Russian Military Cyber Unit Targets Global Infrastructure

The UK’s National Cyber Security Centre (NCSC) and nine international allies have exposed cyberattacks orchestrated by Russia’s GRU Unit 29155, an elite military intelligence team. Since at least 2020, Unit 29155 has targeted government and critical infrastructure sectors across the globe, conducting cyber-espionage, sabotage, and data theft. The unit is distinct from other known GRU cyber groups like Fancy Bear, and is responsible for the Whispergate malware attack on Ukrainian organizations ahead of Russia’s 2022 invasion. This disclosure marks the first time the UK has publicly detailed Unit 29155’s operations.

The NCSC reports that the unit includes junior GRU officers and cybercriminals, working to disrupt international support for Ukraine amid the ongoing war. According to NCSC’s director of operations, Paul Chichester, this highlights Russia’s strategic use of cyberspace to advance its military and political agendas.

Whispergate, a particularly destructive malware, was attributed to Unit 29155 in May 2022. This malware attack caused widespread disruption to ordinary citizens and businesses in Ukraine and across Europe. In light of these threats, the NCSC and its allies have issued guidance on defending against such attacks, urging organizations to prioritize patching known vulnerabilities, implementing strong security measures, and testing systems against frameworks like MITRE ATT&CK.

These efforts underscore the importance of global collaboration in countering state-sponsored cyberattacks, with the UK and its partners committed to exposing and mitigating malicious activities from actors like GRU Unit 29155. The advisory serves as a critical alert to organizations worldwide to enhance their cybersecurity defenses in response to these ongoing threats.

Source: Silicon UK

The European Cyber Intelligence Foundation is a nonprofit think tank specializing in intelligence and cybersecurity, offering consultancy services to government entities. To mitigate potential threats, it is important to implement additional cybersecurity measures with the help of a trusted partner like INFRA www.infrascan.net, or you can try yourself using check.website.