MOSCOW, August 3. /TASS/. The activity of the APT31 hacking group, known for targeting government agencies around the world, has been detected in Russia for the first time, according to a study by the IT company Positive Technologies.
In the first half of 2021, the group sent more than a dozen malicious mailings, and traces of its attacks were found in Mongolia, the US, Canada, and Belarus. Now the APT31 group’s activity has been detected in Russia.
"As part of a threat intelligence study, PT Expert Security Center experts detected emails with previously unseen malicious content sent to Mongolia. Then, similar attacks were detected in Russia, the United States, Canada, and the Republic of Belarus," according to the statement.
The criminals used malicious software code that allows them to control a victim’s computer or network by using remote access. Phishing, one of the most common social engineering techniques, was used by the group as the initial attack vector, the experts say.
"While studying one of the latest malware samples used by the group, PT ESC experts detected a link to a phishing domain, which imitates the domain of federal government bodies and government bodies of the subjects of the Russian Federation for the Internet segment.
"Over the year, APT31 has added and started to actively use new versions of malware. The group’s infrastructure is also growing — all this, combined with the fact that the group has not previously attacked Russia, suggests that it is expanding to countries where its increasing activity can be detected, in particular our country. We believe that experts will soon reveal other tools used by the group, including in attacks against Russia, that can be identified by code or network infrastructure," says Denis Kuvshinov, Head of Threat Analysis at Positive Technologies, as quoted by the press service.
APT31 (also known as Hurricane Panda and Zirconium) has been active since at least 2016. Its key interests have been cyberespionage and the collection of sensitive data of strategic importance. The group has a particular interest in the public sector around the world: at various times, its victims have been the government of Finland, and, purportedly, the governments of Norway and Germany.
A number of researchers suspect that APT31 is also behind a series of attacks on organizations and individuals close to US presidential candidates during the 2020 election campaign. Other targets of the group include aerospace and defense companies, international financial companies, high-tech, telecom, and mass media.