Newly discovered cyber-espionage group spies for money using state-actor methods
May 4, 2022 1 Comment
A NEWLY DISCOVERED CYBER-espionage group appears to target the senior leadership of private corporations involved in large-scale financial transactions, but employs skills and methods that are usually associated with state-sponsored threat actors. The group has been termed “UNC3524” by the American cybersecurity firm Mandiant, which says it discovered it in December of 2019. In a detailed blog post published earlier this week, a team of cyber-security researchers at Mandiant say they have been studying the group for over two years, and have been surprised by their findings.
Given its targets, as well as the information it goes after, there is little doubt that UNC3524 is interested in financial gain. However, its operational profile differs markedly from those of other financially oriented hacker groups, according to Mandiant. Its sophisticated approach to espionage demonstrates aspects that are typically associated with government-sponsored intelligence operations. Notably, UNC3524 operatives take their time to get to know their targets, and are not in a hurry to exploit the online environments they penetrate. Mandiant reported that UNC3524 attacks can take up to 18 months to conclude. In contrast, the average financially-motivated cyber-espionage attack rarely lasts longer than three weeks.
Additionally, UNC3524 operatives make a point of maintaining an extremely stealthy and low-key online profile, and have even developed a series of novel exploitation techniques, which Mandiant has termed “QuietExit”. The latter appear to focus on exploiting Internet of Things (IoT) devices that are typically found in corporate settings, but are not protected by traditional anti-virus systems. Once they penetrate the digital environment of their target, UNC3524 operatives meticulously build sophisticated back-doors into the system, and are known to return sometimes within hours after they are detected and repelled.
Interestingly, UNC3524 operatives do not waste time on low-level employees of targeted corporations. Once inside, they go straight for executive-level targets, including those in corporate strategy and development, mergers and acquisitions, and even information security. Mandiant says a few other actors, notably Russian-linked groups like Cozy Bear, Fancy Bear, APT28 or APT29, are also known to operate with such high-level targets in mind. However, there is little other operational overlap between them and UNC3524, the blog post claims.
► Author: Joseph Fitsanakis | Date: 04 May 2022 | Permalink
RUSSIAN STATE COMPANIES, BUSINESSES and individuals are being targeted in an unprecedented wave of attacks by digital assailants, according to observers, who say they are surprised by its ferocity. Since February of this year, hackers have accessed the personal financial data of pro-Kremlin oligarchs, stolen millions of internal emails stored on Russian government severs, and defaced high-profile websites across the nation. The Washington Post, which 
ISRAEL’S MOSSAD INTELLIGENCE AGENCY allegedly foiled a plot by Iranian intelligence to send assassins abroad and kill an Israeli diplomat, an American military official and a French reporter, according to reports. The information about the alleged plot first surfaced late last week in the Iran International News Channel, a British-based Iranian news agency, which is opposed to the government in Tehran. The news agency claimed that the plot had been organized by the Quds Force, the paramilitary wing of the Islamic Revolutionary Guards Corps.
SOUTH KOREAN AUTHORITIES HAVE busted an alleed spy ring run by a North Korean handler, who remains at large. Two men have been arrested so far in connection with the ring. One of them, identified only as “Lee”, is 
THE RUSSIAN FEDERATION HAS reportedly ordered 175,000 new diplomatic passports to be printed, prompting speculation about their possible use at a time when Western sanctions are affecting Russia’s governing elite. Diplomatic passports are travel documents that are issued to accredited diplomats and government officials, such as foreign ministry envoys and others. Pursuant to the Vienna Convention of Diplomatic Relations, holders of diplomatic passports enjoy diplomatic immunity and are typically subjected to very limited inspections by security personnel when crossing international borders.
AUSTRALIAN INTELLIGENCE HAD A role in the mysterious disclosure of a secret memorandum about a controversial defense pact between China and the Solomon Islands, which is causing consternation in the West. Western leaders claim that the pact will turn the tiny Melanesian nation into a logistical hub for Chinese warships in a strategic region of the Pacific Ocean. The pact also stipulates a training role for Chinese police and military personnel, who are called to “assist […] in maintaining social order” in the island nation.
TELEPHONE SYSTEMS BELONGING TO the British government were compromised by the Pegasus surveillance software, according to a Canadian research group. The allegation was made on Monday in an investigative 
CHINESE STATE-OWNED MEDIA has stepped up warnings of an alleged Western espionage offensive, to mark China’s annual “national security education day”, a new initiative promoted by the Chinese Communist Party (CPC). The decision to designate April 15 “national security education day” was adopted by the CPC in 2015, during its 12th National People’s Congress. Since then, the Chinese government has promoted the day as an effort to create a “positive atmosphere of national security” across the nation.
More than 150 officers have been purged form the ranks of Russia’s Federal Security Service (FSB), as President Vladimir Putin is placing blame on his intelligence agencies for the setbacks experienced during the invasion of Ukraine. This assessment was communicated to the London-based Times newspaper by British intelligence sources, who added that many of those purged have been dismissed from the service, while others remain under house arrest. A few —among them senior FSB officials— are in prison. The FSB is tasked with domestic security and counterintelligence operations, which were carried out by the KGB during the Cold War.
AN AMERICAN COMPUTER PROGRAMMER has been jailed for 63 months for providing “highly technical information” to North Korea, which related to cryptocurrency systems, according to United States officials. The programmer, Virgil Griffith, 39, also known as “Romanpoet”, became widely known in the early 2000s, when he began describing himself as a “disruptive technologist”. He later consulted with the Federal Bureau of Investigation and other law enforcement agencies in the area of the dark web and cryptocurrencies.
A LEAKED PLAN FOR a security alliance between China and the small Melanesian nation of the Solomon Islands has sparked concerns about a large-scale military buildup by regional powers in the South Pacific. The draft agreement, which was leaked online last week, appears to turn the Solomon Islands into a logistical hub for Chinese warships. It also stipulates a training role for Chinese police and military personnel, who are called to “assist […] in maintaining social order” in the island nation.
A BRITISH CITIZEN, WHO worked as a security guard at the British embassy in Berlin, has been charged with spying for the Russian intelligence services. Authorities in the United Kingdom announced on Wednesday that David Ballantyne Smith, 57, who lives in Potsdam, Germany, has been charged on nine different offenses under the 1911 Official Secrets Act.
FOUR RUSSIAN DIPLOMATS, WHO Ireland claims are undercover intelligence officers, met with Irish paramilitaries as part of a wider plan to “stoke political unrest” in Britain and Ireland, according to a new report. In a press conference held in Dublin last week, Irish Taoiseach (Prime Minister) Micheál Martin 
A WEEK AFTER POLAND 
intelNews.org 
Mystery blasts, fires, prompt rumors of sabotage campaign inside Russia (updated)
May 6, 2022 by Joseph Fitsanakis 2 Comments
On April 21, a massive blaze engulfed the Central Research Institute for Air and Space Defense of the Russian Defense Ministry in Tver, a city located around 120 miles northwest of Moscow. According to Associated Press, which reported the news about the fire, the institute “was involved in the development of some of the state-of-the-art Russian weapons systems, reportedly including the Iskander missile”. By next morning, at least 17 people were believed to have died as a result of the fire.
Late last week, the Sakhalinskaya GRES-2 power station, a vast 120-megawatt coal-fired power plant in Russia’s far-eastern Sakhalin province, went up in flames, giving rise to persistent rumors of sabotage. On May 1, Russian state-owned news agencies reported that a railway bridge in the western province of Kursk, 70 miles from the Ukrainian border, had been destroyed. Analysts at the Washington-based Atlantic Council think tank claimed that the bridge had been used extensively by the Russian military to transport equipment to eastern Ukraine. Later on the same day, a cluster of fuel-oil tanks in Mytishchi, a mid-size city located northeast of Moscow, were completely destroyed by a fast-spreading fire.
On May 2, a munitions factory in Perm, a major urban center in western Siberia, was hit by a “powerful” explosion. Ukrainian government officials hinted at sabotage in social media posts, though no proof has been provided, and the Kremlin has not commented on the matter. On the following day, the Prosveshchenie publishing house warehouse in Bogorodskoye, northeast of Moscow, was destroyed by a massive fire. The warehouse belongs to Russia’s state-owned publisher of school textbooks. The fire occurred almost simultaneously as another fire engulfed a polyethylene waste storage facility in the central Siberian city of Krasnoyarsk.
Meanwhile, the sprawling forests that surround Krasnoyarsk and other Siberian urban centers are experiencing seasonal wildfires of near-unprecedented scale. Some early reports claimed that the Russian government was finding it difficult to contain these fires, because the country’s emergency response personnel has been sent to the frontlines of the war in Ukraine. But these reports were denied by Russia’s Ministry of Emergency Situations, which claimed earlier this week that the fires were mostly under control.
► Author: Joseph Fitsanakis | Updated: 09 May 2022 | Research credit: M.R. | Permalink
Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with 2022 Russian invasion of Ukraine, News, Russia, sabotage