Russian Hacking Group is Targeting Corporate IoT Devices, Microsoft Researchers Say

Russian Hacking Group is Targeting Corporate IoT Devices, Microsoft Researchers Say

The state-sponsored hackers, best known as Fancy Bear, attempted to compromise popular IoT devices like office printers and a VOIP phone.

A state-sponsored Russian hacking group is targeting IoT devices as a strategy to breach corporate networks, Microsoft revealed in a Monday blog post.

The security threats were first noted in April by security researchers working for the Microsoft Threat Intelligence Center, a cybersecurity unit of the company. Further research by the group found that the “known adversary” was attempting to compromise popular IoT devices, including a VOIP phone, an office printer and a video decoder, according to the post.

“The investigation uncovered that an actor had used these devices to gain initial access to corporate networks,” the post reads. “These devices became points of ingress from which the actor established a presence on the network and continued looking for further access.”

The hacking group is identified by Microsoft as Strontium, but it is also known by the names APT28 and Fancy Bear. Strontium was previously involved in the hack of the Democratic National Committee during the 2016 election cycle and has been identified by U.S. intelligence officials as a unit of the Russian military intelligence agency GRU, ZDNet reported.

Because the company identified and blocked the attacks so early, the researchers said they were not able to “conclusively determine” what the hackers’ ultimate objectives were in carrying out the breaches.

Read more: IoT Security: Current Threats and How to Overcome Them

In the last 12 months, Microsoft has delivered nearly 1,400 notifications to those who have been targeted or compromised by the hacking group. The researchers also notified the manufacturers of the products that were compromised, prompting the companies to consider additional security measures, according to the blog post.

“One in five notifications of STRONTIUM activity were tied to attacks against non-governmental organizations, think tanks, or politically affiliated organizations around the world,” the researchers wrote, adding that the remaining 80 percent largely targeted organizations in government, military, medicine and education, among others. Olympic organizing committees and anti-doping agencies were also among the victims.

The research team said they were sharing information about the breaches to raise awareness of IoT security risks and issue a call to action regarding the enterprise integration of IoT devices. In their post, the researchers note that the number of deployed IoT devices outnumber the combined total of personal computers and mobile phones.

“With each networked IoT device having its own separate network stack, it’s quite easy to see the need for better enterprise management, especially in today’s ‘bring your own device’ world,” the post reads. “These simple attacks taking advantage of weak device management are likely to expand as more IoT devices are deployed in corporate environments.”

Microsoft’s recommendations for securing enterprise IoT devices include developing custom security policies on each IoT device, using a separate network for those devices if feasible, and monitoring devices for abnormal behavior.

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • Maximizing Your Security Budget This Year

    The Importance of Proactive Security Measures: 4 Stories of Regret

    We all want to believe that crime won’t happen to us. So, some business owners hope for the best and put proactive security measures on the back burner, because other things like growth, attracting new customers, and meeting deadlines all seem more pressing. Read Now

  • New Uses for AI

    New applications of AI in IP cameras are delivering precise detection, robust search capabilities, elevated data analysis and enhanced image quality. When combined with built-in analytics, AI can help streamline forensic investigations and also supports several mission-critical business functions. Read Now

  • The Critical Missing Piece

    As technology advances, security programs have invested heavily in advanced systems and sensors. These sensors generate massive amounts of data, often overwhelming the security teams tasked with monitoring them. AI technology promises to sift through this data, using logic and reasoning to differentiate potential threats from non-threats. Read Now

  • Computers Beginning to Come Back Online After CrowdStrike Caused Crash Friday

    Computers around the world are beginning to come back online after a defective update to Windows machines from cybersecurity provider CrowdStrike Friday affected almost 9 million machines. Read Now

Featured Cybersecurity

Webinars

New Products

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file. 3

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3