By Barry Eitel
SAN FRANCISCO
Hackers, likely with Russian government backing, used Twitter and other popular online services to break into high-profile United States government and defense industry computer systems, according to a report released Wednesday.
The sophisticated cyberattack was essentially hidden in plain sight, claims security firm FireEye, by shrouding malicious activity in legitimate network traffic from websites such as Twitter, image-sharing platform GitHub and other cloud-based services.
An algorithm on infected computers would require each machine to check certain Twitter accounts each day. If a specific message was tweeted by one of the accounts, by a human, the compromised machines would execute different actions.
The vulnerability, which FireEye is calling “Hammertoss”, has been exploited by a group of hackers since at least 2014. FireEye calls the coterie of hackers Advanced Persistent Threat (APT) group APT29 and believes the Russia-based attackers have support from the Kremlin.
“The novel approach APT29 takes to carry out its attacks and maintain their persistence in networks represents a level of difficulty that security professionals could see trickle down into their own network security operations,” Laura Galante, the director of threat intelligence at FireEye, said in a statement. “As we continue to track APT29, we will be able to bring more intelligence to light that will help our customers improve their defenses against advanced attacks.”
FireEye claims APT29 was able to use Web-based services such as Twitter to rapidly shift strategies if government security experts began to catch on to the attack.
In April, FireEye identified another Russian group, APT28, that exploited vulnerabilities in the popular Flash software manufactured by Adobe Systems to attack high-profile targets.
The revelations came a few months before major Silicon Valley companies like Mozilla and Facebook called for Adobe to kill Flash, a Web-based platform that has been used for decades.
