Full Report
A Kremlin-backed group tracked as Secret Blizzard or Turla recently used existing cybercrime infrastructure for an espionage campaign aimed at Ukrainian military devices.
Analysis Summary
# Threat Actor: Secret Blizzard
## Attribution & Identity
* **Identification:** Kremlin-backed hackers, likely linked to Russia’s Federal Security Service (FSB).
* **Aliases and Associated Groups:** Turla. The group has been observed hijacking tools and infrastructure from other Russian cybercriminal groups (e.g., Storm-1919, Storm-1837).
## Activity Summary
Secret Blizzard has been engaging in espionage campaigns primarily targeting Ukraine's military by repurposing infrastructure and tools from independent cybercriminal groups. This tactic is used to diversify attack vectors and complicate attribution.
* **Recent Campaigns (Specific to Ukraine):**
* **March-April Campaign:** Appropriated the Amadey tool (associated with Storm-1919) to gather system information, check for antivirus, and deploy the Tavdig backdoor on devices associated with the Ukrainian military, including those using Starlink satellite internet.
* **January Campaign:** Used the backdoor of Storm-1837 to download the Tavdig and KazuarV2 backdoors onto Ukrainian targets.
* **Other Activities:** Previously targeted government-related entities in India and Afghanistan using infrastructure associated with a Pakistan-based cyber-espionage group.
## Tactics, Techniques & Procedures
* Repurposing tools and infrastructure from other threat actors to mask origin and complicate attribution ("Frequent Freeloader" approach).
* Using the Amadey tool for initial reconnaissance (gathering system information, checking AV status).
* Deploying custom backdoors for persistent access and surveillance.
* Long-term intelligence collection and data exfiltration.
- **Specific TTPs/Malware:** Tavdig backdoor, KazuarV2 backdoor.
## Targeting
* **Sectors:** Military, government offices, ministries of foreign affairs, defense departments, and defense-related companies.
* **Geography:** Ukraine (primary focus mentioned), India, and Afghanistan.
* **Victims:** Ukrainian military devices (including those using Starlink), government-related targets in India and Afghanistan.
## Tools & Infrastructure
* **Malware Families Used:**
* Tavdig backdoor
* KazuarV2 backdoor (designed for long-term intelligence collection and exfiltration)
* Amadey (appropriated from Storm-1919, likely used for initial access/reconnaissance)
* **Infrastructure:** Used infrastructure provided or previously controlled by other Russian threat actors (Storm-1919, Storm-1837), and potentially purchased access to Amadey C2 infrastructure.
## Implications
Secret Blizzard remains a high-level Russian state-sponsored espionage threat. Their shift toward appropriating cybercriminal tools suggests an effort to increase operational security (OPSEC) and frustrate attribution efforts, potentially making detection more difficult for defenders who might overlook infrastructure shared across criminal and espionage actors. Their focus on Ukraine's military, specifically devices utilizing Starlink, highlights an interest in critical wartime communications infrastructure.
## Mitigations
* Implement enhanced monitoring on systems, especially those that interact with critical/sensitive networks, for post-compromise activity indicative of standard espionage tools (e.g., Tavdig, KazuarV2).
* Monitor for indicators of compromise associated with known cybercriminal tools (like Amadey) being deployed in conjunction with known espionage activity, as this may indicate actor blending.
* Ensure robust network segmentation, particularly safeguarding sensitive military and government endpoints.
* Monitor for exploitation of infrastructure used by threat actors known to operate in the Russian cybercrime ecosystem.