AWS Attributes Ongoing Espionage of Western Energy Infrastructure to Russia’s GRU

Cyber Espionage Campaign Targeting Critical Infrastructure

Amazon Web Services (AWS) has raised alarms about a long-term cyber espionage operation linked to a group associated with Russia’s Main Intelligence Directorate (GRU), commonly referred to as Sandworm (or APT44). This report outlines the group’s ongoing focus on Western critical infrastructure, particularly within the energy sector, and underscores the need for organizations to enhance their cybersecurity measures.

Targeting Western Infrastructure

AWS’s threat intelligence teams have detailed a concerted effort by the Russian-affiliated group against both North American and European critical infrastructure. This campaign began in 2021 and shows no signs of abating, raising significant concerns about the security of essential services.

Misconfigured Devices: The Attackers’ Entry Point

One crucial finding from the AWS investigation is that the initial access points exploited by attackers were not due to vulnerabilities in AWS itself, but rather the misconfiguration of customer devices. Threat actors are successfully infiltrating networks by taking advantage of inadequately secured edge devices and virtual appliances handled by organizations.

These attackers aim to steal user credentials and maintain prolonged access, often by penetrating third-party network appliances that function on cloud platforms like Amazon Elastic Compute Cloud (EC2).

AWS’s Chief Information Security Officer, CJ Moses, emphasized the urgency of addressing these vulnerabilities. “Organizations must prioritize securing their network edge devices and monitoring for credential replay attacks to counter this persistent threat,” he noted.

Sandworm’s Key Strategies: An Overview

AWS has documented methods commonly employed by the GRU-linked group which reflect a clear and consistent operational strategy. Here are some tactics that have been identified:

1. Exploiting Misconfigurations: Attackers take advantage of mistakes, particularly in open network appliances, to gain their initial foothold.

2. Establishing Persistence: They analyze network connections to ensure long-term access via IP addresses controlled by the attackers.

3. Credential Harvesting: The main aim is to seize credentials that allow attackers to maneuver laterally across networks and elevate their access privileges, particularly targeting critical infrastructure operators.

These established tactics align with Sandworm’s notorious history, which includes high-profile attacks on power grids, such as the significant blackouts in Ukraine in 2015 and 2016. Recent discoveries by the threat intelligence company Cyble have revealed advanced backdoors that closely mimic Sandworm’s methods, particularly those targeting defense systems.

Focusing on the Energy Sector

The targeted operations highlighted by AWS reveal a strategic interest in the global energy sector supply chain. This includes not only electricity providers but also technology vendors that assist them. The group’s targeting scope is extensive:

• Energy Sector: This encompasses electric utilities, energy providers, and specialized managed security services for energy clients.
• Technology and Cloud Services: Attackers focus on collaboration platforms and repositories essential for critical infrastructure development.
• Telecommunications: The campaign also aims at telecom providers worldwide.

The geographic reach of these attacks spans North America, Western and Eastern Europe, as well as the Middle East, indicating an objective to penetrate operational technology and enterprise networks crucial for managing energy distribution in NATO countries and allies.

Methodical Campaign Flow

AWS’s investigation presents a detailed five-step framework employed by attackers to gain access through customer misconfigurations on cloud-hosted devices:

1. Compromising Customer Network Edge Device: The attack initiates through exploiting vulnerabilities in network edge devices hosted on platforms like Amazon EC2.

2. Utilizing Native Packet Capture: Once inside, the attackers use the device’s functionalities to listen in on network traffic.

3. Credential Harvesting: They siphon usernames and passwords from the intercepted traffic flowing through the compromised device.

4. Replaying Credentials: The stolen credentials are used to access other services, enabling attackers to shift from the compromised device into the larger network.

5. Establishing Persistent Access: Ultimately, attackers ensure a discrete, long-term presence within the network for further exploration and data gathering.

Recommendations for Organizations

While AWS asserts its infrastructure is secure, it emphasizes that the responsibility lies with customers to address security flaws that make these campaigns possible. Organizations are strongly urged to act on two fronts:

• Secure Network Edge: Companies should conduct thorough audits and patch any exposed network appliances to ensure they are properly configured.

• Monitor for Credential Replay: Implementing advanced monitoring processes for indicators of compromise related to credential theft is crucial for protecting networks from intrusion.

In summary, the persistent threat posed by groups like Sandworm emphasizes the importance of robust cybersecurity measures and continuous vigilance among organizations operating critical infrastructure.