Hacker Group Anonymous and Others Targeting Russian Data
By Jeremiah Fowler - Website Plant
via Iain Fraser Cybersecurity Journalist - Gibraltar
https://bit.ly/CyberJourno PR Wire
Researchers See Russian Databases Targeted With Files Erased and Folders Renamed With Pro Ukrainian Messages.
Together with the Website Planet research team we took an in-depth look at the cyberattacks targeting Russian websites, technology and cyber assets, perpetrated by the famous group, Anonymous. On the same day of Russia’s unprovoked attack against Ukraine, a Twitter account associated with the “Anonymous” hacking collective called on hackers from around the globe to target Russia and it appears that hackers are answering the call.
For the record; I am an American citizen who has lived and worked in Ukraine for nearly a decade. In the early morning hours of February 24th the Russian invasion of Ukraine began. I packed up a few belongings, computers, hard drives, and personal items and fled the city of Kyiv as fast as possible. By 7am there were already hours long lines to gas stations and major roadways were nearly stopped with traffic. It took 4 agonizing days to get to the Polish border where over 115,000+ Ukrainians had crossed in just the first 3 days alone.
Now temporarily based in Krakow, Poland and back online, I started searching to see what activity was happening online and what Russian information had been exposed following Anonymous’ call. As ethical security researchers, we are always looking for exposed data and information and never target any specific organization or geographic location. In our research for this report we were looking for publicly exposed data that was hosted on IPs located in the Russian Federation and using non-password protected cloud storage repositories, to understand what were the “cyber impacts” of the “real world events”. For the last few years pro-Russia hackers had been targeting Ukraine, and since Anonymous’ call we could see a turnaround in cyber activity now targeting Russia that we wanted to look closer into.
The most recurring event we saw were multiple data sets where the file names were changed to “Glory to Ukraine” (Слава Україні) – a reference to Ukraine’s battle for independence in 1918-1920. It was also the rallying cry of the “Revolution of Dignity” in 2014 that overthrew the Russian backed president Viktor Yanukovych and took Ukraine further away from Moscow. It was clear that hackers had accessed these databases, deleted files, and launched a cyber vandalism campaign leaving folders with names like: “putin stop this war”, “stop war”, “no war”, “HackedByUkraine”, and many other pro Ukrainian messages.
It appears that for the majority of the databases we reviewed, most of the files in the folders were wiped out and no longer appeared in the dataset. The anti-Russian hackers used a similar script to the infamous “MeowBot” that changed the name of folders and deleted the contents of the files. In August 2020 Security Discovery’s Bob Diachenko profiled the Meowbot attack that erased thousands of databases over the span of a few days and caused havoc on victims who lost their data and had no way to get it back. Unlike ransomware that encrypts data and demands a payment the MeowBot had no demands. The automated script seemed to have no other purpose except to wipe out data. Some of the activity in the Russian databases appears to be very similar to the 2020 MeowBot attacks (except that this time the demand is for the war to stop). Learn More/...
About Jeremiah Fowler
Jeremiah Fowler is a Security Researcher and co-founder of Security Discovery. Jeremiah began his career in security research in 2015 and has a mission of data protection. He has helped identify and secure the data of millions of people around the world. His discoveries have been covered in Forbes, BBC, Gizmodo, among others. Security and responsible disclosure are not only a passion, but a way of protecting our digital lives.
