{"id":36128,"date":"2020-07-16T15:34:16","date_gmt":"2020-07-16T15:34:16","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/31400\/Russia-Is-Trying-To-Hack-COVID-19-Vaccine-Development.html"},"modified":"2020-07-16T15:34:16","modified_gmt":"2020-07-16T15:34:16","slug":"russia-is-trying-to-hack-covid-19-vaccine-development","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/russia-is-trying-to-hack-covid-19-vaccine-development\/","title":{"rendered":"Russia Is Trying To Hack COVID-19 Vaccine Development"},"content":{"rendered":"
<\/div>\n
<\/p>\n

Russian state-based hackers have targeted Western COVID-19 vaccine development, the cybersecurity agencies of the United States, United Kingdom, and Canada say.<\/p>\n

<\/span><\/p>\n

APT29, a hacker group that has been linked to the Kremlin and Russian-sanctioned hacking campaigns, undertook a campaign to steal information and intellectual property around the development and testing of vaccines for the novel coronavirus.<\/p>\n

<\/span><\/p>\n

The campaign sought to \u201chinder response efforts at a time when healthcare experts and medical researchers need every available resource to help fight the pandemic\u201d reads a joint statement from the three countries.<\/p>\n

<\/span><\/p>\n

The hackers used malware known as \u201cWellMess\u201d and \u201cWellMail\u201d in order to gain access to researchers\u2019 computers. Japan\u2019s cyber security agency issued an alert<\/a> in 2018, warning that WellMess was targeting Windows and Linux machines, after the malware was found on Japanese systems.<\/p>\n

<\/span><\/p>\n

The malware gives hackers the ability to access the target system and upload and download files at will. The hacks have not been publicly connected to APT29 before today.<\/p>\n

<\/span><\/p>\n

\u201cThroughout 2020, APT29 has targeted various organisations involved in COVID-19 vaccine development in Canada, the United States and the United Kingdom, highly likely with the intention of stealing information and intellectual property relating to the development and testing of COVID-19 vaccines,\u201d reads a joint technical advisory.<\/p>\n

<\/span><\/p>\n

It\u2019s not clear how successful the hackers were.<\/p>\n

<\/span><\/p>\n

A spokesperson for Russian President Vladimir Putin strenuously denied that Russia tried to hack Western research agencies. \u201cRussia has nothing to do with these attempts and we do not accept such accusations just like we don\u2019t accept yet another set of unfounded accusations of interference in the 2019 [UK] elections,\u201d said the spokesperson per CNN.<\/a><\/p>\n

<\/span><\/p>\n

The British also announced Thursday<\/a> that evidence points to Russian interference in their 2019 election.<\/p>\n

<\/span><\/p>\n

The Russian hacker group, sometimes referred to as \u201cCozy Bear\u201d or by other aliases, was also identified as the group responsible for the hack on the servers of the Democratic National Committee<\/a>, putting it at the centre of a conspiracy by Moscow to try and elect Donald Trump as president.<\/p>\n

<\/span><\/p>\n

\u201cThe group uses a variety of tools and techniques to predominantly target governmental, diplomatic, think-tank, healthcare and energy targets for intelligence gain,\u201d reads an assessment from the UK.<\/p>\n

<\/span><\/p>\n

The Communications Security Establishment (CSE), Canada\u2019s main signals intelligence agency and cyber security organization, concluded that APT29 \u201calmost certainly operates as part of Russian intelligence services\u201d\u2014a very high degree of confidence.<\/p>\n

<\/span><\/p>\n

The Establishment was joined by the UK\u2019s Government Communications Headquarters\u2019 National Cyber Security Centre and the American Department of Homeland Security\u2019s Cybersecurity and Infrastructure Security Agency.<\/p>\n

<\/span><\/p>\n

\u201cAPT29 is likely to continue to target organisations involved in COVID-19 vaccine research and development, as they seek to answer additional intelligence questions relating to the pandemic,\u201d the UK agency wrote in a technical assessment.<\/p>\n

<\/span><\/p>\n

The CSE is imploring health organizations to take steps to protect themselves from cyber attack, and has previously released an assessment warning of potential cyberattacks<\/a> on COVID-19 researchers.<\/p>\n

<\/span><\/p>\n

The joint assessment says APT29 used known exploits<\/a> in commercial VPN and remote access software, including Citrix, PulseSecure, and Fortinet.<\/p>\n

<\/span><\/p>\n

Follow Justin Ling on Twitter<\/a>.<\/em><\/p>\n

<\/span><\/div>\n

\n