A Russian-speaking hacker has been linked to a global cyber operation breaching numerous organizations to collect credentials and facilitate access sales to ransomware groups. This operation has impacted sectors such as education, healthcare, financial services, telecommunications, and government bodies, among others, particularly those with internet-facing systems vulnerable to attack.
Global Breach and Credential Theft
The hacker reportedly targeted exposed security appliances and public applications, exploiting known software vulnerabilities to infiltrate networks. Once inside, the attacker gathered passwords and moved through the internal systems, sometimes achieving full control over company identity systems. CloudSEK researchers identified this activity after discovering a server with detailed records of the hacker’s operations.
CloudSEK’s report, shared with Cyber Security News, suggests the hacker acts as an initial access broker, selling network access to external ransomware groups rather than conducting direct ransomware attacks. This highlights the risks of a single security breach leading to broader criminal activities, where stolen access can be sold or reused by other malicious actors.
Exploiting Vulnerabilities Across Nations
The findings indicate the hacker conducted large-scale scans across more than a dozen countries, staging exploits for at least 12 vulnerabilities across products from companies like Fortinet, F5, SonicWall, and others. Most exploit codes were public proof-of-concept materials, albeit slightly modified for this operation, allowing the hacker to target numerous vulnerable systems efficiently.
After gaining access, the operator used web shells and network tunnels to penetrate Windows systems within victim environments. Stolen NTLM password hashes facilitated remote authentication, and credential stores were harvested to expand access within the networks. In confirmed cases, the attacker managed to forge enduring Kerberos authentication tickets, suggesting a complete compromise of Active Directory systems.
Espionage Activities in Ukraine
Shifting focus, the operation also targeted Ukrainian defense and aerospace organizations. The hacker deployed command-and-control tools like Sliver, accessed exposed source-code repositories, and gathered intelligence beyond typical corporate access sales. Investigators found images from internet-facing IP cameras and screenshots from remote desktop sessions, indicating a surveillance motive.
This espionage overlaps with reports of Russian-linked actors monitoring cameras near critical infrastructure in Ukraine. CloudSEK assesses that this operation likely served state intelligence needs, though direct links to state-sponsored activities remain unconfirmed. The shared infrastructure and tools used hint at a blend of criminal and espionage objectives.
Organizations are advised to enhance their cybersecurity measures by removing internet exposure of administrative interfaces, applying patches promptly, and treating stolen configuration backups as full network exposures. Additional steps include rotating credentials, monitoring for unauthorized access, and addressing potential domain compromises.
Strengthening Cyber Defenses
To mitigate such threats, organizations should review and tighten their cybersecurity protocols, focusing on securing internet-facing systems and promptly addressing known vulnerabilities. Regular monitoring and updating of security systems can help prevent unauthorized access and minimize the risks posed by sophisticated cyber threats.
