{"id":34391,"date":"2020-04-14T14:33:09","date_gmt":"2020-04-14T14:33:09","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/31118\/Russian-State-Hackers-Behind-San-Francisco-Airport-Hack.html"},"modified":"2020-04-14T14:33:09","modified_gmt":"2020-04-14T14:33:09","slug":"russian-state-hackers-behind-san-francisco-airport-hack","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/russian-state-hackers-behind-san-francisco-airport-hack\/","title":{"rendered":"Russian State Hackers Behind San Francisco Airport Hack"},"content":{"rendered":"<p><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/zdnet2.cbsistatic.com\/hub\/i\/2020\/04\/14\/049f266e-2600-4a9e-b5e3-11d160d6bd7f\/sfo.jpg\" class alt=\"sfo.jpg\"><\/span><span class=\"credit\">Image via Robert Bye on Unsplash<\/span> <\/p>\n<div class=\"relatedContent alignRight\" readability=\"8.0321285140562\">\n<h3 class=\"heading\"><span class=\"int\">Special feature<\/span><\/h3>\n<div class=\"thumb\"><a href=\"https:\/\/www.zdnet.com\/topic\/cyberwar-and-the-future-of-cybersecurity\/\" data-omniture-track=\"moduleClick\" data-omniture-track-data=\"{&quot;moduleInfo&quot;: &quot;pinbox&quot;, &quot;pageType&quot;: &quot;article&quot;}\" data-vanity-rewritten=\"true\"><span class=\"img\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/zdnet3.cbsistatic.com\/hub\/i\/r\/2016\/09\/01\/fa215859-76c8-4ab7-8b55-56a42e0d8950\/resize\/220x165\/cf651a47272fd8abf79b87f4b45ba3c4\/09-2016-special-feature-cover-art.jpg\" class alt=\"Cyberwar and the Future of Cybersecurity\" height=\"165\" width=\"220\"><\/span><\/a><\/div>\n<p class=\"title\"><a href=\"https:\/\/www.zdnet.com\/topic\/cyberwar-and-the-future-of-cybersecurity\/\" data-omniture-track=\"moduleClick\" data-omniture-track-data=\"{&quot;moduleInfo&quot;: &quot;pinbox&quot;, &quot;pageType&quot;: &quot;article&quot;}\" data-vanity-rewritten=\"true\">Cyberwar and the Future of Cybersecurity<\/a><\/p>\n<p class=\"dek\">Today&#8217;s security threats have expanded in scope and seriousness. There can now be millions &#8212; or even billions &#8212; of dollars at risk when information security isn&#8217;t handled properly.<\/p>\n<p class=\"read-more\"><a href=\"https:\/\/www.zdnet.com\/topic\/cyberwar-and-the-future-of-cybersecurity\/\" data-omniture-track=\"moduleClick\" data-omniture-track-data=\"{&quot;moduleInfo&quot;: &quot;pinbox&quot;, &quot;pageType&quot;: &quot;article&quot;}\" data-vanity-rewritten=\"true\">Read More<\/a><\/p>\n<\/div>\n<p>Hackers believed to be operating on behalf of the Russian government have hacked two websites operated by the San Francisco International Airport, cyber-security firm ESET said today.<\/p>\n<p>The hacks took place last month, in March, according to a data breach notification [<a href=\"http:\/\/media.flysfo.com.s3.amazonaws.com\/pdf\/Memo%20-%20Notice%20of%20Data%20Breach_il-4-3-2020_ntn.pdf\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">PDF<\/a>] posted on the airport&#8217;s website.<\/p>\n<p>The attacks targeted <a href=\"https:\/\/sfoconnect.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">SFOConnect.com<\/a>, a website used by airport employees, and <a href=\"https:\/\/sfoconstruction.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">SFOConstruction.com<\/a>, a portal used by airport construction contractors.<\/p>\n<p>According to San Francisco airport officials, hackers breached both websites and planted code that exploited an Internet Explorer bug to steal login credentials.<\/p>\n<p>But in a series of tweets today, ESET said that &#8220;the targeted information was NOT the visitor&#8217;s credentials to the compromised websites, but rather the visitor&#8217;s own Windows credentials.&#8221;<\/p>\n<p>&#8220;The intent was to collect Windows credentials (username\/NTLM hash) of visitors by exploiting an SMB feature and the file:\/\/ prefix,&#8221; the ESET research team said.<\/p>\n<p>NTLM hashes can be cracked to obtain a cleartext version of a user&#8217;s Windows password. If the hackers had access to the airport&#8217;s internal network, they could have used credentials obtained from airport employees to spread laterally through the airport&#8217;s internal network to conduct reconnaissance, data theft, or sabotage.<\/p>\n<h3>ESET links hack to Energetic Bear<\/h3>\n<section class=\"sharethrough-top\" data-component=\"medusaContentRecommendation\" data-medusa-content-recommendation-options=\"{&quot;promo&quot;:&quot;promo_zd_recommendation_sharethrough_top_in_article_desktop&quot;,&quot;spot&quot;:&quot;dfp-in-article&quot;}\">\n<\/section>\n<p>ESET said the attack was carried out by a threat actor known as <a href=\"https:\/\/malpedia.caad.fkie.fraunhofer.de\/actor\/energetic_bear\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">Energetic Bear<\/a> (also known as DragonFly). The group has been active since 2010 and is believed to be operating on behalf of the Russian government.<\/p>\n<p>The group is one of Russia&#8217;s most active state-sponsored entities. Over the past decade, Energetic Bear hackers have been behind a widespread hacking campaign that targeted organizations all over the world.<\/p>\n<p>The group&#8217;s primary targets have been organizations in the energy sector &#8212; hence its name of Energetic Bear &#8212; primarily those located in the Middle East, Turkey, and the US.<\/p>\n<p>However, Energetic Bear has also recently began targeting other types of organizations as well, including companies in the aerospace and the aviation sector, according to <a href=\"https:\/\/securelist.com\/energetic-bear-crouching-yeti\/85345\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">a report published by Kaspersky in April 2018<\/a>, and an <a href=\"https:\/\/www.us-cert.gov\/ncas\/alerts\/TA18-074A\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">alert sent at the time by the US Department of Homeland Security<\/a>.<\/p>\n<p>In fact, the same Kaspersky report details a series of <a href=\"https:\/\/en.wikipedia.org\/wiki\/Watering_hole_attack\" target=\"_blank\" rel=\"noopener noreferrer\" data-component=\"externalLink\">watering hole attacks<\/a> carried out by Energetic Bear that used the same &#8220;<em>file:\/\/ prefix<\/em>&#8221; trick to obtain NTLM hashes from users visiting a compromised website.<\/p>\n<div class=\"twitterContainer\" readability=\"6.2923728813559\">\n<blockquote class=\"twitter-tweet\" readability=\"6.7118644067797\">\n<p lang=\"en\" dir=\"ltr\">The recently reported breach of <a href=\"https:\/\/twitter.com\/hashtag\/SFO?src=hash&amp;ref_src=twsrc%5Etfw\" rel=\"noopener noreferrer\" target=\"_blank\" data-component=\"externalLink\">#SFO<\/a> airport websites is in line with the TTPs of an APT group known as Dragonfly\/Energetic Bear. The intent was to collect Windows credentials (username\/NTLM hash) of visitors by exploiting an SMB feature and the file:\/\/ prefix <a href=\"https:\/\/twitter.com\/hashtag\/ESETresearch?src=hash&amp;ref_src=twsrc%5Etfw\" rel=\"noopener noreferrer\" target=\"_blank\" data-component=\"externalLink\">#ESETresearch<\/a> 1\/2 <a href=\"https:\/\/t.co\/pDZMdb49lb\" rel=\"noopener noreferrer nofollow\" target=\"_blank\" data-component=\"externalLink\">pic.twitter.com\/pDZMdb49lb<\/a><\/p>\n<p>\u2014 ESET research (@ESETresearch) <a href=\"https:\/\/twitter.com\/ESETresearch\/status\/1249981751138627585?ref_src=twsrc%5Etfw\" rel=\"noopener noreferrer\" target=\"_blank\" data-component=\"externalLink\">April 14, 2020<\/a><\/p><\/blockquote>\n<\/div>\n<p>&#8220;This technique has been used for years by Energetic Bear\/DragonFly,&#8221; Matthieu Faou, malware researcher at ESET, told <em>ZDNet<\/em> in an interview today.<\/p>\n<p>We also asked Faou to expand on the company&#8217;s tweets and inquired if this hack is part of a new campaign aimed at the US aviation sector.<\/p>\n<p>&#8220;We don&#8217;t have any information about the compromise of another airport website,&#8221; Faou told us. &#8220;According to ESET telemetry, the other websites that were recently compromised are mainly media websites in Eastern Europe.&#8221;<\/p>\n<h3>San Francisco airport reset all employee passwords<br \/><\/h3>\n<p>Faou said that when they detected the technique being used in the wild again, they &#8220;reported it immediately to the SFO airport team&#8221; who &#8220;quickly removed the malicious piece of code from their website.&#8221;<\/p>\n<p>Airport officials than followed through by forcing password resets for &#8220;all SFO related email and network passwords on Monday, March 23, 2020.&#8221;<\/p>\n<p>The password reset is enough to prevent hackers from using the stolen NTLM hashes for any future intrusions.<\/p>\n<p>However, the two websites were also used by other users who were not airport employees. Through its public security breach announcement, the San Francisco airport is now urging users who recently visited the site to take similar actions and reset their Windows passwords.<\/p>\n<p> READ MORE <a href=\"https:\/\/packetstormsecurity.com\/news\/view\/31118\/Russian-State-Hackers-Behind-San-Francisco-Airport-Hack.html\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":34392,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[60],"tags":[8577],"class_list":["post-34391","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-packet-storm","tag-headlinegovernmentmalwarerussiacyberwar"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Russian State Hackers Behind San Francisco Airport Hack 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/russian-state-hackers-behind-san-francisco-airport-hack\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Russian State Hackers Behind San Francisco Airport Hack 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/russian-state-hackers-behind-san-francisco-airport-hack\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2020-04-14T14:33:09+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/04\/russian-state-hackers-behind-san-francisco-airport-hack.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"500\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-state-hackers-behind-san-francisco-airport-hack\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-state-hackers-behind-san-francisco-airport-hack\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Russian State Hackers Behind San Francisco Airport Hack\",\"datePublished\":\"2020-04-14T14:33:09+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-state-hackers-behind-san-francisco-airport-hack\\\/\"},\"wordCount\":707,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-state-hackers-behind-san-francisco-airport-hack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/russian-state-hackers-behind-san-francisco-airport-hack.jpg\",\"keywords\":[\"headline,government,malware,russia,cyberwar\"],\"articleSection\":[\"Packet Storm\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-state-hackers-behind-san-francisco-airport-hack\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-state-hackers-behind-san-francisco-airport-hack\\\/\",\"name\":\"Russian State Hackers Behind San Francisco Airport Hack 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-state-hackers-behind-san-francisco-airport-hack\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-state-hackers-behind-san-francisco-airport-hack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/russian-state-hackers-behind-san-francisco-airport-hack.jpg\",\"datePublished\":\"2020-04-14T14:33:09+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-state-hackers-behind-san-francisco-airport-hack\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-state-hackers-behind-san-francisco-airport-hack\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-state-hackers-behind-san-francisco-airport-hack\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/russian-state-hackers-behind-san-francisco-airport-hack.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/04\\\/russian-state-hackers-behind-san-francisco-airport-hack.jpg\",\"width\":1000,\"height\":500},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/russian-state-hackers-behind-san-francisco-airport-hack\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"headline,government,malware,russia,cyberwar\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/headlinegovernmentmalwarerussiacyberwar\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Russian State Hackers Behind San Francisco Airport Hack\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Russian State Hackers Behind San Francisco Airport Hack 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/russian-state-hackers-behind-san-francisco-airport-hack\/","og_locale":"en_US","og_type":"article","og_title":"Russian State Hackers Behind San Francisco Airport Hack 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/russian-state-hackers-behind-san-francisco-airport-hack\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2020-04-14T14:33:09+00:00","og_image":[{"width":1000,"height":500,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/04\/russian-state-hackers-behind-san-francisco-airport-hack.jpg","type":"image\/jpeg"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/russian-state-hackers-behind-san-francisco-airport-hack\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/russian-state-hackers-behind-san-francisco-airport-hack\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Russian State Hackers Behind San Francisco Airport Hack","datePublished":"2020-04-14T14:33:09+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/russian-state-hackers-behind-san-francisco-airport-hack\/"},"wordCount":707,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/russian-state-hackers-behind-san-francisco-airport-hack\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/04\/russian-state-hackers-behind-san-francisco-airport-hack.jpg","keywords":["headline,government,malware,russia,cyberwar"],"articleSection":["Packet Storm"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/russian-state-hackers-behind-san-francisco-airport-hack\/","url":"https:\/\/www.threatshub.org\/blog\/russian-state-hackers-behind-san-francisco-airport-hack\/","name":"Russian State Hackers Behind San Francisco Airport Hack 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/russian-state-hackers-behind-san-francisco-airport-hack\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/russian-state-hackers-behind-san-francisco-airport-hack\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/04\/russian-state-hackers-behind-san-francisco-airport-hack.jpg","datePublished":"2020-04-14T14:33:09+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/russian-state-hackers-behind-san-francisco-airport-hack\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/russian-state-hackers-behind-san-francisco-airport-hack\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/russian-state-hackers-behind-san-francisco-airport-hack\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/04\/russian-state-hackers-behind-san-francisco-airport-hack.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2020\/04\/russian-state-hackers-behind-san-francisco-airport-hack.jpg","width":1000,"height":500},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/russian-state-hackers-behind-san-francisco-airport-hack\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"headline,government,malware,russia,cyberwar","item":"https:\/\/www.threatshub.org\/blog\/tag\/headlinegovernmentmalwarerussiacyberwar\/"},{"@type":"ListItem","position":3,"name":"Russian State Hackers Behind San Francisco Airport Hack"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/34391","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=34391"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/34391\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/34392"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=34391"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=34391"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=34391"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}