Newly discovered cyber-espionage group spies for money using state-actor methods
May 4, 2022 1 Comment
A NEWLY DISCOVERED CYBER-espionage group appears to target the senior leadership of private corporations involved in large-scale financial transactions, but employs skills and methods that are usually associated with state-sponsored threat actors. The group has been termed “UNC3524” by the American cybersecurity firm Mandiant, which says it discovered it in December of 2019. In a detailed blog post published earlier this week, a team of cyber-security researchers at Mandiant say they have been studying the group for over two years, and have been surprised by their findings.
Given its targets, as well as the information it goes after, there is little doubt that UNC3524 is interested in financial gain. However, its operational profile differs markedly from those of other financially oriented hacker groups, according to Mandiant. Its sophisticated approach to espionage demonstrates aspects that are typically associated with government-sponsored intelligence operations. Notably, UNC3524 operatives take their time to get to know their targets, and are not in a hurry to exploit the online environments they penetrate. Mandiant reported that UNC3524 attacks can take up to 18 months to conclude. In contrast, the average financially-motivated cyber-espionage attack rarely lasts longer than three weeks.
Additionally, UNC3524 operatives make a point of maintaining an extremely stealthy and low-key online profile, and have even developed a series of novel exploitation techniques, which Mandiant has termed “QuietExit”. The latter appear to focus on exploiting Internet of Things (IoT) devices that are typically found in corporate settings, but are not protected by traditional anti-virus systems. Once they penetrate the digital environment of their target, UNC3524 operatives meticulously build sophisticated back-doors into the system, and are known to return sometimes within hours after they are detected and repelled.
Interestingly, UNC3524 operatives do not waste time on low-level employees of targeted corporations. Once inside, they go straight for executive-level targets, including those in corporate strategy and development, mergers and acquisitions, and even information security. Mandiant says a few other actors, notably Russian-linked groups like Cozy Bear, Fancy Bear, APT28 or APT29, are also known to operate with such high-level targets in mind. However, there is little other operational overlap between them and UNC3524, the blog post claims.
► Author: Joseph Fitsanakis | Date: 04 May 2022 | Permalink
ISRAEL’S MOSSAD INTELLIGENCE AGENCY allegedly foiled a plot by Iranian intelligence to send assassins abroad and kill an Israeli diplomat, an American military official and a French reporter, according to reports. The information about the alleged plot first surfaced late last week in the Iran International News Channel, a British-based Iranian news agency, which is opposed to the government in Tehran. The news agency claimed that the plot had been organized by the Quds Force, the paramilitary wing of the Islamic Revolutionary Guards Corps.
THE RUSSIAN FEDERATION HAS reportedly ordered 175,000 new diplomatic passports to be printed, prompting speculation about their possible use at a time when Western sanctions are affecting Russia’s governing elite. Diplomatic passports are travel documents that are issued to accredited diplomats and government officials, such as foreign ministry envoys and others. Pursuant to the Vienna Convention of Diplomatic Relations, holders of diplomatic passports enjoy diplomatic immunity and are typically subjected to very limited inspections by security personnel when crossing international borders.
AUSTRALIAN INTELLIGENCE HAD A role in the mysterious disclosure of a secret memorandum about a controversial defense pact between China and the Solomon Islands, which is causing consternation in the West. Western leaders claim that the pact will turn the tiny Melanesian nation into a logistical hub for Chinese warships in a strategic region of the Pacific Ocean. The pact also stipulates a training role for Chinese police and military personnel, who are called to “assist […] in maintaining social order” in the island nation.
RUSSIAN DEEP-COVER SPY Mikhail Vasenkov, who was caught by authorities in the United States in 2010, and was later part of a multi-person spy-swap between Washington and Moscow, has reportedly died. Vasenkov was an officer for the Soviet-era Committee for State Security (KGB), under which he constructed his non-official cover identity. In 1976, he 
TELEPHONE SYSTEMS BELONGING TO the British government were compromised by the Pegasus surveillance software, according to a Canadian research group. The allegation was made on Monday in an investigative 
AN AMERICAN COMPUTER PROGRAMMER has been jailed for 63 months for providing “highly technical information” to North Korea, which related to cryptocurrency systems, according to United States officials. The programmer, Virgil Griffith, 39, also known as “Romanpoet”, became widely known in the early 2000s, when he began describing himself as a “disruptive technologist”. He later consulted with the Federal Bureau of Investigation and other law enforcement agencies in the area of the dark web and cryptocurrencies.
A LEAKED PLAN FOR a security alliance between China and the small Melanesian nation of the Solomon Islands has sparked concerns about a large-scale military buildup by regional powers in the South Pacific. The draft agreement, which was leaked online last week, appears to turn the Solomon Islands into a logistical hub for Chinese warships. It also stipulates a training role for Chinese police and military personnel, who are called to “assist […] in maintaining social order” in the island nation.
THE FEDERAL BUREAU OF Investigation arrested two men on Wednesday, who allegedly tried to influence four agents of the United States Secret Service with money and gifts, according to an affidavit. The men were identified on Thursday as Haider Ali, 36, and Arian Taherzadeh, 40. Both are United States citizens and residents of Washington, DC. On the same day, FBI personnel searched five apartments and a number of cars that belong to the two men.
A BRITISH CITIZEN, WHO worked as a security guard at the British embassy in Berlin, has been charged with spying for the Russian intelligence services. Authorities in the United Kingdom announced on Wednesday that David Ballantyne Smith, 57, who lives in Potsdam, Germany, has been charged on nine different offenses under the 1911 Official Secrets Act.
FOUR RUSSIAN DIPLOMATS, WHO Ireland claims are undercover intelligence officers, met with Irish paramilitaries as part of a wider plan to “stoke political unrest” in Britain and Ireland, according to a new report. In a press conference held in Dublin last week, Irish Taoiseach (Prime Minister) Micheál Martin 
THE DIRECTOR OF FRANCE’S military intelligence agency has been asked to resign, allegedly because of his agency’s failure to anticipate the Russian invasion of Ukraine. General Éric Vidaud is a career military officer, who rose through the ranks to command the 1st Marine Infantry Parachute Regiment, one of the three units in the French Army Special Forces Command. In 2018, he was placed at the helm of the Special Operations Command, which oversees the joint activities of special forces units from all of France’s military branches. In August of last year, Vidaud assumed command of the Directorate of Military Intelligence (DRM), which operates under France’s Armed Forces Ministry.
AMERICAN INTELLIGENCE AGENCIES ASSESSED Russia’s intentions in Ukraine with remarkable precision. Moreover, Washington’s picture of the Russian military’s material power has proven highly accurate. On the other hand, American intelligence agencies appear to have over-estimated Russia’s conceptual military power —that is, Moscow’s ability to utilize its material military strength efficiently. This, combined with a tendency to underrate the willingness of the Ukrainian population to resist the Russian invasion, appears to have led Washington to over-estimate Russia’s chances of a swift military victory in Ukraine.
intelligence interpreted Russian intentions on Ukraine with remarkable accuracy. It should be noted that, with the help of its intelligence advisors, the White House was able to 
UKRAINE’S MILITARY INTELLIGENCE AGENCY has published a list that contains the names, addresses and passport numbers of 600 Russians, who it alleges are employees of the Russian Federal Security Service (FSB). The FSB is Russia’s domestic security and counterintelligence agency, but its personnel also operate in former Soviet republics, including Ukraine. It has been 
Mystery blasts, fires, prompt rumors of sabotage campaign inside Russia (updated)
May 6, 2022 2 Comments
On April 21, a massive blaze engulfed the Central Research Institute for Air and Space Defense of the Russian Defense Ministry in Tver, a city located around 120 miles northwest of Moscow. According to Associated Press, which reported the news about the fire, the institute “was involved in the development of some of the state-of-the-art Russian weapons systems, reportedly including the Iskander missile”. By next morning, at least 17 people were believed to have died as a result of the fire.
Late last week, the Sakhalinskaya GRES-2 power station, a vast 120-megawatt coal-fired power plant in Russia’s far-eastern Sakhalin province, went up in flames, giving rise to persistent rumors of sabotage. On May 1, Russian state-owned news agencies reported that a railway bridge in the western province of Kursk, 70 miles from the Ukrainian border, had been destroyed. Analysts at the Washington-based Atlantic Council think tank claimed that the bridge had been used extensively by the Russian military to transport equipment to eastern Ukraine. Later on the same day, a cluster of fuel-oil tanks in Mytishchi, a mid-size city located northeast of Moscow, were completely destroyed by a fast-spreading fire.
On May 2, a munitions factory in Perm, a major urban center in western Siberia, was hit by a “powerful” explosion. Ukrainian government officials hinted at sabotage in social media posts, though no proof has been provided, and the Kremlin has not commented on the matter. On the following day, the Prosveshchenie publishing house warehouse in Bogorodskoye, northeast of Moscow, was destroyed by a massive fire. The warehouse belongs to Russia’s state-owned publisher of school textbooks. The fire occurred almost simultaneously as another fire engulfed a polyethylene waste storage facility in the central Siberian city of Krasnoyarsk.
Meanwhile, the sprawling forests that surround Krasnoyarsk and other Siberian urban centers are experiencing seasonal wildfires of near-unprecedented scale. Some early reports claimed that the Russian government was finding it difficult to contain these fires, because the country’s emergency response personnel has been sent to the frontlines of the war in Ukraine. But these reports were denied by Russia’s Ministry of Emergency Situations, which claimed earlier this week that the fires were mostly under control.
► Author: Joseph Fitsanakis | Updated: 09 May 2022 | Research credit: M.R. | Permalink
Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with 2022 Russian invasion of Ukraine, News, Russia, sabotage