The EU has imposed the first ever sanctions against cyber-attacks. These include six individuals and three entities accused of carrying out the WannaCry, NotPetya and Cloud Hopper attacks. The sanctions imposed include a travel ban and asset freeze.
John Hultquist, Senior Director of Analysis, Mandiant Threat Intelligence comments:
“The European Union imposed sanctions against multiple people and organizations for their role in a number of cyberattacks and cyber espionage incidents. The sanctions are tied to the NotPetya and Ukraine blackout attacks carried out by the GRU as well as an act of cyber espionage that was attempted against the OPCW by that same organization. WannaCry was another global destructive event similar to the NotPetya incident that posed as ransomware, though it was carried out by North Korean actors. Cloud Hopper was a long term complex cyber espionage operation that targeted managed service providers to gain access to third parties that was carried out by Chinese contractors working on behalf of the Ministry of State Security.
NotPetya and WannaCry were two of the most devastating cyberattacks in history, causing billions of dollars in damage and disrupting many vital systems, such as those belonging to the UK’s NHS. At least one victim of NotPetya has claimed 1.3 billion dollars in damage. The NotPetya attack was carried out by the GRU actors known as Sandworm who had previously conducted two attacks on Ukraine’s grid. Those same actors attempted a destructive attack on the Pyeongchang Olympics though no government statement has accused the Russian government for their role in that incident.
The Cloud Hopper campaign was a complex intelligence collection operation that was meant to gather intelligence rather than disrupt systems. APT10 gained access to Managed Service Providers as a means to then target their customers – organizations who used those providers to host their IT. China and others continue this type of activity, moving upstream to telecommunications and IT providers where they can gain access to multiple organizations and individuals simultaneously.
The GRU was also behind an attempt to hack the OPCW’s WI-FI network by physically visiting their facilities in the Hague. That operation was disrupted but the unit had been involved in similar operations in Switzerland, Brazil, and Malaysia which targeted the Olympics and other investigations involving Russia. The consistent use of physical human intelligence teams to supplement its intrusion efforts makes the GRU a particularly effective adversary. Sanctions may be particularly effective for disrupting this activity as they may hinder the free movement of this unit.”
Share this article on Twitter or LinkedIn.
See more news here.
