Russian cyberspies targeted punk rock band Pussy Riot

Pawn Storm, known for international spying, also targets Russians, Trend Micro said

A closely watched band of suspected Russian hackers have spied on domestic targets, including two members of the outspoken punk rock band Pussy Riot.

Trend Micro said the group, which it refers to as Pawn Storm, has also targeted a software developer in Russia, politicians, artists and journalists in the country.

“Pawn Storm’s targets have mostly been external political entities outside of Russia, but after our analysis we found that a great deal of targets can actually be found within the country’s borders,” wrote Feike Hacquebord, a Trend Micro threat researcher, in a blog post on Tuesday.

Trend came to its conclusion by studying phishing campaigns conducted by Pawn Storm. The group distributes its malware through emails which seek to trick users into clicking on malicious files or links.

It analyzed 12,000 phishing attacks, which sought to steal login credentials, from 2014 and this year. That made it possible “to derive reliable statistics on Pawn Storm targets worldwide,” Hacquebord wrote.

Other security companies, including FireEye, have kept an eye on Pawn Storm over the years. FireEye, which named it APT (advanced persistent threat) 28, said in October it suspected the group was in Russia.

FireEye said much of the group’s malware was set to a Russian language setting, and its working patterns adhered to business hours in Moscow.

Pawn Storm has been active for at least seven years and in the past has focused on geopolitical targets relating to the Caucasus region, Europe and its neighbor, Georgia.

Hacquebord wrote the latest analysis showed two members of the band Pussy Riot have been targeted, as well as a popular Russian rock star.

Russia imprisoned three members of Pussy Riot after they staged an impromptu performance in a Moscow church in early 2012. The group has been highly critical of the Russian government, and their sentences drew worldwide condemnation.

In one another instance, Pawn Storm targeted an active Russian military attache working in a NATO county, which “makes the spies’ motivations even more intriguing,” Hacquebord wrote.

The locations of the top three most targeted people were Ukraine, followed by the U.S. and U.K. In the U.S., Pawn Storm typically pursues the country’s military and affiliated defense companies although it is also interested in energy research, think tanks and academics, he wrote.

Last month, the group attacked high-profile people who use Yahoo’s free email system. The phishing emails were written as if they were notifications from Yahoo for an opt-in program that would improve the deliverability of their email, Hacquebord wrote.

But if users clicked on the link in the email, they unknowingly granted access to their accounts to the attackers using OAuth. OAuth is a protocol for logging into other services using account credentials from another.

“When Yahoo users would opt in, Pawn Storm would get unfettered access to the mailbox,” he wrote.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags punk rockcyberspiestrend microsecurityPawn StormPussy Riot

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Father’s Day Gift Guide

Most Popular Reviews

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?