Russian GRU Unit 29155 recent operations

-

Background

Russian GRU military intelligence Unit 29155 (aka Cadet Blizzard, Ember Bear, FrozenVista, UNC2589) is a covert subunit of the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU), primarily tasked with conducting high-stakes and clandestine operations abroad. Established under the GRU, Unit 29155 gained public attention due to its involvement in activities that align with Russia's asymmetric warfare objectives, particularly in Europe, Ukraine, and NATO-affiliated regions. Unit 29155 operates in several domains, from traditional espionage and sabotage to cyber operations.


Figure 1 WANTED: GRU Unit 29155 [1]

Unit 29155 has significantly intensified operations since 2020, pivoting from covert actions in Europe toward a greater emphasis on cyber operations with a focus on undermining Ukraine and NATO allies through espionage, data manipulation, and sabotage.

Primary TTPs
  • Espionage and Data Theft
    • Unit 29155 conducts extensive espionage campaigns aimed at gathering intelligence from NATO countries, European union members, and multiple nations in Latin America and Central Asian. They've exploited critical infrastructure and government systems leveraging reconnaissance tools like Nmap and Shodan to scan for vulnerabilities and gather intelligence [2].
    • Sensitive information obtained through these operations are occasionally leaked or shared publicly in order to damage the reputations of their victims as part of influence efforts [3].
  • Destructive Operations
    • Unit 29155 was tracked as the group deploying the destructive WhisperGate malware, disguised as ransomware but meant to erase victim data. This wiper was used in targeting of Ukrainian governmental and critical infrastructure entities. This activity provided evidence of a clear shift to sabotage tactics aligned with Russian military objectives early in the Russia/Ukraine conflict.
    • Destructive attacks have also been directed towards logistics operations supporting Ukraine, as seen in repeated attacks against infrastructure crucial to NATO and EU support for Ukraine [2].
  • Infrastructure Scanning/Domain Enumeration
    • Unit 29155 engaged in over 14,000 documented cases of domain scanning, targeting NATO infrastructure and EU entities. The scanning has been described as preparatory, often identifying weak points for later exploitation efforts. Open-source and custom tools like Acunetix, WPScan, and VirusTotal were commonly used for this reconnaissance [3].
  • Cybercriminal Overlap
    • Not wholly unique to Unit 29155, but rather the broad spectrum of Russian state-sponsored APT groups, researchers report collaboration with known cybercriminal elements, employing non-GRU actors to facilitate operations. This working relationship extends the group's reach and allows it to exploit technical expertise outside formal military ranks while obscuring attribution. It is also believed that this particular unit consists of primarily junior personnel and so may operate at a less sophisticated level than other groups like APT28 or APT29 [4].
Mitigations and Recommendations
Network defenders across critical sectors are encouraged to implement mitigations against known tactics:
  • Prioritize patching of known vulnerabilities and enforce multi-factor authentication (MFA).
  • Monitor networks for unusual scanning or reconnaissance activity and segment networks to mitigate lateral movement, post infiltration.
  • Use intrusion detection tools to monitor for technical indicators of compromise (IOCs) relating to Unit 29155.
Unit 29155's evolution highlights a blend of traditional espionage with enhanced cyber and sabotage capabilities, particularly in relation to high-stakes geopolitical targets. The expanded use of cyber tactics show the importance for affected nations and organizations to maintain vigilance and robust cyber defenses.


References
[1] https://www.fbi.gov/wanted/cyber/gru-29155-cyber-actors
[2] https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3895808/
[3] https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/russian-military-cyber-actors-target-us-and-global-critical-infrastructure
[4] https://www.rferl.org/a/germany-gru-russia-cyber-warning/33112764.html


Comments

Post a Comment

Popular posts from this blog

-
Image
ESET's APT Activity Report Q4 2023-Q1 2024 summarizes observations of various advanced persistent threat (APT) groups documented by ESET researchers between October 2023 and March 2024. Their observations highlight the broader threat landscape investigated during this period of time and details trends, developments and tooling used by these threat actors. The public report proclaims to contain a fraction of what private ESET customers receive. China Chinese-aligned cyber espionage groups have traditionally targeted public facing applications for obtaining initial access on a target network. In many campaigns investigated by ESET and others, the groups leveraged one-day vulnerabilities against a range of appliances and software including VPNs, firewalls, Confluence, Exchange, and others. See ESETs report linked below for their detailed analysis on Chinese threat activity.  Middle East According to ESET's research, a potentially Iranian-aligned threat group BladedFeline continued...
Read more
-
Image
Microsoft recently released their findings after a lengthy investigation into activity conducted by the Russian state-sponsored APT28 group using a unique tool for privilege escalation and credential harvesting on victim networks. Microsoft refers to the custom tool as GooseEgg and claim that the group has been observed leveraging this tool since at least June 2020. GooseEgg The custom toolset leverages CVE-2023-38208 in the Windows Print Spooler service which changes a JavaScript constraints file and executes it with SYSTEM permissions. Based on their findings, Microsoft believes GooseEgg is deployed after initial access to elevate access to targeted systems with the end goal of harvesting credentials and data. Unsurprisingly, targeting includes Ukrainian, Western European and North American entities across several sectors including government, non-government, education and transportation. After initial access of victim device, researchers observed APT28 deploying GooseEgg to escalate...
Read more