{"id":35315,"date":"2020-06-01T17:35:00","date_gmt":"2020-06-01T17:35:00","guid":{"rendered":"https:\/\/www.darkreading.com\/attacks-breaches\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\/d\/d-id\/1337962"},"modified":"2020-06-01T17:35:00","modified_gmt":"2020-06-01T17:35:00","slug":"rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\/","title":{"rendered":"Rare NSA Advisory About Russia-Based Cyberattacks Unlikely to Stop Them"},"content":{"rendered":"
\n<\/header>\n

The Sandworm group — behind disinformation and election-hacking campaigns and responsible for a 2016 power outage in the Ukraine — is now targeting e-mail servers.<\/span> <\/p>\n

A rare advisory from the US National Security Agency (NSA), warning of attacks by Russian military intelligence on vulnerable e-mail servers, is not likely to dissuade the nation-state cyber-espionage group from attacking targets of interest, cybersecurity experts say.<\/p>\n

On Thursday, the NSA told organizations<\/a> that a remotely exploitable vulnerability in the EXIM mail transfer agent, which comes installed by default on some versions of Linux, is being targeted by “Russian cyber actors from the GRU Main Center for Special Technologies (GTsST), field post number 74455” \u2014 otherwise known as the Sandworm group. The Sandworm group is one of two main cyber operations groups for Russian military intelligence.<\/p>\n

But aside from convincing targeted organizations to take the appropriate actions to protect their systems, the advisory will likely not blunt the attacks, says Greg Lesnewich, a threat intelligence researcher at Recorded Future.<\/p>\n

“We have tried naming and shaming of the individual operators and the unit \u2014 obviously sanctions have been tried,” he says. “I think that Russian intelligence agencies have a high risk tolerance and feel pretty emboldened to do what they are doing, so I’m not entirely sure what we could potentially do to deter them from conducting these activities.”<\/p>\n

The warning<\/a> does not bode well for the latest US election cycle. With politics already polarized and disinformation regularly being used by political parties and foreign rivals, the revelation that Russian intelligence has likely gained access to some government organizations’ and businesses’ e-mail servers is troubling. <\/p>\n

In addition, the fact that a US intelligence agency is raising a flag should lend credence to the information and may spur action, Lesnewich says.<\/p>\n

“Predominantly, it is to help American \u2014 and potentially some UK, Australian, and Canadian \u2014 businesses and entities to patch these servers to prevent incidents from happening,” he says. “In addition, by naming the GRU unit associated with the activity, they are putting resources and a warning out to help the public. We are in an election year, and this GRU activity has been implicated in election meddling both in the US and abroad.”<\/p>\n

Attack Record<\/strong>
For at least 15 years, the Sandworm group \u2014 also known as Iridium, Electrum, BlackEnergy, and Voodoo Bear<\/a> \u2014 has compromised a variety of political targets, sown disinformation, and collected intelligence on Russia’s rivals and interests. It has twice caused power outages in Ukraine and targeted the 2018 Winter Olympics with the Olympic Destroyer attack. The group has also started focusing on deploying Android malware to target South Korean and Ukrainian targets by creating knock-off applications that resembled other applications \u2013 in one case compromising a developer account, according to Google’s Threat Analysis Group<\/a>.<\/p>\n

The Russian government agency behind the attacks, known as the Main Directorate of the General Staff of the Armed Forces (GRU), is one of the most well-known state actors on the Internet, global consulting firm Booz Allen Hamilton stated in an in-depth analysis of Sandworm attacks<\/a> published in March 2020.<\/p>\n

“The GRU is not the only Russian government agency that conducts cyber operations, but it is Russia’s most thoroughly documented and consistently publicly implicated cyber operations organization,” according to the 84-page analysis. “In recent years, the United States, its allies, and its partners have repeatedly, explicitly, and unequivocally attributed numerous cyber events, cover personas, and security industry group names to the GRU.”<\/p>\n

The EXIM vulnerability (CVE-2019-10149) is trivial to exploit and only requires a specially crafted command to be sent in the “MAIL FROM” filed of a message, the NSA warned in the latest advisory. “When CVE-2019-10149 is successfully exploited, an actor is able to execute code of their choosing,” the NSA said. <\/p>\n

The code downloaded from Sandworm-linked domains and executed on exploited servers adds privileged users, disables some networks security, modifies SSH configuration to allow remote access for the attackers, and executes other code to further compromise the network, the NSA advisory stated.<\/p>\n

EXIM is a popular mail transfer agent \u2014 the servers that shuffle e-mail around the Internet \u2014 with almost 5.3 million computers running the software. At least 30% of those servers are running vulnerable EXIM versions, according to data from Internet intelligence service Shodan.io<\/a>. <\/p>\n

The attackers began targeting the software in August 2019 and downloaded scripts from domains and servers known to belong to the Sandworm group, the NSA stated in its advisory. The agency’s warning is a “rare trifecta move” because the NSA is outing a particular threat actor, warning about a vulnerability, and releasing indicators of compromise, says<\/p>\n

“It is sort of this unprecedented thing for them to publish about, which suggests that these operators have hit targets of interest inside the US or inside friendly foreign intelligence apparatus,” he says. “And that means there must be cases of some juicy targets that are using the EXIM mail server for them to be worried about.”<\/p>\n

The attribution is useful in this case because access to e-mail servers is a critical step in a common cybercriminal operation known as business e-mail compromise (BEC), but the Russian group is not known to use such tactics. Under the lucrative scheme, fraudsters use a compromised e-mail server to intercept messages and invoices sent between a vendor and its clients. By using the access to request changes to bank account information, attackers have rerouted payments to their own accounts, resulting in BEC topping the list of damages due to cybercriminal operations<\/a>.<\/p>\n

Related Content:<\/strong><\/p>\n

<\/div>\n
Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that “really <\/strong> bad day” in cybersecurity. Click for<\/strong> more information and to register<\/a>. <\/strong><\/strong><\/em><\/div>\n

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio<\/a><\/span> <\/p>\n

Recommended Reading:<\/strong><\/p>\n

More Insights<\/span><\/p>\n

Read More HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

The Sandworm group — behind disinformation and election-hacking campaigns and responsible for a 2016 power outage in the Ukraine — is now targeting e-mail servers. Read More HERE<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[151],"tags":[],"class_list":["post-35315","post","type-post","status-publish","format-standard","hentry","category-darkreading-ti"],"yoast_head":"\nRare NSA Advisory About Russia-Based Cyberattacks Unlikely to Stop Them 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Rare NSA Advisory About Russia-Based Cyberattacks Unlikely to Stop Them 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2020-06-01T17:35:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/img.deusm.com\/darkreading\/MarilynCohodas\/VIRTUALSUMMIT_DR20_320x50.jpg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Rare NSA Advisory About Russia-Based Cyberattacks Unlikely to Stop Them\",\"datePublished\":\"2020-06-01T17:35:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\\\/\"},\"wordCount\":1016,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/img.deusm.com\\\/darkreading\\\/MarilynCohodas\\\/VIRTUALSUMMIT_DR20_320x50.jpg\",\"articleSection\":[\"DarkReading |TI\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\\\/\",\"name\":\"Rare NSA Advisory About Russia-Based Cyberattacks Unlikely to Stop Them 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/img.deusm.com\\\/darkreading\\\/MarilynCohodas\\\/VIRTUALSUMMIT_DR20_320x50.jpg\",\"datePublished\":\"2020-06-01T17:35:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\\\/#primaryimage\",\"url\":\"https:\\\/\\\/img.deusm.com\\\/darkreading\\\/MarilynCohodas\\\/VIRTUALSUMMIT_DR20_320x50.jpg\",\"contentUrl\":\"https:\\\/\\\/img.deusm.com\\\/darkreading\\\/MarilynCohodas\\\/VIRTUALSUMMIT_DR20_320x50.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Rare NSA Advisory About Russia-Based Cyberattacks Unlikely to Stop Them\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Rare NSA Advisory About Russia-Based Cyberattacks Unlikely to Stop Them 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\/","og_locale":"en_US","og_type":"article","og_title":"Rare NSA Advisory About Russia-Based Cyberattacks Unlikely to Stop Them 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2020-06-01T17:35:00+00:00","og_image":[{"url":"https:\/\/img.deusm.com\/darkreading\/MarilynCohodas\/VIRTUALSUMMIT_DR20_320x50.jpg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Rare NSA Advisory About Russia-Based Cyberattacks Unlikely to Stop Them","datePublished":"2020-06-01T17:35:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\/"},"wordCount":1016,"commentCount":0,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\/#primaryimage"},"thumbnailUrl":"https:\/\/img.deusm.com\/darkreading\/MarilynCohodas\/VIRTUALSUMMIT_DR20_320x50.jpg","articleSection":["DarkReading |TI"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.threatshub.org\/blog\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\/","url":"https:\/\/www.threatshub.org\/blog\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\/","name":"Rare NSA Advisory About Russia-Based Cyberattacks Unlikely to Stop Them 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\/#primaryimage"},"thumbnailUrl":"https:\/\/img.deusm.com\/darkreading\/MarilynCohodas\/VIRTUALSUMMIT_DR20_320x50.jpg","datePublished":"2020-06-01T17:35:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\/#primaryimage","url":"https:\/\/img.deusm.com\/darkreading\/MarilynCohodas\/VIRTUALSUMMIT_DR20_320x50.jpg","contentUrl":"https:\/\/img.deusm.com\/darkreading\/MarilynCohodas\/VIRTUALSUMMIT_DR20_320x50.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/rare-nsa-advisory-about-russia-based-cyberattacks-unlikely-to-stop-them\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Rare NSA Advisory About Russia-Based Cyberattacks Unlikely to Stop Them"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/35315","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=35315"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/35315\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=35315"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=35315"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=35315"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}