm saying that if a state is a bad actor, then cut them out until they get their act together.
Re: (Score:2)
Re: (Score:2)
Putin's already filtering what is getting into the country.
I'm just saying cut the lines to filter what is getting out of the country.
And it's not racist, I'm not asking for citizen tests or anything. I'm saying that if a state is a bad actor, then cut them out until they get their act together.
I don't think it would be effective.
Sure, you could create an international agreement* to cut every cable, which kicks the vast majority of the population off the Internet, but not everyone.
A few satellites, radio transmitters, and hidden cables and they could get their traffic into another country. From there it goes through a router that strips anything that suggests a Russian origin and you've got connectivity.
It's not something that works at scale, but it's enough for the elites and the state sponsored
Re: (Score:2)
God bless Putin and the good work he is doing.
Without the devil, how can we tell who's good?
Re: (Score:3)
The Internet death penalty.
And yes, I think cutting all links would be a good idea. Even though they'd still route through their allies, I doubt they'd be interested in being identified as a point of origin of Russian cyber-warfare.
China would likely want to keep foreign access simply to enable more efficient selling of goods to Western consumers.
Re: (Score:2)
It might be some help but so much of this crappy activity is run off of so many commercial hosting platforms, including Azure, that you can't contain it with simple null-routing/blocklisting.
With an inventory of stolen credit cards and some basic scripting it is easy to set up and tear down attack infrastructure in the short amount of time it takes a provider to spin up whatever instances you've ordered. It's a big old game of whack-a-mole that won't go away because we value privacy over security. That's th
Re: (Score:2)
It won't work. The call is coming from inside the house.
Re: (Score:2)
Because then the only access to information that the Russian people will have is state edited. This was discussed by RIPE.
Here's RIPE's views:
https://labs.ripe.net/author/s... [ripe.net]
Re: (Score:2)
That's pretty much all they're getting now, yeah?
Neocon cyber BS .. (Score:1, Funny)
Do they still use an IP address registered to their own street address
Re: (Score:2)
Please, anyone can easily thwart a DDoS today, if you have to take something like that serious, you might want to wonder how you became a target in the first place because you should not be important enough.
Microsoft -- a bunch of geniuses (Score:1)
Is this kind of 'a bunch of bad actors are going to keep acting badly'?
Protect yourself (Score:1)
Protect yourself: don't use Windows.
Plan ? of course they have (Score:2)
They have a plan? (Score:2)