Russian hackers target MH17 journalists for embarrassing Putin

State threat actors are a reality for today's scribes

Journalists investigating the downing of the MH17 flight over eastern Ukraine in 2014 have been hacked by Russia, according to security intelligence outfit ThreatConnect.

The Joint Investigation Team (JIT) recently announced that Malaysia Airlines flight MH17 was shot down over Eastern Ukraine in July 2014 by a missile transported from Russia.

Investigative journalism group Bellingcat, whose reports were consulted by the JIT during the investigation, were targeted in a series of sophisticated hacks.

These assaults included spearphishing, credential harvesting, SMS spoofing and more, as explained in a blog post by ThreatConnect (extract below).

[Bellingcat founder Eliot] Higgins shared data with ThreatConnect that indicates Bellingcat has come under sustained targeting by Russian threat actors, which allowed us to identify a 2015 spearphishing campaign that is consistent with FANCY BEAR’s tactics, techniques, and procedures. We also analyzed a February 2016 attack by CyberBerkut – a group claiming to be pro-Russian Ukrainian hacktivists but also a suspected front for Moscow – against Russia-based Bellingcat contributor Ruslan Leviev, where CyberBerkut defaced the Bellingcat website and leaked Leviev’s personal details.

ThreatConnect’s research shows a “similarity in the attack patterns to those adopted by Russia” against other targets to those slung against Bellingcat.

“Organisations which negatively impact Russia’s image can expect cyber operations intended to retaliate or maliciously affect them,” ThreatConnect notes, adding that the assault is “symptomatic of a wider trend of state actors attempting to hack and disrupt private enterprises” such as the recent hacks against the World Anti-Doping Agency.

Previous research by Trend Micro fingered Russian hackers as prime suspects in the attempted theft of sensitive data from the team investigating the downed Malaysia Airlines MH17 flight. ®