Russian hacking group targeted US military contractors

A hacking group tied to Russian intelligence tried to worm its way into the systems of dozens of Western think tanks, journalists and former military and intelligence officials, Microsoft and U.S. authorities said Thursday.

The group, known as Star Blizzard to cyberespionage experts, targeted its victims with emails that appeared to come from a trusted source — a tactic known as spear phishing. In fact, the emails sought access to the victims’ internal systems, as a way to steal information and disrupt their activities.

Star Blizzard's actions were persistent and sophisticated, according to Microsoft, and the group often did detailed research on its targets before launching an attack. Star Blizzard also went after civil society groups, U.S. companies, American military contractors and the Department of Energy, which oversees many nuclear programs, the company said.

On Thursday, a U.S. court unsealed documents authorizing Microsoft and the Department of Justice to seize more than 100 website domain names associated with Star Blizzard. That action came after a lawsuit was filed against the network by Microsoft and the NGO-Information Sharing and Analysis Center, a nonprofit tech organization that investigated Star Blizzard.

Authorities haven't gone into details about Star Blizzard's effectiveness but said they expect Russia to keep deploying hacking and cyberattacks against the U.S. and its allies.

“The Russian government ran this scheme to steal Americans’ sensitive information, using seemingly legitimate email accounts to trick victims into revealing account credentials,” Deputy Attorney General Lisa Monaco said in announcing the U.S. actions against Star Blizzard. “With the continued support of our private sector partners, we will be relentless in exposing Russian actors and cybercriminals and depriving them of the tools of their illicit trade.”

Star Blizzard has been linked to Russia’s Federal Security Service, or FSB. Last year, British authorities accused the group of mounting a yearslong cyberespionage campaign against U.K. lawmakers. Microsoft said it has been tracking the group’s activities since 2017.

Microsoft said it observed Star Blizzard attempt dozens of hacking efforts targeting 30 different groups since January 2023. The tech giant's cybersecurity experts say Star Blizzard has proven to be especially elusive.

“Star Blizzard’s ability to adapt and obfuscate its identity presents a continuing challenge for cybersecurity professionals,” the company wrote in a report on its findings.

U.S. authorities charged two Russian men last year in connection with Star Blizzard's past actions. Both are believed to be in Russia.

Along with American targets, Star Blizzard went after people and groups throughout Europe and in other NATO countries. Many had supported Ukraine following Russia's invasion.

A message left with the Russian Embassy in Washington was not immediately returned Thursday.

微软和美国当局周四表示，一个与俄罗斯情报部门有关联的黑客组织试图入侵数十家西方智库、记者以及前军事和情报官员的系统。

这个被网络间谍专家称为“星际暴雪”（Star Blizzard）的组织，利用看似来自可信来源的电子邮件来攻击受害者——这种策略被称为鱼叉式网络钓鱼。实际上，这些邮件旨在获取受害者内部系统的访问权限，从而窃取信息并干扰其正常运营。

微软表示，Star Blizzard 的行动持续且老练，该组织通常会在发动攻击前对目标进行详细研究。微软还称，Star Blizzard 的攻击目标包括民间团体、美国公司、美国军工承包商以及负责监管众多核项目的美国能源部。

周四，美国一家法院解封了授权微软和司法部查封与Star Blizzard相关的100多个网站域名的文件。此前，微软和非政府组织信息共享与分析中心（一家曾对Star Blizzard进行调查的非营利性科技机构）对该公司提起了诉讼。

当局尚未详细说明“星际暴雪”的有效性，但表示预计俄罗斯将继续对美国及其盟友发动黑客攻击和网络攻击。

“俄罗斯政府实施了这项计划，旨在窃取美国公民的敏感信息。他们利用看似合法的电子邮件账户诱骗受害者泄露账户凭证，”美国副司法部长丽莎·莫纳科在宣布美国对星际暴雪公司采取行动时表示。“在私营部门合作伙伴的持续支持下，我们将不遗余力地揭露俄罗斯网络犯罪分子，并剥夺他们进行非法活动的工具。”

Star Blizzard 与俄罗斯联邦安全局（FSB）存在关联。去年，英国当局指控该组织对英国议员进行了长达数年的网络间谍活动。微软表示，自 2017 年以来，他们一直在追踪该组织的活动。

微软表示，自 2023 年 1 月以来，他们观察到 Star Blizzard 针对 30 个不同的组织发起了数十次黑客攻击。这家科技巨头的网络安全专家表示，Star Blizzard 已被证明尤其难以捉摸。

“Star Blizzard 不断调整自身并混淆身份的能力，对网络安全专业人员构成了持续的挑战，”该公司在一份调查报告中写道。

去年，美国当局指控两名俄罗斯男子与星际暴雪公司过去的违法行为有关。据信两人目前都身在俄罗斯。

除了美国本土的目标外，“星际暴雪”组织还将目标对准了欧洲及其他北约国家的个人和团体。其中许多人曾在俄罗斯入侵乌克兰后支持过乌克兰。

周四，记者致电俄罗斯驻华盛顿大使馆，但尚未收到回复。