Kremlin-backed hackers targeted a “large” petroleum refinery in a NATO nation

Enlarge / Fawley Oil Refinery on a bright day. (credit: Getty Images)

One of the Kremlin’s most active hacking groups targeting Ukraine recently tried to hack a large petroleum refining company located in a NATO country. The attack is a sign that the group is expanding its intelligence gathering as Russia’s invasion of its neighboring country continues.

The attempted hacking occurred on August 30 and was unsuccessful, researchers with Palo Alto Networks’ Unit 42 said on Tuesday. The hacking group—tracked under various names including Trident Ursa, Gamaredon, UAC-0010, Primitive Bear, and Shuckworm—has been attributed by Ukraine’s Security Service to Russia’s Federal Security Service.

Setting sights on the energy industry

In the past 10 months, Unit 42 has mapped more than 500 new domains and 200 samples and other bread crumbs Trident Ursa has left behind in spear phishing campaigns attempting to infect targets with information-stealing malware. The group mostly uses emails with Ukrainian-language lures. More recently, however, some samples show that the group has also begun using English-language lures.

Read 10 remaining paragraphs | Comments