Russia State-Sponsored Cyber Threat: Advisories
As the nation's cyber defense agency and national coordinator for critical infrastructure, CISA provides resources—including cybersecurity advisories written in coordination with partners—to help stakeholders build resilience against nation-state actors and other cyber threats.
Table 1: CISA and Joint CISA Advisories
| Publication Date | Title | Description |
|---|---|---|
| February 26, 2024 | SVR Cyber Actors Adapt Tactics for Initial Cloud Access | The UK National Cyber Security Centre (NCSC) and international partners assess that APT29 is a cyber espionage group, almost certainly part of the SVR, an element of the Russian intelligence services. The US National Security Agency (NSA), the US Cybersecurity and Infrastructure Security Agency (CISA), the US Cyber National Mission Force (CNMF), the Federal Bureau of Investigation (FBI), Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), the Canadian Centre for Cyber Security (CCCS), and New Zealand Government Communications Security Bureau (GCSB) agree with this attribution and the details provided in this advisory. This advisory details recent tactics, techniques, and procedures (TTPs) of the group commonly known as APT29, also known as Midnight Blizzard, the Dukes, or Cozy Bear. |
| December 13, 2023 | Russian Foreign Intelligence Service (SVR) Exploiting JetBrains TeamCity CVE Globally | The U.S. Federal Bureau of Investigation (FBI), U.S. Cybersecurity & Infrastructure Security Agency (CISA), U.S. National Security Agency (NSA), Polish Military Counterintelligence Service (SKW), CERT Polska (CERT.PL), and the UK’s National Cyber Security Centre (NCSC) assess Russian Foreign Intelligence Service (SVR) cyber actors—also known as Advanced Persistent Threat 29 (APT 29), the Dukes, CozyBear, and NOBELIUM/Midnight Blizzard—are exploiting CVE-2023-42793 at a large scale, targeting servers hosting JetBrains TeamCity software since September 2023. This advisory highlights SVR involvement in the exploitation of this vulnerability in JetBrain TeamCity software. The advisory provides cyber defenders tactics employed by SVR actors in this operation, discusses the operation’s focus on software companies, and includes indicators of compromise (IOCs) and mitigation recommendations. |
| December 7, 2023 | Russian FSB Cyber Actor Star Blizzard Continues Worldwide Spear-phishing Campaigns | The Russia-based actor Star Blizzard (formerly known as SEABORGIUM, also known as Callisto Group/TA446/COLDRIVER/TAG-53/BlueCharlie) continues to successfully use spear-phishing attacks against targeted organizations and individuals in the UK, and other geographical areas of interest, for information-gathering activity. The UK National Cyber Security Centre (NCSC), the US Cybersecurity and Infrastructure Security Agency (CISA), the US Federal Bureau of Investigation (FBI), the US National Security Agency (NSA), the US Cyber National Mission Force (CNMF), the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), the Canadian Centre for Cyber Security (CCCS), and the New Zealand National Cyber Security Centre (NCSC-NZ) assess that Star Blizzard is almost certainly subordinate to the Russian Federal Security Service (FSB) Centre 18. |
| August 31, 2023 | Joint Malware Analysis Report: Infamous Chisel | The UK National Cyber Security Centre (NCSC), the U.S. National Security Agency (NSA), U.S. Cybersecurity and Infrastructure Security Agency (CISA), U.S. Federal Bureau of Investigation (FBI), New Zealand’s National Cyber Security Centre (NCSC-NZ), the Canadian Centre for Cyber Security – part of the Canada’s Communications Security Establishment (CSE), and Australian Signals Directorate (ASD) are aware that the actor known as Sandworm has used a new mobile malware in a campaign targeting Android devices used by the Ukrainian military. The malware is referred to here as Infamous Chisel. Organizations from the United Kingdom, United States, Australia, Canada, and New Zealand have previously linked the Sandworm actor to the Russian GRU's Main Centre for Special Technologies GTsST. For more information, see the Joint Malware Analysis Report: Infamous Chisel |
| May 09, 2023 | Joint Cybersecurity Advisory: Hunting Russian Intelligence “Snake” Malware | CISA and partners have released a joint advisory for a sophisticated cyber espionage tool used by Russian cyber actors. Hunting Russian Intelligence “Snake” Malware provides technical descriptions of the malware’s host architecture and network communications, and mitigations to help detect and defend against this threat. CISA urges organizations to review the advisory for more information and apply the recommended mitigations and detection guidance. For more information on FSB and Russian state-sponsored cyber activity, please see the joint advisory Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure. |
| April 18, 2023 | Joint Cybersecurity Advisory: APT28 Exploits Known Vulnerability to Carry Out Reconnaissance and Deploy Malware on Cisco Routers | NCSC, NSA, CISA, and FBI have released a joint advisory to provide details of tactics, techniques, and procedures (TTPs) associated with APT28's exploitation of Cisco routers in 2021. By exploiting the vulnerability CVE-2017-6742, APT28 used infrastructure to masquerade Simple Network Management protocol (SNMP) access into Cisco routers worldwide, including routers in Europe, U.S. government institutions, and approximately 250 Ukrainian victims. CISA encourages personnel to review NCSC’s Jaguar Tooth malware analysis report for detailed TTPs and indicators of compromise which may help detect APT28 activity. For more information on APT28 activity, see the advisories Russian State-sponsored and Criminal Cyber Threats to Critical Infrastructure and Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. |
| April 20, 2022 | Joint Cybersecurity Advisory: Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure | The cybersecurity authorities of the United States, Australia, Canada, New Zealand, and the United Kingdom have released a joint Cybersecurity Advisory to warn organizations that Russia’s invasion of Ukraine could expose organizations both within and beyond the region to increased malicious cyber activity. This activity may occur as a response to the unprecedented economic costs imposed on Russia as well as materiel support provided by the United States and U.S. allies and partners. This advisory provides an overview of Russian state-sponsored advanced persistent threat groups, Russian-aligned cyber threat groups, and Russian-aligned cybercrime groups to help the cybersecurity community protect against possible cyber threats. |
| March 24, 2022 | Joint Cybersecurity Advisory: Tactics, Techniques, and Procedures of Indicted State-Sponsored Russian Cyber Actors Targeting the Energy Sector | This joint Cybersecurity Advisory—coauthored by CISA, the Federal Bureau of Investigation (FBI), and the Department of Energy (DOE)—provides information on multiple intrusion campaigns conducted by state-sponsored Russian cyber actors from 2011 to 2018 and targeted U.S. and international Energy Sector organizations. CISA, the FBI, and DOE responded to these campaigns with appropriate action in and around the time that they occurred. CISA, the FBI, and DOE are sharing this information in order to highlight historical tactics, techniques, and procedures (TTPs) used by adversaries to target U.S. and international Energy Sector organizations. On March 24, 2022, the U.S. Department of Justice unsealed indictments of three Russian Federal Security Service (FSB) officers and a Russian Federation Central Scientific Research Institute of Chemistry and Mechanics (TsNIIKhM) employee for their involvement in intrusion campaigns against U.S. and international oil refineries, nuclear facilities, and energy companies. |
| March 15, 2022 | Joint Cybersecurity Advisory: Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor Authentication Protocols and “PrintNightmare” Vulnerability | This Advisory warns organizations that Russian state-sponsored cyber actors have gained network access through exploitation of default MFA protocols and a known vulnerability. As early as May 2021, Russian state-sponsored cyber actors took advantage of a misconfigured account set to default MFA protocols at a non-governmental organization (NGO), allowing them to enroll a new device for MFA and access the victim network. The actors then exploited a critical Windows Print Spooler vulnerability, “PrintNightmare” (CVE-2021-34527) to run arbitrary code with system privileges. Russian state-sponsored cyber actors successfully exploited the vulnerability while targeting an NGO using Cisco’s Duo MFA, enabling access to cloud and email accounts for document exfiltration. |
| February 23, 2022 | Joint Cybersecurity Advisory: New Sandworm Malware Cyclops Blink Replaces VPNFilter | In this Advisory, NCSC-UK, CISA, NSA and the FBI report that the malicious cyber actor known as Sandworm or Voodoo Bear is using new malware, referred to as Cyclops Blink. Cyclops Blink appears to be a replacement framework for the VPNFilter malware exposed in 2018, which exploited network devices, primarily small office/home office routers and network-attached storage devices. |
| February 16, 2022 | Joint Cybersecurity Advisory: Russian State-Sponsored Cyber Actors Target Cleared Defense Contractor Networks to Obtain Sensitive U.S. Defense Information and Technology | From at least January 2020, through February 2022, the Federal Bureau of Investigation (FBI), National Security Agency (NSA), and Cybersecurity and Infrastructure Security Agency (CISA) have observed regular targeting of U.S. cleared defense contractors (CDCs) by Russian state-sponsored cyber actors. The actors have targeted both large and small CDCs and subcontractors with varying levels of cybersecurity protocols and resources. This Advisory provides detection and mitigation recommendations for CDCs to reduce the risk of data exfiltration by Russian state-sponsored actors. |
| January 11, 2022 | Joint Cybersecurity Advisory: Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure | This Advisory provides an overview of Russian state-sponsored cyber operations; commonly observed tactics, techniques, and procedures (TTPs); detection actions; incident response guidance; and mitigations. It is intended to help the cybersecurity community reduce the risk presented by these threats. |
| July 20, 2021 | ICS Advisory: ICSA-14-178-01: ICS Focused Malware – Havex ICS Alert: ICS-ALERT-14-281-01E: Ongoing Sophisticated Malware Campaign Compromising ICS (Update E) ICS Alert: IR-ALERT-H-16-056-01: Cyber-Attack Against Ukrainian Critical Infrastructure Technical Alert: TA17-163A: CrashOverride Malware | These previously published ICS advisories and alerts contain information on historical cyber-intrusion campaigns by Russian nation-state cyber actors. |
| July 16, 2021 | Joint Cybersecurity Advisory: APT29 targets COVID-19 vaccine development | This Advisory details recent Tactics, Techniques and Procedures (TTPs) of the group commonly known as ‘APT29’, also known as ‘the Dukes’ or ‘Cozy Bear’. It also provides indicators of compromise as well as detection and mitigation advice. |
| July 1, 2021 | Joint Cybersecurity Advisory: Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments | This Advisory details how the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) has targeted hundreds of U.S. and foreign organizations using brute force access to penetrate government and private sector victim networks. The advisory reveals the tactics, techniques, and procedures (TTPs) GTsSS actors used in their campaign to exploit targeted networks, access credentials, move laterally, and collect and exfiltrate data. |
| May 14, 2021 | CISA Analysis Report: Eviction Guidance for Networks Affected by the SolarWinds and Active Directory/M365 Compromise | This Analysis Report provides guidance to federal agencies in crafting eviction plans in response to the SolarWinds Orion supply chain compromise. The guidance is intended for federal agencies with networks that used affected versions of SolarWinds Orion and have evidence of follow-on threat actor activity. Although this guidance is tailored to federal agencies, CISA encourages critical infrastructure entities; state, local, tribal, and territorial government organizations; and private sector organizations to review and apply it, as appropriate. Note: For more information on the SolarWinds Orion supply chain compromise, refer to the Remediating Networks Affected by the SolarWinds and Active Directory/M365 Compromise webpage. |
| May 7, 2021 | Joint NCSC-CISA-FBI-NSA CSA: Further TTPs associated with SVR cyber actors | This Joint Cybersecurity Advisory (CSA) is on Russian SVR activities related to the SolarWinds Orion compromise. The CSA details SVR tactics, techniques, and procedures (TTPs) and on SVR-leveraged malware, including WELLMESS, WELLMAIL, GoldFinder, GoldMax, and possibly Sibot, as well as open-source Red Team command and control frameworks, Sliver and Cobalt Strike. Note: See FactSheet: Russian SVR Activities for summaries of three key Joint CSAs that detail Russian SVR activities related to the SolarWinds compromise. For more information on the SolarWinds Orion supply chain compromise, refer to the Remediating Networks Affected by the SolarWinds and Active Directory/M365 Compromise webpage. |
| April 26, 2021 | Joint FBI-DHS-CISA CSA: SVR Cyber Operations: Trends and Best Practices for Network Defenders | This Joint CSA is on Russian SVR activities related to the SolarWinds Orion compromise. The CSA provides information on SVR TTPs. Specifically, this CSA points out the FBI's observation that, starting in 2018, the SVR shifted from "using malware on victim networks to targeting cloud resources, particularly e-mail, to obtain information." Significantly, SVR's compromise of Microsoft cloud environments following their SolarWinds Orion supply chain compromise is an example of this trend. Note: See FactSheet: Russian SVR Activities for summaries of three key Joint CSAs that detail Russian SVR activities related to the SolarWinds compromise. For more information on the SolarWinds Orion supply chain compromise, refer to the Remediating Networks Affected by the SolarWinds and Active Directory/M365 Compromise webpage. |
| April 15, 2021 | Joint NSA-CISA-FBI CSA: Russian SVR Targets U.S. and Allied Networks | This Joint CSA is on Russian SVR activities related to the SolarWinds Orion compromise. The CSA details the vulnerabilities the SVR is leveraging—as well as the techniques it is using—in its attempts to compromise U.S. and Allied networks. Note: See FactSheet: Russian SVR Activities for summaries of three key Joint CSAs that detail Russian SVR activities related to the SolarWinds compromise. For more information on the SolarWinds Orion supply chain compromise, refer to the Remediating Networks Affected by the SolarWinds and Active Directory/M365 Compromise webpage. |
| March 18, 2021 | CISA Alert: Detecting Post-Compromise Threat Activity Using the CHIRP IOC Detection Tool | This Alert announces the CISA Hunt and Incident Response Program (CHIRP) tool. CHIRP is a forensics collection tool that CISA developed to help network defenders find indicators of compromise (IOCs) associated with the SolarWinds Orion supply chain compromise. Note: For more information on the SolarWinds Orion supply chain compromise, refer to the Remediating Networks Affected by the SolarWinds and Active Directory/M365 Compromise webpage. |
| January 8, 2021 | CISA Alert: Detecting Post-Compromise Threat Activity in Microsoft Cloud Environments | This Alert is a companion alert to CISA Alert: Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations. This Alert addresses the APT actor's tactics and techniques. Note: For more information on the SolarWinds Orion supply chain compromise, refer to the Remediating Networks Affected by the SolarWinds and Active Directory/M365 Compromise webpage. |
| December 17, 2020 | This Alert focuses on an APT actor’s compromise of SolarWinds Orion products affecting U.S. government agencies, critical infrastructure entities, and private network organizations. Note: For more information on the SolarWinds Orion supply chain compromise, refer to the Remediating Networks Affected by the SolarWinds and Active Directory/M365 Compromise webpage. | |
| October 22, 2020 | Joint FBI-CISA CSA: Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets | This Joint CSA provides information on Russian state-sponsored APT actor activity targeting various U.S. state, local, tribal, and territorial government networks, as well as aviation networks. This Advisory updates Joint CISA-FBI CSA: APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations. |
| October 9, 2020 | Joint CISA-FBI CSA: APT Actors Chaining Vulnerabilities Against SLTT, Critical Infrastructure, and Elections Organizations | This Joint CSA provides information on APT actors exploiting multiple legacy vulnerabilities in combination with a newer privilege escalation vulnerability. The commonly used tactic, known as vulnerability chaining, exploits multiple vulnerabilities in the course of a single intrusion to compromise a network or application. |
| April 16, 2018 | Joint DHS-FBI-NCSC Alert: Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices | This Joint Technical Alert provides information on the worldwide cyber exploitation of network infrastructure devices by Russian state-sponsored cyber actors. Targets are primarily government and private-sector organizations, critical infrastructure providers, and the internet service providers supporting these sectors. |
| March 15, 2018 | Joint DHS-FBI Alert: Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors | This Joint Technical Alert provides information on Russian government actions targeting U.S. government entities as well as critical infrastructure organizations. It also contains IOCs and technical details on the TTPs used by Russian government cyber actors on compromised victim networks. |
| July 1, 2017 | CISA Alert: Petya Ransomware | This Technical Alert provides in-depth technical analysis of NotPetya malware, a Petya malware variant that surfaced on June 27, 2017. The U.S. Government has publicly attributed this NotPetya malware variant to the Russian military. |
| February 10, 2017 | CISA Analysis Report: Enhanced Analysis of GRIZZLY STEPPE Activity | This Analysis Report provides signatures and recommendations to detect and mitigate threats from GRIZZLY STEPPE actors. |
| December 29, 2016 | Joint DHS-FBI Analysis Report: GRIZZLY STEPPE - Russian Malicious Cyber Activity | This Joint Analysis Report provides technical details regarding the tools and infrastructure used by the Russian civilian and military intelligence services (RIS) to compromise and exploit networks and endpoints associated with the U.S. election, as well as a range of U.S. Government, political, and private sector entities. The U.S. Government is referring to this malicious cyber activity by RIS as GRIZZLY STEPPE. |