Fancy Bear hackers used IoT devices to hack corporate networks

A state-sponsored hacking group from Russia is targeting IoT devices in order to breach corporate networks which are then used to pivot to more high-value targets.

According to the Microsoft Threat Intelligence Center, attacks have been observed in the wild and Microsoft attributes these attacks to a group it calls Strontium which is also commonly known as either APT 28 or Fancy Bear.

The group played a significant role in the DNC hack of 2016 and thanks to an indictment filed in 2018 by US officials, we now know that it has been identified as Unit 26165 and Unit 74455 of the Russian military intelligence agency GRU.

Back in April of this year, Microsoft’s security researchers discovered that Fancy Bear attempted “to compromise popular IoT devices across multiple customer locations”.

IoT security

According to Microsoft, Fancy Bear tried to gain access to a VOIP phone, an office printer and a video decoder. The company provided further details on its investigation into the group’s activities in a blog post, saying:

“The investigation uncovered that an actor had used these devices to gain initial access to corporate networks. In two of the cases, the passwords for the devices were deployed without changing the default manufacturer’s passwords and in the third instance the latest security update had not been applied to the device.”

Apparently the hackers were using compromised IoT devices as an entry point into their targets’ internal networks. Once inside, they would scan for other vulnerable systems which were then used to expand their initial foothold.

Fortunately Microsoft was able to block these attacks in their early stages but this means that it investigators won’t be able to determine exactly what Fancy Bear was attempting to steal from the compromised networks. The company will reveal additional details regarding Fancy Bear’s activities online at this year’s Black Hat USA security conference.

IoT devices are increasingly under attack by hackers as many of them are protected by just a default password which is why the first thing you should do when setting up a new device is to change its password to something both unique and strong.

Source: TechRadar