9 ms·
Microsoft has detected nation-state activity associated with NOBELIUM
- zelag 5y agoKinda off topic, but I'm wondering who names these threat actors?
- connordoner 5y agoI’d love to know this too!
- rvnx 5y agoMarketing managers and security researchers in private companies giving them names. The same reason high-profile exploits have nickname (heartbleed for example). https://en.wikipedia.org/wiki/Cozy_Bear https://en.wikipedia.org/wiki/Cozy_Bear for the sources for each name
- ConcernedCoder 5y agoI'm sure marketing knows it's easier to sell remediation for "heartbleed" rather than "smurfkiss"
- rvnx 5y agoWell, it's explained here for Microsoft: https://www.microsoft.com/security/blog/2021/10/25/microsoft-digital-defense-report-shares-new-insights-on-nation-state-attacks/ https://www.microsoft.com/security/blog/2021/10/25/microsoft...
- Arrath 5y agoI was idly thinking while reading the Journalist & Pegasus story from a few days ago[1], that some of the names for these exploits and groups, like KISMET, NOBELIUM, and HIPPOCRENE FACTOR especially, sound like codenames from a Destiny Lore Card[2] or something. Must be a fun exercise to brainstorm some of them up, if nothing else. [1]https://news.ycombinator.com/item?id=28980382 https://news.ycombinator.com/item?id=28980382 [2]https://www.destinypedia.com/Grimoire:Allies/Rasputin#Ghost_Fragment:_Rasputin_3 https://www.destinypedia.com/Grimoire:Allies/Rasputin#Ghost_...
- Grimm1 5y agoI just got off the Destiny subreddit, why must you drag me back in! They really do though, some RASPUTIN level AI just naming things.
- ping00 5y agoI believe that individual vendors (MSTC, FireEye, Talos, etc.) name threat actors differently. If you're interested, I'd highly recommend this page by CrowdStrike: https://adversary.crowdstrike.com/en-US/ https://adversary.crowdstrike.com/en-US/ It's very interesting to see how humans naturally tend to craft identities for faceless, nameless adversaries, which I think is very interesting from a social standpoint. Also the artwork in the website above is just plain cool IMO :) Although the vendors share information quite freely, I think there's hesitation on a vendor mutually adopting another vendor's threat actor name because it implies more substantive research on the latter's part, which is usually a no-no in a field like this. Ofc, I'm sure there are exceptions. edit: I also wanted to give Thai CERT a shout out and add a link to https://www.thaicert.or.th/downloads/files/Threat_Group_Cards_v2.0.pdf https://www.thaicert.or.th/downloads/files/Threat_Group_Card... which is less flashy than the CrowdStrike compendium, but well-detailed
- sdw1 5y agoReally appreciate the Thai CERT link -- I was really interested in seeing that Crowdstrike information presented in a format that's not about to pitch me the Crowdstrike Cinematic Universe or next-gen-Rainbow-6-arena-MMO or whatever they're going for. The glitchy elements/animations made it actually stressful for me to read.
- hdjjhhvvhga 5y ago> It's very interesting to see how humans naturally tend to craft identities for faceless, nameless adversaries, which I think is very interesting from a social standpoint. It's quite simple: you need a name (preferably unique) in order to refer to it in communication.
- staticassertion 5y agoIt's more than that. "FancyBear" is not a random name.
- Igelau 5y agoRandomly pulled from list of Beyblades and marijuana strains, it would appear.
- vmception 5y agoIts just individuals deploying their code over clearnet with computers they found on darknet RDP marketplaces The authorities are so incompetent in generating consequences that they have go with the idea that Putin signed off on the action himself, just to deflect “A dozen intelligence agencies” are all going to have the same evidence: a non-VPN IP address People are really gullible, remember when even just that turned into a partisan thing a few years ago? lulz. idiots.
- mox1 5y agoInitially this started internally at the US Government. Probably mostly the NSA, but then the vernacular spread. Kinda useful when having conversations to say "Cranky Frog" and not "China special operations group 304 PLA #122" The names were classified (Secret perhaps?), but at some point the US Government realized everyone was kinda using these names in conversations, probably not all at the secret level. These names had leaked out too much, they needed new names. So they decided to rename them with new Secret names, and just kinda let the old names become utilized. They tried to hide the old <-> new name mapping because the new name mapping was classified. Crowdstrike started as mostly former FBI / NSA employees. They liked using all these names to identify actors. But they realized they didn't want to use classified names. So they came up with their own very boring names (APT1, APT2 ,etc.). While others had always done this internally (Microsoft had names, Google had internal names, etc. etc.), Crowd strike utilized these names very publicly and it just kinda took off. I think the US Government at some point realized they could just use Crowdstrike names and avoid all of the Classified name mess, so they just utilized crowd strike names as well. So now Crowdstrike names are mostly the go-to. Unless you are micrososft, then you keep using your names.... My guess is Somewhere at Ft Meade an analyst has produced a massive, beautiful chart mapping all this shit together, and her sole job is to keep it updated. ...or this is my best guess anyway.
- fname 5y agoThis might help: https://www.securityweek.com/whats-threat-group-name-inside-look-intricacies-nation-state-attribution https://www.securityweek.com/whats-threat-group-name-inside-... For Microsoft specifically, we leverage the periodic table of elements when naming nation states.
- Jyaif 5y agoNobelium is an incredibly stupid name. They might as well go all in and name them "plutonium" or "anthrax".
- The-Bus 5y agoBest thing to do is give them non-threatening names like Beige Team or Fanny Pack.
- slowhand09 5y agoLocutus of Borg probably...
- lodovic 5y ago"The targeted activity has been observed against organizations based in the United States and across Europe since May 2021. NOBELIUM is the same actor behind the SolarWinds compromise in 2020, and this latest activity shares the hallmarks of the actor’s compromise-one-to-compromise-many approach." Just tell us which country.. It's probably one of two options.
- schleck8 5y agoRussia, Mitre profile is here: https://attack.mitre.org/groups/G0016/ https://attack.mitre.org/groups/G0016/
- rvnx 5y agoRussia according to the previous deductions of the US government about this group
- chrisseaton 5y agoRussia isn't a nation-state though.
- deleted 5y ago[deleted]
- cronix 5y agoPedantic arguments don't change the substance.
- ssklash 5y agoWhat do you mean by this? Is it because they didn't explicitly say "The Russian Federation"? Because we both know that's exactly what they meant, and that it is most certainly a nation-state.
- chrisseaton 5y agoA nation-state is a state that perfectly aligns with a nationality. Hence nation-state. A nation that is also a state. The Russian Federation is a state with many nationalities within its borders. So it isn't a nation-state. Other classic examples of non-nation-states are the UK and the US. https://www.quora.com/Is-Russia-a-nation-state https://www.quora.com/Is-Russia-a-nation-state
- Cycl0ps 5y agoThe Darknet Diaries podcast just released an episode on a similar attack (via MSP) if you're interested in hearing what this looks like from a remidiation standpoint
- tommek4077 5y agoLol, this stuff happens since forever with webfacing servers. Thats why you dont use 'root' or 'admin' as a ssh user. Just some PR fear mongering stuff to get the newbies in the cloudspace instead of hosting own servers.
- jszymborski 5y agoSomething I've been thinking a lot about is that news of nation states attacking NATO member systems often make headlines, but there is little about NATO members attacking these same nation states. This sort of results in an impression that there is a capability asymmetry between the two. Is that true? Or do we just not hear about it.
- papito 5y agoThere is no asymmetry in capability but there is an asymmetry in the desire to provoke. Russia has solidified its role in the world as essentially - a geopolitical troll. "Stabbing in the back", the thing they accuse everyone else of, is the strategy. NATO does not want this fight, and they do not have the hierarchy of plausible deniability, which the Russian security services have perfected to a form of art. "Independent" hacking groups do jobs for the government, in exchange to freely conduct mercenary for-profit attacks without fear of being jailed. NATO countries don't have this system. If they do something, they do it without proxies. https://arstechnica.com/information-technology/2018/01/dutch-intelligence-hacked-video-cameras-in-office-of-russians-who-hacked-dnc/ https://arstechnica.com/information-technology/2018/01/dutch...
- naasking 5y ago> There is no asymmetry in capability but there is an asymmetry in the desire to provoke. Or asymmetry in the desire to report it. Any country reports threats against them wide and far, and they downplay or ignore any threatening actions they make. > NATO countries don't have this system. If they do something, they do it without proxies. Colour me skeptical. "Open and transparent" is just not how intelligence services operate.
- papito 5y agoIntelligence agencies obviously rarely do PR. Give one example of a NATO hacking "proxy" getting caught. There have been multiple Russian ones.
- wayoutthere 5y ago
- slt2021 5y agoJust a fear mongering article intended to SELL extra Azure services for $$$ that in theory maybe fix some of the Microsoft's own Security vulnerabilities. Like internet facing RDP (aka Ransomware Deployment Protocol) server. Notice how everyone in this thread is scared of "nation-state" and Russia - this is the exact emotion and reaction Microsoft wants. After fear of some "god-level Russian state hacker superpower" is seeded, the next logical step is to SELL some crappy cloud subscriptions for $$$ and keep milking your fear and making money.
- toss1 5y agoThe fact that MS wants "to SELL extra Azure services for $$$" and the fact that RUS, CCP and other nation/state actors often attack those services are not mutually exclusive. Claiming that the notice is false simply because some aspect of it it may also align with some profit sounds like an entry-level fallacy spouted by Qanoners, or an actual RUS twitter troll posting their daily dezinformatsiya, or just the everyday paranoia of those who flock under those banners. Do you have any actual evidence that the notice is false?
- lame-robot-hoax 5y ago“Please don't post shallow dismissals, especially of other people's work. A good critical comment teaches us something.”
- nray 5y ago* "detected state activity", or even "detected foreign state activity". WTF does "nation-state" mean? Bhutan?