Russia-linked GRU Unit 29155 targeted critical infrastructure globally

The United States and its allies state that Russia-linked threat actors operating under the GRU are behind global critical infrastructure attacks.

The FBI, CISA, and NSA linked threat actors from Russia’s GRU Unit 29155 to global cyber operations since at least 2020. These operations include espionage, sabotage, and reputational damage. The United States and its allies state that GRU is behind global critical infrastructure attacks.

Starting January 13, 2022, the group employed the WhisperGate wiper in attacks against Ukrainian organizations. The government expert pointed out that Unit 29155 operates independently from other GRU-affiliated groups like Unit 26165 and Unit 74455.

Russia’s GRU Unit 29155 is also responsible for attempted coups, influence operations, and assassination attempts across Europe. Since 2020, the unit has expanded into offensive cyber operations aimed at espionage, reputational harm, and data destruction. The FBI believes the unit’s cyber actors are junior GRU officers gaining experience under senior leadership. They also rely on non-GRU actors, including cybercriminals, to carry out their operations.

The FBI, NSA, and CISA assess that Russia’s GRU Unit 29155 is responsible for various activities such as attempted coups, sabotage, influence operations, and assassination attempts across Europe. Since 2020, the unit has expanded into offensive cyber operations aimed at espionage, reputational harm, and data destruction. The FBI believes the unit’s cyber actors are junior GRU officers gaining experience under senior leadership. They also rely on non-GRU actors, including cybercriminals, to carry out their operations.

“FBI assesses the Unit 29155 cyber actors to be junior active-duty GRU officers under the direction of experienced Unit 29155 leadership. These individuals appear to be gaining cyber experience and enhancing their technical skills through conducting cyber operations and intrusions.” reads the joint advisory. “Additionally, FBI assesses Unit 29155 cyber actors rely on non-GRU actors, including known cyber-criminals and enablers to conduct their operations.”

GRU Unit 29155 has been conducting cyber operations against NATO members, European countries, Latin America, and Central Asia. The threat actors targeted critical infrastructure sectors such as government, finance, transportation, energy, and healthcare. Their activities include website defacement, infrastructure scanning, data exfiltration, and leaking stolen data. Since 2022, the unit focused on disrupting aid efforts for Ukraine.

“To date, the FBI has observed more than 14,000 instances of domain scanning across at least 26 NATO members and several additional European Union (EU) countries. Unit 29155 cyber actors have defaced victim websites and used public website domains to post exfiltrated victim information.” continues the report. “Whether through offensive operations or scanning activity, Unit 29155 cyber actors are known to target critical infrastructure and key resource sectors, including the government services, financial services, transportation systems, energy, and healthcare sectors of NATO members, the EU, Central American, and Asian countries.”

GRU Unit 29155 targeted government and critical infrastructure by exploiting IP ranges using publicly available tools for scanning and vulnerability exploitation. The group only relies on common red-teaming techniques and tools like Raspberry Robin and SaintBot, often overlapping with other cyber actors, making it harder to attribute its activities. The nation-state actor attempted to exploit flaws in internet-facing systems, including Dahua IP cameras, to gain initial access. Using Shodan, they identify IoT devices and leverage default credentials to execute remote commands and exfiltrate data, including images and plaintext credentials.

Since 2020, Unit 29155 actors used virtual private servers (VPSs) to host tools, conduct reconnaissance, exploit victim systems, and exfiltrate data. Once successfully exploited a system, the attackers deplyed a Meterpreter payload and established communication through reverse TCP connections to their infrastructure. These reverse TCP sessions are initiated via specific ports, facilitating further control and data extraction from the compromised systems.

The joint advisory also includes tactics, techniques, and procedures associated with Unit 29155 along with mitigations.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Russia)