Google: Cyber crime meshes with cyber warfare as states enlist gangs | Computer Weekly
Summary
Ben Read, a senior manager at the group, said: “The vast cyber criminal ecosystem has acted as an accelerant for state-sponsored hacking, providing malware, vulnerabilities, and in some cases full-spectrum operations to states. One example it gives is how, in March 2024, the Russian Anonymous Marketplace (RAMP) forum actor “badbone”, who has been associated with the INC ransomware gang, sought illicit access to Dutch and French medical, government and educational organisations, stating that they were willing to pay 2-5% more for hospitals, particularly those with emergency services. Another example the report gives is “UNC2589”, a “threat cluster” whose activity has been publicly attributed to the Russian General Staff Main Intelligence Directorate (GRU)’s 161st Specialist Training Center (Unit 29155). The report’s authors say CIGAR’s expansion from cyber crime into espionage activity likely supporting Russian state objectives began in October 2022, when it conducted a phishing campaign targeting Ukrainian military-related entities. CIGAR continued, says the report, to conduct intrusion activity targeting primarily Ukraine and Europe through 2023 and 2024, including campaigns leveraging zero-days in Microsoft Word, Firefox and Windows.