Russian Hacking Group is Targeting Corporate IoT Devices, Microsoft Researchers Say

Russian Hacking Group is Targeting Corporate IoT Devices, Microsoft Researchers Say

The state-sponsored hackers, best known as Fancy Bear, attempted to compromise popular IoT devices like office printers and a VOIP phone.

A state-sponsored Russian hacking group is targeting IoT devices as a strategy to breach corporate networks, Microsoft revealed in a Monday blog post.

The security threats were first noted in April by security researchers working for the Microsoft Threat Intelligence Center, a cybersecurity unit of the company. Further research by the group found that the “known adversary” was attempting to compromise popular IoT devices, including a VOIP phone, an office printer and a video decoder, according to the post.

“The investigation uncovered that an actor had used these devices to gain initial access to corporate networks,” the post reads. “These devices became points of ingress from which the actor established a presence on the network and continued looking for further access.”

The hacking group is identified by Microsoft as Strontium, but it is also known by the names APT28 and Fancy Bear. Strontium was previously involved in the hack of the Democratic National Committee during the 2016 election cycle and has been identified by U.S. intelligence officials as a unit of the Russian military intelligence agency GRU, ZDNet reported.

Because the company identified and blocked the attacks so early, the researchers said they were not able to “conclusively determine” what the hackers’ ultimate objectives were in carrying out the breaches.

Read more: IoT Security: Current Threats and How to Overcome Them

In the last 12 months, Microsoft has delivered nearly 1,400 notifications to those who have been targeted or compromised by the hacking group. The researchers also notified the manufacturers of the products that were compromised, prompting the companies to consider additional security measures, according to the blog post.

“One in five notifications of STRONTIUM activity were tied to attacks against non-governmental organizations, think tanks, or politically affiliated organizations around the world,” the researchers wrote, adding that the remaining 80 percent largely targeted organizations in government, military, medicine and education, among others. Olympic organizing committees and anti-doping agencies were also among the victims.

The research team said they were sharing information about the breaches to raise awareness of IoT security risks and issue a call to action regarding the enterprise integration of IoT devices. In their post, the researchers note that the number of deployed IoT devices outnumber the combined total of personal computers and mobile phones.

“With each networked IoT device having its own separate network stack, it’s quite easy to see the need for better enterprise management, especially in today’s ‘bring your own device’ world,” the post reads. “These simple attacks taking advantage of weak device management are likely to expand as more IoT devices are deployed in corporate environments.”

Microsoft’s recommendations for securing enterprise IoT devices include developing custom security policies on each IoT device, using a separate network for those devices if feasible, and monitoring devices for abnormal behavior.

About the Author

Haley Samsel is an Associate Content Editor for the Infrastructure Solutions Group at 1105 Media.

Featured

  • Security Today Launches 2023 Government Security Awards

    Security Today Launches 2023 Government Security Awards

    Security Today is proud to announce the launch of the 2023 Government Security Awards. The Govies honor outstanding government security products in a variety of categories. For this year’s awards program, participants can choose from 38 different categories to enter their product(s) into. Read Now

  • Back to the Basics

    Back to the Basics

    Security is a continuous evolution of practices and procedures. The developments in technology and advancements in threats make security difficult at times. Although security from one location may look different from another location, there is a common goal applied to security measures. The common goal is protection. Read Now

  • The Top Three Security Trends in 2023

    The Top Three Security Trends in 2023

    As security technology has become more widely used, the interest in new capabilities and increased security measures has increased. As we head into 2023, these three trends will shape the security landscape. Read Now

  • TSA Breaks Record Nationally and in Washington for Firearm Discoveries in 2022

    TSA Breaks Record Nationally and in Washington for Firearm Discoveries in 2022

    Transportation Security Administration (TSA) officers in Washington detected 164 firearms in travelers’ carry-on luggage in 2022, with the majority of the firearms discovered at Seattle-Tacoma International Airport’s (SEA) security checkpoints. Read Now

Featured Cybersecurity

New Products

  • Hanwha Techwin Wisenet XRN-6410DB4 / mXRN-3210B4

    Hanwha Techwin Wisenet XRN-6410DB4 / mXRN-3210B4

    Hanwha Techwin America, a global supplier of IP and analog video surveillance solutions, unveiled two new Wisenet X series NVRs that support the industry’s first video playback and recording of up to 8K super-high-resolution images. 3

  • Kangaroo Home Security System

    Kangaroo Home Security System

    Kangaroo is the affordable, easy-to-install home security system designed for anyone who wants an added layer of peace of mind and protection. It has several products, ranging from the fan-favorite Doorbell Camera + Chime, to the more comprehensive Front Door Security Kit with Professional Monitoring. Regardless of the level of desired security, Kangaroo’s designed to move with consumers - wherever that next chapter may be. Motion sensors, keypads and additional features can be part of the package to any Kangaroo system in place, anytime. Additionally, Kangaroo offers scalable protection plans with a variety of benefits ranging from 24/7 professional monitoring to expanded cloud storage, coverage for damage and theft. 3

  • Altronix eFlow

    Altronix eFlow™ Dual Voltage Access Control Kits

    Altronix has launched an enhanced line of eFlow™ power supply/charger kits that provide 12 and 24VDC simultaneously for locking devices and peripherals. 3