3 firms in Eastern Europe hit by hackers accused of ties to Russia

BRATISLAVA • Hackers have infected three energy and transport companies in Ukraine and Poland with sophisticated new malware and may be planning destructive cyber attacks, a software security firm said yesterday.

A report by researchers at Slovakia-based ESET did not attribute the hacking activity, recorded between 2015 and mid-2018, to any specific country but blamed it on a group that has been accused by Britain of having links to Russian military intelligence.

The report is the latest to raise suspicions in the West about Russia's GRU spy agency, accused by London of conducting a "reckless campaign" of global cyber attacks and trying to kill a former Russian spy in England. Moscow denies the charges.

Investigators at ESET said the group responsible for a series of earlier attacks against the Ukrainian energy sector, which used malware known as BlackEnergy, had now developed and used a new malware suite called GreyEnergy.

ESET has helped investigate a series of high-profile cyber attacks on Ukraine in recent years, including those on the Ukrainian energy grid which led to power outages in late 2015.

Kiev has accused Moscow of orchestrating those attacks, while US cyber security firm FireEye says a group known as Sandworm is thought to be responsible. Britain's GCHQ spy agency said this month that BlackEnergy Actors and Sandworm are both names associated with the GRU. "The important thing is that they are still active," ESET researcher Robert Lipovsky told Reuters. "This shows that this very dangerous and persistent 'threat actor' is still active."

Kremlin spokesman Dmitry Peskov said there was no evidence to support the allegations against the GRU and that Russia does not use cyber attacks against other countries. "These are just more accusations. We are tired of denying them, because no one is listening," he said.

After infection via e-mails laced with malicious weblinks or documents - a tactic known as "spear phishing" - or by compromising servers exposed to the Internet, GreyEnergy allowed the attackers to map out their victim's networks and gather confidential information such as passwords and login credentials, ESET said.

Mr Lipovsky said his team then saw the hackers seek out critical parts of the companies' systems, including computers which ran industrial control processes.

"It is my understanding that this was the reconnaissance and espionage phase, potentially leading up to cyber sabotage," he said.

The ESET report did not name the three companies infected in Ukraine and Poland, and Reuters was unable to identify them.

Ukraine's Cyber Police confirmed the attacks on two Ukrainian companies but declined to give any further details. Poland's Internal Security Agency declined to comment.


A version of this article appeared in the print edition of The Straits Times on October 18, 2018, with the headline '3 firms in Eastern Europe hit by hackers accused of ties to Russia'. Print Edition | Subscribe