Week of February 14, 2022: Russian hackers mine defense contractors, and DDoS hits Ukraine's banks

What mattered to security leaders in the week of February 14, 2022? CISA, the FBI and the NSA disclosed two years of Russian state intrusions into cleared US defense contractors, while DDoS attacks took Ukraine's defense ministry and two state banks offline on February 15 and the White House tied them to Russia's GRU three days later. The FBI and Secret Service also described BlackByte ransomware inside three US critical infrastructure sectors.

Russian state actors spent two years inside cleared defense contractors

A joint advisory from CISA, the FBI and the NSA, published February 16 as AA22-047A, said Russian state-sponsored actors had regularly targeted US cleared defense contractors from at least January 2020 through February 2022. Entry came through brute-force password attacks, spearphishing with shortened links, harvested credentials and known flaws, and the intruders often lived inside Microsoft 365 using legitimate accounts. The agencies said the theft yielded export-controlled data and insight into weapons development timelines. The first recommended actions were MFA, strong unique passwords and M365 unified audit logging. (CISA)

DDoS attacks knock Ukraine's defense ministry and state banks offline

On Tuesday, February 15, denial-of-service attacks hit the websites of Ukraine's Ministry of Defence, its armed forces, Ukrainian Public Radio, Privatbank and Oschadbank. Only the radio site stayed up; the bank sites were unreachable for hours and Privatbank's mobile banking service was affected. On February 18 the White House attributed the attacks to Russia's GRU military intelligence, citing known GRU infrastructure sending heavy traffic to Ukrainian addresses; the Kremlin denied involvement. The fast public attribution signalled how Washington intended to handle cyber activity around the Ukraine crisis. (Help Net Security, BleepingComputer)

FBI and Secret Service detail BlackByte as the 49ers confirm an attack

CISA on February 15 pointed organizations to a joint FBI and US Secret Service advisory with indicators of compromise for BlackByte, a ransomware-as-a-service group that encrypts Windows hosts including virtual servers. The FBI said that as of November 2021 BlackByte had hit entities in at least three US critical infrastructure sectors: government facilities, financial, and food and agriculture. Its indicators included suspicious ASPX files found on compromised Microsoft IIS servers. Separately, the San Francisco 49ers confirmed a BlackByte attack that the team said only temporarily disrupted parts of its IT network. (CISA, BleepingComputer)

Conti absorbs the TrickBot crew and shifts to BazarBackdoor

Research from AdvIntel, reported on February 18, said the Conti ransomware syndicate had recruited several senior developers and managers of the TrickBot botnet by the end of 2021, turning the operation into a Conti subsidiary. Because TrickBot had become easy for antivirus tools to catch, the group was moving initial access to BazarBackdoor, a stealthier remote-access tool now developed under Conti's control. For defenders, detection rules tuned to TrickBot were losing value as the same people changed tooling. (BleepingComputer)

BlackCat claims the Swissport attack and posts job-candidate data

The BlackCat (ALPHV) gang claimed the earlier ransomware attack on Swissport, the aviation cargo and ground-services firm present at 310 airports in 50 countries, and on February 15 posted sample files while offering what it said was a 1.6 TB data dump for sale. The leaked samples included passport images, internal memos and job candidates' details such as passport numbers and a religion indicator. Swissport had said the attack, which caused flight delays, was largely contained. (BleepingComputer)

Magento and Chrome zero-days lead nine new KEV entries

On February 15 CISA added nine actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. Two were fresh: an improper input validation flaw in Adobe Commerce and Magento Open Source (CVE-2022-24086) and a use-after-free in Google Chrome (CVE-2022-0609), both with a federal remediation deadline of March 1, 2022. The other seven were older Microsoft, WinRAR, Flash and PHPUnit bugs due by August 15. E-commerce teams running Magento storefronts had the shortest runway. (CISA)