Russian hackers cloak attacks using Iranian group

   

21 Oct 2019

Russian hackers cloak attacks using Iranian group

BBC

An Iranian hacking group was itself hacked by a Russian group to spy on multiple countries, UK and US intelligence agencies have revealed.

The Iranian group - codenamed OilRig - had its operations compromised by a Russian-based group known as Turla.

The Russians piggybacked on the Iranian group to target other victims.

A National Cyber Security Centre (NCSC) investigation, begun in 2017 into an attack on a UK academic institution, uncovered the double-dealing.

Crowded space
The NCSC discovered that the attack on the institution had been carried out by the Russian Turla group, which it realised was scanning for capabilities and tools used by Iran-based OilRig.

In an investigation that lasted months, it became clear the Russian group had targeted the Iranian-based group and then used its tools and access to collect data and compromise further systems.

Attacks were discovered against more than 35 countries with the majority of the victims being in the Middle East. At least 20 were successfully compromised. The ambition was to steal secrets, and documents were taken from a number of targets, including governments.

Intelligence agencies said Turla was both getting hold of information the Iranians were stealing but also running their own operations using Iranian access and then hoping it would hide their tracks.

Victims might have assumed they had been compromised by the Iranian-based group when in fact the real culprit was based in Russia.

There is no evidence that Iran was complicit or aware of the Russians' use of their access or that the activity was done to foment trouble between countries but is a sign of the increasingly complex world of cyber-operations.

"This is getting to be a very crowded space," explained Paul Chichester, director of operations for the NCSC, the protective arm of the intelligence agency GCHQ.

He adding he had not previously seen such a sophisticated attack carried out. Separately it has been reported in leaks that the US and UK also have similar capabilities.

Mr Chichester said he would not describe the Russian hack attacks as a "false flag" since it was not an attempt to deliberately frame someone else.

The NCSC would also not directly attribute the attacks to the Russian and Iranian states but Turla has previously been linked by others to Russia's Security Service, the FSB, and OilRig to the Iranian state.

'We can identify them'
The investigation was primarily a UK one but the details are being revealed jointly by the NCSC and America's NSA. A report of Turla compromising another espionage group was made by the private security company Symantec in June.

Mr Chichester said the purpose of revealing the details was to help others detect this activity and defend themselves.

"We want to send a clear message that even when cyber-actors seek to mask their identity, our capabilities are a match for them and we can identify them," he said.

How the two groups will react to the exposure is not something officials said they could predict.

View all News
Loading

Supporters & Partners

OFFICIAL GOVERNMENT CYBERSECURITY PARTNER

Dubai Electronic Security Center Logo

dp

OFFICIAL DISTRIBUTION PARTNER

ISPIRE

OFFICIALLY SUPPORTED BY

Telecommunications Regulatory Authority

Official Smart City Partner

Strategic Sponsors & Partners

Strategic AI Partner

Huawei_gisec

Strategic Sponsor


sap

IOT Partner


Vodafone_iotx

 

Strategic Partner


cb

 

Official Digital Partner

etisalat_gisec

Strategic Partner

Strategic Partner

tahaluf

Platinum & Diamond sponsors

Platinum Sponsor

pp

Platinum Sponsor

BLUVECTOR

Diamond Sponsor

fe

Gold sponsors


cs
 

gold sponsor

know

emailauth


so

HumanFirewall

thales

Silver sponsors

cf

df

Education Partner

isc2

ras

vf

GISEC

west

GISEC

nedaa

oracle_gisec

crest

Industry & Association Partner

Germany Association Partner

TeleTrusT

India Pavilion Partner

Logo

Thank you to Exhibitors

VIEW MORE EXHIBITORS
 

Thank you to our Media Partners