{"id":42060,"date":"2021-07-30T16:24:10","date_gmt":"2021-07-30T16:24:10","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/heres-30-servers-russian-intelligence-uses-to-fling-malware-at-the-west-beams-riskiq\/"},"modified":"2021-07-30T16:24:10","modified_gmt":"2021-07-30T16:24:10","slug":"heres-30-servers-russian-intelligence-uses-to-fling-malware-at-the-west-beams-riskiq","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/heres-30-servers-russian-intelligence-uses-to-fling-malware-at-the-west-beams-riskiq\/","title":{"rendered":"Here’s 30 servers Russian intelligence uses to fling malware at the West, beams RiskIQ"},"content":{"rendered":"

Details of 30 servers thought to be used by Russia’s SVR spy agency (aka APT29) as part of its ongoing campaigns to steal Western intellectual property were made public today by RiskIQ.<\/p>\n

Russia’s Foreign Intelligence Service “is actively serving malware (WellMess, WellMail) previously used in espionage campaigns targeting COVID-19 research in the UK, US, and Canada,” according to threat intel firm.<\/p>\n

“Team Atlas assesses with high confidence that these IP addresses and certificates are in active use by APT29 at the time of this writeup,” said RiskIQ in its blog post<\/a>. “We were unable to locate any malware which communicated with this infrastructure, but we suspect it is likely similar to previously identified samples.”<\/p>\n