Amazon Threat Intelligence identifies Russian cyber threat group targeting Western critical infrastructure

This article details Amazon Threat Intelligence's discovery of a Russian state-sponsored cyber campaign targeting Western critical infrastructure, particularly the energy sector, from 2021-2025.

• Russian GRU-linked threat group shifted tactics from exploiting vulnerabilities to targeting misconfigured network edge devices
• Campaign focuses on energy sector organizations across North America, Europe, and other regions
• Attackers compromise customer network devices hosted on AWS to harvest credentials via packet capture
• Harvested credentials replayed against victim organizations' online services and infrastructure
• Infrastructure overlaps suggest coordination with "Curly COMrades" group tracked by Bitdefender
• Organizations should audit network edge devices, monitor for credential replay, and implement strong authentication
• AWS recommends using IAM roles, security groups, VPC Flow Logs, Amazon Inspector, CloudTrail, and GuardDuty
• Eight indicators of compromise (IOCs) provided for detection and investigation

Organizations must prioritize securing network edge devices and implementing credential replay detection to defend against this persistent state-sponsored threat.