Menu
Malware used in White House and State Department hacks possibly linked to Russia

Malware used in White House and State Department hacks possibly linked to Russia

The malware is related to the MiniDuke, CosmicDuke and OnionDuke cyberespionage tools, researchers from Kaspersky Lab found

The group of attackers behind cyberintrusions at the White House and the Department of State last year used malware that bears strong similarities to cyberespionage tools suspected to be of Russian origin.

Security researchers from Kaspersky Lab have dubbed the cyberespionage group CozyDuke and said that it has blatantly targeted high-profile victims since the second half of last year. Its toolset includes malware droppers, information-stealing programs and backdoors that have antivirus evasion capabilities and make use of cryptography, the researchers said Tuesday a blog post.

More importantly, technical evidence suggests that some of the CozyDuke malware has strong "functional and structural similarities" to known components of the MiniDuke, CosmicDuke and OnionDuke cyberespionage tools, the Kaspersky researchers said.

Those three threats have been used to attack NATO members and European governments over the past two years and are believed to be related.

While the Kaspersky researchers did not discuss CozyDuke's possible origins in their blog post, researchers from other companies who analyzed MiniDuke, CosmicDuke and OnionDuke in the past believe they are the work of the Russian government.

In a January blog post, researchers from F-Secure noted that none of the high-profile CosmicDuke or OnionDuke targets were from Russia. The only victims detected in Russia had links to illegal substances, suggesting that those spyware tools might be used in support of law enforcement investigations in the country.

"Considering the victims of the law enforcement use case seem to be from Russia, and none of the high-profile victims are exactly pro-Russian, we believe that a Russian government agency is behind these operations," the F-Secure researchers concluded.

The possible link between the State Department security breach last year and Russian hackers has been noted before. In February, the Wall Street Journal reported that five unnamed people familiar with the intrusion had seen or had been told of links between the malware used in the attack and the Russian government.


Follow Us

Join the newsletter!

Error: Please check your email address.

Tags intrusionsecuritydata breachf-securespywaremalwarekaspersky lab

Featured

Slideshows

Channel celebrates as HP marks 50 years in NZ

Channel celebrates as HP marks 50 years in NZ

HP marked 50 years in New Zealand at an event in the vendor's Auckland's headquarters last night, with a host of key channel figures coming along to celebrate. Photos by HP.

Channel celebrates as HP marks 50 years in NZ
EDGE 2017 - Icebreaker Sessions round 2

EDGE 2017 - Icebreaker Sessions round 2

EDGE guests experience the value of networking at the second round of Icebreaker sessions.. Photos by Maria Stefina

EDGE 2017 - Icebreaker Sessions round 2
Show Comments