New Findings Problem Attribution in Denmark’s Vitality Sector Cyberattacks

Jan 14, 2024NewsroomCyber Assault / Vulnerability

The cyber assaults focusing on the vitality sector in Denmark final yr might not have had the involvement of the Russia-linked Sandworm hacking group, new findings from Forescout present.

The intrusions, which focused round 22 Danish vitality organizations in Might 2023, occurred in two distinct waves, one which exploited a safety flaw in Zyxel firewall (CVE-2023-28771) and a follow-on exercise cluster that noticed the attackers deploy Mirai botnet variants on contaminated hosts through an as-yet-unknown preliminary entry vector.

The primary wave passed off on Might 11, whereas the second wave lasted from Might 22 to 31, 2023. In a single such assault detected on Might 24, it was noticed that the compromised system was speaking with IP addresses (217.57.80[.]18 and 70.62.153[.]174) that had been beforehand used as command-and-control (C2) for the now-dismantled Cyclops Blink botnet.

Forescout’s nearer examination of the assault marketing campaign, nevertheless, has revealed that not solely had been the 2 waves unrelated, but in addition unlikely the work of the state-sponsored group owing to the actual fact the second wave was a part of a broader mass exploitation marketing campaign in opposition to unpatched Zyxel firewalls. It is at present not recognized who’s behind the dual units of assaults.

“The marketing campaign described because the ‘second wave’ of assaults on Denmark, began earlier than and continued after [the 10-day time period], focusing on firewalls indiscriminately in a really comparable method, solely altering staging servers periodically,” the corporate stated in a report aptly titled “Clearing the Fog of Struggle.”

There may be proof to recommend that the assaults might have began as early as February 16 utilizing different recognized flaws Zyxel gadgets (CVE-2020-9054 and CVE-2022-30525) alongside CVE-2023-28771, and persevered as late as October 2023, with the exercise singling out varied entities throughout Europe and the U.S.

“That is additional proof that exploitation of CVE-2023-27881, slightly than being restricted to Danish essential infrastructure, is ongoing and focusing on uncovered gadgets, a few of which simply occur to be Zyxel firewalls safeguarding essential infrastructure organizations,” Forescout added.