Russian Hackers Linked to New Attacks Exploiting Windows Vulnerability

By

Russia has repeatedly made headlines in the upcoming U.S. election, with government-sponsored hackers allegedly responsible for accessing Democratic Party emails and then publishing them through WikiLeaks and other sources. Now Microsoft has given the hacking sources additional validity, claiming a group previously linked to the Russian government and U.S. political hacks is responsible for recent attacks that exploited a newly discovered Windows security flaw.

Microsoft revealed on its website that “spear phishing” emails had been sent from the Strontium hacking group, also known as “Fancy Bear” and “APT 28.” Those emails were used to launch a small number of attacks by exploiting Windows vulnerabilities. Microsoft is releasing a patch on Election Day, November 8, to protect users against the threat.

The timing of Microsoft’s announcement, as well as the patch release on Election Day, adds yet another element of chaos into what has proven to be a historically unusual and turbulent election cycle. And much in the spirit of the impending election, rivals Microsoft and Google were at each other’s throats over the timing of the vulnerability announcement. According to Microsoft, the attacks exploit a vulnerability in Adobe’s Flash software as well as the Windows OS. Adobe released a patch for its vulnerability on Monday, and Google promptly went public with details of the attacks – well before Microsoft’s patch was prepared and available.

“Google’s decision to disclose these vulnerabilities before patches are broadly available and tested is disappointing, and puts customers at increased risk,” said Microsoft in a statement, while Google had no comment on the issue.

According to John Bambenek, threat systems manager at Fidelis Cybersecurity, a company specializing in threat detection and security, early disclosure was the right move in this scenario, and will protect more enterprises in the long run.

“There will always be a risk with acknowledging weakness,” said Bambenek. “Even releasing patches can give adversaries the very clues needed to weaponize and exploit. This was very much true with Microsoft patches years ago, which have been largely mitigated by automated patching and rebooting within 24 hours of release.”

“While we don’t have solid data to talk about how widely it is being used, we do know that this vulnerability is dangerous,” added Bambenek. “It's a local privilege escalation, which means that if a user can execute compromised code, that code could be used to run commands as the administrator and more deeply embed itself into a system. At this point, my preference is to release mitigation strategies so that enterprises can protect their users while awaiting a patch.”

The Fancy Bear hacking group has been primarily tied to GRU, Russia’s military intelligence agency. The group has been widely blamed for the recent hacks of Democratic Party databases and emails.




Edited by Alicia Young

TechZone360 Contributing Editor

SHARE THIS ARTICLE
Related Articles

How Your Company Can Maintain Its Cybersecurity in 2021 and Beyond

By: Special Guest    9/17/2021

Cybercrimes are continually on the rise, bringing more threats to organizations in the pandemic than before. Statistics show that as early as March…

Read More

Is Mining Cryptocurrency Still Viable?

By: Special Guest    9/17/2021

As cryptocurrency continues to grow, more and more people are getting in on the action. But is it worth mining? Click here to find out more.

Read More

The World Will Change With Bitcoin

By: Special Guest    9/15/2021

Financial freedom may increase more efficiently with digital currency than ever before. The consequences of this are profound. Millions of people …

Read More

From Driver's Licenses Proof of Vaccination to Fishing Licenses, the World is Going All-Digital

By: Erik Linask    9/13/2021

The State of Louisiana's LA Wallet app will soon allow users to upload not only digital driver's licenses and COVID-19 vaccination status, but also hu…

Read More

Apple Must Now Allow Alternative Direct Payment Options In App Store, Judge Rules

By: Luke Bellos    9/10/2021

A California judge ruled that Apple has not been proven to be a monopoly, but is participant in anti-competitive practices within the company's digita…

Read More