Code deployed in US cyber-attack linked to suspected Russian hackers
A Moscow-based cybersecurity company has reported that some of the malicious code employed against the US government in a cyber-attack last month overlaps with code previously used by suspected Russian hackers.
The findings by Kaspersky investigators may provide the first public evidence to support accusations from Washington that Moscow was behind the biggest cyber-raid against the government in years, affecting 18,000 users of software produced by SolarWinds, including US government agencies.
However, investigators from Kaspersky have cautioned that the code similarities do not confirm that the same group is behind both attacks.
According to findings, published by the investigators Georgy Kucherin, Igor Kuznetsov, and Costin Raiu, a “backdoor” called Sunburst used to communicate with a server controlled by the hackers resembled another hacking tool called Kazuar, which had previously been attributed to the Turla APT (advanced persistent threat) group.
Attacks by Turla have been documented from at least 2008, when the group was believed to have infiltrated US Central Command. Later, Turla was implicated in attacks on embassies in a number of countries, ministries, utilities, healthcare providers, and other targets. Several cybersecurity companies have said they believe the hacking team is Russian, and an Estonian intelligence report from 2018 says the group is “tied to the federal security service, FSB”.
US intelligence agencies last week released a joint statement accusing Moscow of launching the attack, which they said was “ongoing” more than a month after being made public.
Moscow has denied responsibility.
The Sunburst backdoor used in the recent attack allowed the hackers to receive reports on infected computers and then target those they deemed interesting for further exploitation. The vast majority of the 18,000 infected machines were not referred for further exploitation, showing that the attack was highly targeted.
The Kaspersky investigators found that functions that kept the malware dormant for weeks, as well as how it coded information about targets, appeared to have links to Kazuar, which was first reported by Palo Alto Networks in 2017. “A hallmark of Turla operations is iterations of their tools and code lineage in Kazuar can be traced back to at least 2005,” the cybersecurity firm reported then.
The Kaspersky investigators said there could be other explanations for the coding overlap besides Turla being behind the SolarWinds attack. It is possible the attackers were “inspired” by the Kazuar code; that both groups obtained their malware from the same source; that a former member of Turla brought the code to a new team; or that the code was used as a “false flag”, deployed in the attack specifically to attract blame against Turla and implicate Moscow.
“Nevertheless, they are curious coincidences,” the group wrote. “One coincidence wouldn’t be that unusual, two coincidences would definitively raise an eyebrow, while three such coincidences are kind of suspicious to us.”