Russian state hackers hijacked rival servers to spy on targets in India, Afghanistan

Category	Details
Threat Actors	Secret Blizzard (also known as Turla), Storm-0156
Campaign Overview	Russian state-sponsored hackers (Secret Blizzard) infiltrated Storm-0156 infrastructure to target Afghan and Indian government agencies and institutions.
Target Regions (Victims)	Afghanistan (government, intelligence), India (military, defense-related institutions)
Methodology	Secret Blizzard used infrastructure of Storm-0156 to deploy its own malware and exploit data exfiltrated by Storm-0156.
Product Targeted	Afghan and Indian government, intelligence agencies, military and defense-related institutions.
Malware Reference	TwoDash, Statuezy, Wainscot, CrimsonRAT
Tools Used	Wainscot, CrimsonRAT (appropriated from Storm-0156)
Vulnerabilities Exploited	Exploitation of compromised infrastructure from Storm-0156
TTPs	Infiltration via third-party infrastructure, malware deployment, and shifting blame to other threat actors.
Attribution	Secret Blizzard attributed to Russia’s Federal Security Service (FSB), associated with Turla, Waterbug, and other Russian threat actors.
Recommendations	Monitoring and securing infrastructure, blocking unauthorized use of exfiltrated data, strengthening defenses against third-party infrastructure misuse.
Source	The Records

Read full article: https://therecord.media/russian-turla-secret-blizzard-hackers-hijack-rival-servers-targeting-south-asia

Disclaimer: The above summary has been generated by an AI language model