Russian Hackers Linked to New Attacks Exploiting Windows Vulnerability

By Laura Stotler November 02, 2016

Russia has repeatedly made headlines in the upcoming U.S. election, with government-sponsored hackers allegedly responsible for accessing Democratic Party emails and then publishing them through WikiLeaks and other sources. Now Microsoft has given the hacking sources additional validity, claiming a group previously linked to the Russian government and U.S. political hacks is responsible for recent attacks that exploited a newly discovered Windows security flaw.

Microsoft revealed on its website that “spear phishing” emails had been sent from the Strontium hacking group, also known as “Fancy Bear” and “APT 28.” Those emails were used to launch a small number of attacks by exploiting Windows vulnerabilities. Microsoft is releasing a patch on Election Day, November 8, to protect users against the threat.

The timing of Microsoft’s announcement, as well as the patch release on Election Day, adds yet another element of chaos into what has proven to be a historically unusual and turbulent election cycle. And much in the spirit of the impending election, rivals Microsoft and Google were at each other’s throats over the timing of the vulnerability announcement. According to Microsoft, the attacks exploit a vulnerability in Adobe’s Flash software as well as the Windows OS. Adobe released a patch for its vulnerability on Monday, and Google promptly went public with details of the attacks – well before Microsoft’s patch was prepared and available.

“Google’s decision to disclose these vulnerabilities before patches are broadly available and tested is disappointing, and puts customers at increased risk,” said Microsoft in a statement, while Google had no comment on the issue.

According to John Bambenek, threat systems manager at Fidelis Cybersecurity, a company specializing in threat detection and security, early disclosure was the right move in this scenario, and will protect more enterprises in the long run.

“There will always be a risk with acknowledging weakness,” said Bambenek. “Even releasing patches can give adversaries the very clues needed to weaponize and exploit. This was very much true with Microsoft patches years ago, which have been largely mitigated by automated patching and rebooting within 24 hours of release.”

“While we don’t have solid data to talk about how widely it is being used, we do know that this vulnerability is dangerous,” added Bambenek. “It's a local privilege escalation, which means that if a user can execute compromised code, that code could be used to run commands as the administrator and more deeply embed itself into a system. At this point, my preference is to release mitigation strategies so that enterprises can protect their users while awaiting a patch.”

The Fancy Bear hacking group has been primarily tied to GRU, Russia’s military intelligence agency. The group has been widely blamed for the recent hacks of Democratic Party databases and emails.




Edited by Alicia Young

TechZone360 Contributing Editor

SHARE THIS ARTICLE
Related Articles

Why People Don't Update Their Computers

By: Special Guest    7/13/2018

When the WannaCry ransomware attacked companies all over the world in 2017, experts soon realized it was meant to be stopped by regular updating. Even…

Read More

More Intelligence About The New Intelligence

By: Rich Tehrani    7/9/2018

TMC recently announced the launch of three new artificial intelligence events under the banner of The New Intelligence. I recently spoke with TMC's Ex…

Read More

Technology, Innovation, and Compliance: How Businesses Approach the Digital Age

By: Special Guest    6/29/2018

Organizations must align internally to achieve effective innovation. Companies should consider creating cross-functional teams or, at a minimum, incre…

Read More

Contribute Your Brain Power to The New Intelligence

By: Paula Bernier    6/28/2018

The three events that are part of The New Intelligence are all about how businesses and service providers, and their customers, can benefit from artif…

Read More

TMC Launches The New Intelligence - an Unparalleled AI and Machine Learning Conference & Expo in Florida

By: TMCnet News    6/28/2018

TMC announced the launch of The New Intelligence conference and expo - The Event Powering the AI Revolution. This exciting new event will take place o…

Read More