Malware used in White House and State Department hacks possibly linked to Russia

The malware is related to the MiniDuke, CosmicDuke and OnionDuke cyberespionage tools, researchers from Kaspersky Lab found

The group of attackers behind cyberintrusions at the White House and the Department of State last year used malware that bears strong similarities to cyberespionage tools suspected to be of Russian origin.

Security researchers from Kaspersky Lab have dubbed the cyberespionage group CozyDuke and said that it has blatantly targeted high-profile victims since the second half of last year. Its toolset includes malware droppers, information-stealing programs and backdoors that have antivirus evasion capabilities and make use of cryptography, the researchers said Tuesday a blog post.

More importantly, technical evidence suggests that some of the CozyDuke malware has strong "functional and structural similarities" to known components of the MiniDuke, CosmicDuke and OnionDuke cyberespionage tools, the Kaspersky researchers said.

Those three threats have been used to attack NATO members and European governments over the past two years and are believed to be related.

While the Kaspersky researchers did not discuss CozyDuke's possible origins in their blog post, researchers from other companies who analyzed MiniDuke, CosmicDuke and OnionDuke in the past believe they are the work of the Russian government.

In a January blog post, researchers from F-Secure noted that none of the high-profile CosmicDuke or OnionDuke targets were from Russia. The only victims detected in Russia had links to illegal substances, suggesting that those spyware tools might be used in support of law enforcement investigations in the country.

"Considering the victims of the law enforcement use case seem to be from Russia, and none of the high-profile victims are exactly pro-Russian, we believe that a Russian government agency is behind these operations," the F-Secure researchers concluded.

The possible link between the State Department security breach last year and Russian hackers has been noted before. In February, the Wall Street Journal reported that five unnamed people familiar with the intrusion had seen or had been told of links between the malware used in the attack and the Russian government.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags intrusionsecuritydata breachf-securespywaremalwarekaspersky lab

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Father’s Day Gift Guide

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Armand Abogado

HP OfficeJet 250 Mobile Printer

Wireless printing from my iPhone was also a handy feature, the whole experience was quick and seamless with no setup requirements - accessed through the default iOS printing menu options.

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?