Kremlin-Backed Hackers Targeted A Large Petroleum Refinery

Enlarge / Fawley Oil Refinery on a bright day. Getty Images reader comments

97 with 0 posters participating

Share this story

One of the Kremlin’s most active hacking groups targeting Ukraine recently tried to hack a large petroleum refining company located in a NATO country. The attack is a sign that the group is expanding its intelligence gathering as Russia’s invasion of its neighboring country continues.

The attempted hacking occurred on August 30 and was unsuccessful, researchers with Palo Alto Networks’ Unit 42 said on Tuesday. The hacking group—tracked under various names including Trident Ursa, Gamaredon, UAC-0010, Primitive Bear, and Shuckworm—has been attributed by Ukraine’s Security Service to Russia’s Federal Security Service.

Setting sights on the energy industry

In the past 10 months, Unit 42 has mapped more than 500 new domains and 200 samples and other bread crumbs Trident Ursa has left behind in spear phishing campaigns attempting to infect targets with information-stealing malware. The group mostly uses emails with Ukrainian-language lures. More recently, however, some samples show that the group has also begun using English-language lures.

“We assess that these samples indicate that Trident Ursa is attempting to boost their intelligence collection and network access against Ukrainian and NATO allies,” company researchers wrote.

Among the filenames used in the unsuccessful attack were: MilitaryassistanceofUkraine.htm, Necessary_military_assistance.rar, and List of necessary things for the provision of military humanitarian assistance to Ukraine.lnk.

Tuesday’s report didn’t name

Read more

Explore the site

More from the blog

Latest News