Russian malware used by 'privateer' hackers against Ukrainian government

A hacker tool popular across underground Russian crime networks has been used in attacks on the Ukrainian government, indicating the use of “privateers” for digital espionage, according to researchers.

The malware, known as BlackEnergy, appears to have been used in cyberattacks against Georgia during the Russo-Georgian conflict of 2008 too, but has also been operated by criminals as a means to steal credit card data.

This summer, it was tailored to hit a number of Ukrainian targets. Researchers from security firm F-Secure said Ukrainian Railways and infrastructure related to government bodies in Dnipropetrovsk, a city in the southeast of Ukraine, were in the crosshairs of the hackers. The researchers uncovered the hackers’ use of proxy servers - used to reroute internet traffic - linked to those targets’ networks.

The current “working theory” is that the attackers were carrying out hits on a wide range of targets to earn themselves a living, but were “somehow co-opted” into carrying out state espionage, F-Secure’s Sean Sullivan suggested to the Guardian. “They used to steal credit cards and now they have a different kind of buyer,” Sullivan added.

Victims were sent emails containing documents that ostensibly offered information on Russian plans to take over the world, said researchers from another anti-virus firm ESET. One appeared to be a story from the Guardian, entitled ‘Russian ambassadors: next we’ll take Catalonia, Venice, Scotland and Alaska’. Though this was a genuine article online, anyone who clicked on the associated Word file would open themselves up to BlackEnergy infection.

The malware can scoop up reams of information from victims’ PCs, including passwords and system information. “The nature of the information being gathered seems to be generic rather than targeted. This may be because the malware has roots from crimeware,” F-Secure’s report read. “The information is still useful however as such data makes it easier for the gang to plan any further attacks on the same targets.”

Sullivan said many of the targets were using an old form of anti-virus protection, where “signatures” or markers of malware are used to blacklist them and ban them from the network. The BlackEnergy hackers, just like most cybercriminals on the planet, have tweaked their code so anti-virus won’t recognise them as there is no corresponding signature.

“The attackers don’t need a lot of sophistication to get round a 2001 technology,” Sullivan said.

The so-called Quedagh gang behind the attacks has been operating since 2010, F-Secure said, but their tools have been used by various cyber criminals since 2007.

There is much suspicion around Russian government involvement in cyber attacks on foreign entities, especially those related to the current conflict in Ukraine. UK defence contractor BAE Systems reported in March that Ukraine was facing a barrage of attacks from digital spies as tensions escalated between the two countries.

The FBI is investigating whether Russia backed recent attacks on US banks, including JP Morgan, in response to sanctions imposed by the west since the Putin regime’s support of rebels in the east of Ukraine.