APT31 Linked to Cyberattacks on Air-Gapped Systems in Eastern Europe
August 01, 2023
Cyber Attack / Data Security
A Chinese-affiliated nation-state actor is under suspicion for a series of cyberattacks targeting industrial organizations in Eastern Europe last year, aimed at extracting information from air-gapped systems. Cybersecurity firm Kaspersky has attributed these intrusions with medium to high confidence to the hacking group known as APT31, which is also recognized by the aliases Bronze Vinewood, Judgement Panda, and Violet Typhoon (previously Zirconium). This conclusion is based on shared tactics observed in the attacks. The intrusions involved over 15 different implants and their variants, categorized into three primary functions: establishing persistent remote access, collecting sensitive data, and transmitting the stolen information to infrastructure controlled by the attackers. Notably, one type of implant appeared to be an advanced modular malware, designed to profile removable drives and infect them with a worm to extract data from isolated air-gapped networks.
Cyber Attack / Data Security
China’s APT31 Linked to Data Breaches in Eastern Europe’s Industrial Sector In a developing cybersecurity crisis, it has been reported that a state-sponsored hacking group with ties to China has been implicated in a series of targeted attacks on industrial organizations in Eastern Europe. These attacks, which occurred over the…
APT31 Linked to Cyberattacks on Air-Gapped Systems in Eastern Europe
August 01, 2023
Cyber Attack / Data Security
A Chinese-affiliated nation-state actor is under suspicion for a series of cyberattacks targeting industrial organizations in Eastern Europe last year, aimed at extracting information from air-gapped systems. Cybersecurity firm Kaspersky has attributed these intrusions with medium to high confidence to the hacking group known as APT31, which is also recognized by the aliases Bronze Vinewood, Judgement Panda, and Violet Typhoon (previously Zirconium). This conclusion is based on shared tactics observed in the attacks. The intrusions involved over 15 different implants and their variants, categorized into three primary functions: establishing persistent remote access, collecting sensitive data, and transmitting the stolen information to infrastructure controlled by the attackers. Notably, one type of implant appeared to be an advanced modular malware, designed to profile removable drives and infect them with a worm to extract data from isolated air-gapped networks.
