My information Resource (blog.mir.net) – Page 8 – A users view of technology by Jay Ferron

Russia Cyber Threat Operations

Russian nation-state cyber actors remain among the most persistent, capable, and strategically aligned threats in the global cyber landscape. Their operations routinely target Western governments, critical infrastructure, defense contractors, and political institutions, using a combination of cyber espionage, advanced malware, and living-off-the-land techniques. These campaigns are characterized by prolonged presence, covert operations, and strategic alignment with Russia’s geopolitical goals, making them especially challenging to detect and mitigate.

A key takeaway from this analysis is that Russian cyber activity is not merely opportunistic; it is intentional and ongoing, designed to maintain persistent access for future disruption, espionage, or influence efforts. Russia’s ability to blend into trusted environments and exploit legitimate platforms significantly raises the threat to national security, essential services, and the private sector.

In the broader risk context, Russia exemplifies the intersection of cyber operations and hybrid warfare, where espionage, sabotage, and geopolitical strategy align. Organizations must prioritize detection and hardening against known Russian tactics, techniques, and procedures (TTPs), particularly those involving credential theft, cloud environment exploitation, and lateral movement, as these remain core elements of Russia’s offensive cyber strategy.

Key Points

Who: Russian state-sponsored actors, including APT28 (Fancy Bear), APT29 (Cozy Bear), Sandworm, and Gamaredon.
What: Conducted cyber espionage, prepositioned in networks, and launched disruptive operations aligned with Russian geopolitical goals.
How: Used spearphishing, credential harvesting, zero-day exploits, cloud service abuse, and stealthy tools like living-off-the-land binaries (LOLBins) and custom malware.
Why it matters: These operations are designed not only for data theft but also to maintain persistent access, evade detection, and retain the ability to disrupt critical infrastructure or manipulate information at strategic moments.

Risk Assessment

The NJCCIC has assessed that Russian state-sponsored cyber actors represent a persistent and evolving threat with the demonstrated capability and intent to conduct both intelligence-gathering and disruptive operations. Their activities seriously threaten national security, essential public services, and critical industries.

Recently, these groups have changed tactics by increasingly targeting cloud infrastructure and identity management platforms like Microsoft 365. This evolution includes deploying new malware variants designed to evade traditional detection methods, allowing them to infiltrate previously considered lower-risk environments.

Russian actors have a well-documented history of targeting entities across government, critical infrastructure, healthcare, defense, and election systems. The likelihood of exposure or compromise is significantly higher if environments include legacy technology or commonly used third-party platforms. The combination of their strategic intent, advanced techniques, and a sector’s relevance makes proactive defense and visibility into these threat vectors essential.

Timeline of Activity

Attribution	Start Date	End Date	Location	Sector	Activity
APT 28 (Fancy Bear)	2007	Present	Global (US, NATO, and Europe)	Government, Military, and Media	Espionage, election interference, credential theft, hack and leak operations
APT 29 (Cozy Bear)	2008	Present	Global	Government, Think Tanks, and NGOs	Cyber espionage, credential harvesting, and supply chain compromises
Turla (Venomous Bear)	2008	Present	Europe and the Middle East	Government, Military, and Research	Long-term espionage, custom malware, and hijacking satellite infrastructure
Berserk Bear (Energetic Bear)	2010	Present	Europe and the US	Energy and ICS	ICS reconnaissance, credential harvesting, and infrastructure targeting
Gamaredon (Primitive Bear)	2013	Present	Ukraine	Government	Phishing, malware, and espionage
Sandworm Team	2014	Present	Ukraine and Global	Energy, ICS, and Telecom	Destructive Malware (NotPetya), ICS Attacks, and Wiper Malware
Evil Corp (Indrik Spider)	2014	Present	Global	Finance, Retail, and Healthcare	Banking trojans and ransomware deployments
Star Blizzard	2017	Present	UK, US, and Ukraine	Academia and Government	Credential theft and phishing
Shuckworm	2017	Present	Ukraine	Government	Using old malware
Nobelium (Subset of APT 29)	2020	2021	Global	IT, Government, and Supply Chain	SolarWinds compromise, cloud service, and lateral movement
NoName057(16)	2022	Present	Europe, NATO-aligned States	Government and Media	DDoS ops focused on Finland, Latvia, and Poland. Activity spikes during major NATO summits and political votes.
KillNet (pro-Russian hacktivist)	2022	Present	NATO, EU, and US	Government, Healthcare, and Transportation	DDoS attack on US hospital, Polish rail, and airport websites.
Fancy Bear	2022	Present	Europe and the US	Critical Infrastructure	Compromise of CCTV at transit hubs to monitor Western Military Aid
RomCom	2024	Present	Europe and the US	Government, Defense, Energy, Pharma, and Legal	Zero-click exploits via Firefox (CVE-2024-9680) and Windows (CVE-2024-49039), deploying RATs

Capabilities

Advanced Persistent Threats (APTs): Russia maintains multiple state-sponsored groups (APT28, APT29, Sandworm) capable of long-term, covert operations across sectors.
Malware Toolsets: Known for deploying malware such as NotPetya, Snake, Drovorub, WellMess, and CosmicDuke.
Tradecraft: Uses living-off-the-land binaries (LOLBins), legitimate credentials, and cloud platform abuse (Microsoft 365).
Operational Focus: Supports espionage, prepositioning in critical infrastructure, disinformation, and destructive attacks aligned with geopolitical goals.
Supply Chain Intrusions: Demonstrated ability to compromise software providers and abuse trusted relationships (SolarWinds, Ukrainian tax software).
ICS/OT Disruption: Proven capacity to target and impact operational technology systems (BlackEnergy, Industroyer).
Information Warfare: Coordinates cyber operations with disinformation and influence campaigns targeting elections and public opinion.

Key Intelligence Gaps

The NJCCIC has assessed that several intelligence gaps limit a full Russian cyber threat landscape assessment. One of the most pressing concerns is whether Russian threat actors are currently positioning themselves within networks to carry out future physical or disruptive attacks, particularly amid ongoing geopolitical tensions and hybrid warfare strategies.

Another critical intelligence gap concerns developing and deploying new malware strains, particularly malware designed to target industrial control systems (ICS), satellite infrastructure, or emerging space technologies, where visibility remains low.

The degree of coordination between Russian intelligence services and non-state criminal cyber groups (such as ransomware-as-a-service operators) also remains unclear. It is essential to determine how much operational freedom these groups have and whether they receive explicit support or protection from the state. There is also a lack of clarity about whether Russia’s agencies are working together or against each other.

Additionally, there is limited insight into evolving Russian tactics for evading detection, especially in hybrid and multi-cloud environments, where traditional monitoring tools may fall short.

The impact of economic sanctions and wartime constraints on Russia’s cyber strategy and operational capabilities is also poorly understood, leaving a gap in forecasting future shifts in tactics or targeting priorities.

Known Threat Groups

Military Intelligence (GRU)

APT28: Fancy Bear, Sofacy, STRONTIUM, Sednit
Sandworm Team: BlackEnergy, Voodoo Bear, TeleBots
Gamaredon Group: Primitive Bear
InvisiMole: Occasionally linked with Gamaredon

Foreign Intelligence Service (SVR)

APT29: Cozy Bear, The Dukes, Yttrium, Nobelium

Federal Security Service (FSB)

Turla: Snake, Uroburos, Venomous Bear
Berserk Bear: Energetic Bear, Crouching Yeti, Dragonfly
Krypton: Suspected ties to Turla

Get your skills up to speed on retrieval-augmented generation

Meet Researcher and Analyst in Microsoft 365 Copilot: July 2025 edition

NIST Welcomes Comments on Outline for Standards “Zero Draft” on AI Testing, Evaluation, Verification, and Validation

In March 2025, based on stakeholders’ input, NIST announced its AI Standards Zero Drafts pilot project to accelerate the creation of AI standards and expand participation in AI standards development.

After the pilot’s launch, NIST identified two initial topics based on community feedback: AI testing, evaluation, verification, and validation (TEVV) and documentation of AI models and datasets. NIST has now released a detailed outline proposing a direction and structure for the forthcoming TEVV zero draft.

The proposed document is intended as an overarching framework that helps AI practitioners design appropriate TEVV approaches for specific systems and cases. It is envisioned as integrating with current and future ISO/IEC standards on AI testing while also providing a suitable backdrop to facilitate their application.

Read the Outline

Feedback on the outline is welcome. Input received by September 12, 2025, will be considered for NIST’s initial public draft of the text; input received later will be considered for incorporation into subsequent iterations.

NIST Proposes to Update SP 800-56A and Revise SP 800-56C

In December 2024, NIST’s Crypto Publication Review Board initiated a review of the following Special Publications (SP):

NIST SP 800-56Ar3, Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography (2018)
NIST SP 800-56Br2, Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography (2019)
NIST SP 800-56Cr2, Recommendation for Key-Derivation Methods in Key-Establishment Schemes (2020)

In response, NIST received public comments.

NIST proposes to:

update SP 800-56Ar3
reaffirm SP 800-56Br2
revise SP 800-56Cr2

Submit comments on this decision by September 15, 2025 to cryptopubreviewboard@nist.gov with “Comments on SP 800-56 Decision Proposal” in the subject line. Comments received in response to this request will be posted on the Crypto Publication Review Project site after the due date. Submitters’ names and affiliations (when provided) will be included, while contact information will be removed. See the project site for additional information about the review process.

UPDATE: Microsoft Releases Guidance on Exploitation of SharePoint Vulnerabilities

Update (07/22/2025): This Alert was updated to reflect newly released information from Microsoft, and to correct the actively exploited Common Vulnerabilities and Exposures (CVEs), which have been confirmed as CVE-2025-49706, a network spoofing vulnerability, and CVE-2025-49704, a remote code execution (RCE) vulnerability.

CISA is aware of active exploitation of a spoofing and RCE vulnerability chain involving CVE-2025-49706 and CVE-2025-49704, enabling unauthorized access to on-premise SharePoint servers. While the scope and impact continue to be assessed, the chain, publicly reported as “ToolShell,” provides unauthenticated access to systems and authenticated access through network spoofing, respectively, and enables malicious actors to fully access SharePoint content, including file systems and internal configurations, and execute code over the network.

While not actively exploited, Microsoft has identified the following new CVEs that pose a potential risk:

CVE-2025-53771 is a patch bypass for CVE-2025-49706.
CVE-2025-53770 is a patch bypass for CVE-2025-49704.

CISA recommends the following actions to reduce the risks associated with the RCE compromise:

Apply the necessary security updates released by Microsoft.
Configure Antimalware Scan Interface (AMSI) in SharePoint as indicated by Microsoft and deploy Microsoft Defender AV on all SharePoint servers.
- If AMSI cannot be enabled, disconnect affected products from service that are public-facing on the internet until official mitigations are available. Once mitigations are provided, apply them according to CISA and vendor instructions.
- Follow the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available.
For information on detection, prevention, and advanced threat hunting measures, see Microsoft’s Disrupting active exploitation of on-premises SharePoint vulnerabilities and advisory for CVE-2025-49706. CISA encourages organizations to review all articles and security updates published by Microsoft on July 8, 2025, relevant to the SharePoint platform deployed in their environment.
Rotate ASP.NET machine keys, then after applying Microsoft’s security update, rotate ASP.NET machine keys again, and restart the IIS web server.
Disconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) from the internet. For example, SharePoint Server 2013 and earlier versions are end-of-life and should be discontinued if still in use.
Monitor for POSTs to /_layouts/15/ToolPane.aspx?DisplayMode=Edit
Conduct scanning for IPs 107.191.58[.]76, 104.238.159[.]149, and 96.9.125[.]147, particularly between July 18-19, 2025.
Update intrusion prevention system and web-application firewall (WAF) rules to block exploit patterns and anomalous behavior. For more information, see CISA’s Guidance on SIEM and SOAR Implementation.
Implement comprehensive logging to identify exploitation activity. For more information, see CISA’s Best Practices for Event Logging and Threat Detection.
Audit and minimize layout and admin privileges.

For more information on this vulnerability, please see Eye Security’s reporting and Palo Alto Networks Unit42’s post. CVE-2025-53770 was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on July 20, 2025. Update: CVE-2025-49706 and CVE-2025-49704 were added to the KEV on July 22, 2025.

Note: This Alert may be updated to reflect new guidance issued by CISA or other parties.

CISA would like to acknowledge the contributions of the security researcher community in rapidly sharing insights that enabled CISA to notify critical infrastructure organizations impacted by this activity.

Organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at contact@mail.cisa.dhs.gov or (888) 282-0870.

#StopRansomware: Interlock

This Joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Department of Health and Human Services (HHS), and Multi-State Information Sharing and Analysis Center (MS-ISAC)—hereafter referred to as the authoring agencies—are releasing this Joint Cybersecurity Advisory to disseminate known Interlock ransomware IOCs and TTPs identified through FBI investigations (as recently as June) and trusted third-party reporting.

The Interlock ransomware variant was first observed in late September 2024, targeting various business, critical infrastructure, and other organizations in North America and Europe. FBI maintains these actors target their victims based on opportunity, and their activity is financially motivated. FBI is aware of Interlock ransomware encryptors designed for both Windows and Linux operating systems; these encryptors have been observed encrypting virtual machines (VMs) across both operating systems. FBI observed actors obtaining initial access via drive-by download from compromised legitimate websites, which is an uncommon method among ransomware groups. Actors were also observed using the ClickFix social engineering technique for initial access, in which victims are tricked into executing a malicious payload under the guise of fixing an issue on the victim’s system. Actors then use various methods for discovery, credential access, and lateral movement to spread to other systems on the network.

Interlock actors employ a double extortion model in which actors encrypt systems after exfiltrating data, which increases pressure on victims to pay the ransom to both get their data decrypted and prevent it from being leaked.

The authoring agencies encourage organizations to implement the recommendations in the mitigations section of this advisory to reduce the likelihood and impact of Interlock ransomware incidents.

The Growing Threat of Wiper Malware

Wiper malware is a type of destructive malware that destroys organizational files and data, rendering them inaccessible and unusable. It typically spreads through phishing emails, malicious downloads, exploited vulnerabilities, Remote Desktop Protocol (RDP) exploits, and supply chain attacks. Wiper malware is commonly used to destroy critical assets and data and disrupt business operations, leading to financial losses and reputational damage. Threat actors use several techniques to destroy data, including overwriting files with other data (such as NULL or random bytes), encrypting files and destroying the decryption key, corrupting or overwriting the Master Boot Record (MBR), and corrupting the Master File Table (MFT).

It shares many features with ransomware except for its ultimate objective. Unlike ransomware, in which encrypted files may be recovered with a decryption key after a ransom is paid, wiper malware can masquerade as ransomware without a decryption capability. It intends to destroy data instantly and permanently, preventing data decryption and content recovery efforts even if a ransom is paid. The tactics of ransomware-as-a-service (RaaS) operations continue to evolve with emerging dual-threat capabilities combining file encryption and file destruction. The wiper feature is likely added to increase pressure on victims to pay the ransom more quickly instead of delaying or ignoring negotiations altogether.

The history of notable wiper malware started in 2012. Wiper malware was used sporadically over the following ten years to target organizations for sabotage, destruction of evidence, cyberwar, and some financial gain. Therefore, it was a preferred tool for nation-state actors and hacktivists over threat actors seeking profit. The United States government attributed the 2014 Sony Pictures Entertainment (SPE) hack to the Lazarus Group, alleged to be run by the North Korean government. SPE was the first US company to be impacted by wiper malware. In 2017, NotPetya was disguised as ransomware and intended to target Ukraine. However, it spread to many systems worldwide, including the United States and several New Jersey organizations.

Wiper malware activity surged in 2022, with attacks primarily targeting and crippling Ukranian infrastructure or organizations in the Ukraine-Russia war. It was also used by LokiLocker ransomware operators in 2022 and LockBit ransomware operators in 2023 to attack organizations that refused to negotiate a ransom payment. The use of wiper malware in ransomware attacks suggests a potential evolution of tactics by groups not linked to nation-state actors or hacktivists to retaliate and inflict maximum damage on uncooperative victims. In 2024, wiper malware continued with numerous variants, such as AcidPour targeting Linux devices in critical sectors, pro-Palestinian hacktivist group Handala Hacking Team targeting Windows and Linux environments of Israeli organizations, and Hamas-affiliated WIRTE group targeting Israeli organizations with phishing emails delivering SameCoin Wiper. Additionally, threat actors destroyed data of over half (54 percent) of global financial institutions in 2024, an increase of 12.5 percent since 2023.

At the beginning of 2025, wiper malware and ransomware were predicted to continue to increase and evolve, especially across government agencies and critical infrastructure sectors. Since then, there have been some notable wiper malware and ransomware incidents. Researchers discovered a destructive attack on a Ukrainian critical infrastructure organization using a previously unknown wiper malware. Dubbed PathWiper , the variant is likely attributed to a Russian advanced persistent threat (APT) actor that had access to the administrative console of a legitimate endpoint administration framework. The threat actors targeted the master boot record (MBR) and NTFS-related artifacts for corruption, issued malicious commands, and deployed PathWiper across endpoints in the victim organization’s environment. When executed, PathWiper dismounted volumes and overwrote artifacts with randomly generated bytes.

Threat actors also targeted Linux servers in a supply chain attack with wiper malware hidden in three Golang modules on GitHub. The malware overwrote every byte of data with zeros. In a separate campaign, threat actors used typosquatting of legitimate tools to publish eight malicious packages on NPM . The malicious packages destroyed framework files, corrupted core JavaScript methods, and sabotaged browser storage mechanisms.

Wiper malware showed an increasing and evolving trend in ransomware operations in 2025. SuperBlack ransomware operators exploited two Fortinet vulnerabilities and used wiper malware, as seen in previous ransomware incidents tied to LockBit and BrainCipher. The wiper file removed evidence of the ransom executable after encryption. ARCH WIPER ransomware operators destroyed data instead of extorting money by encrypting files without a ransom. A message was delivered stating that the files were permanently corrupted, and victims were advised to reset their systems. Anubis ransomware operators added wiper malware and claimed victims in healthcare, hospitality, business services, and construction in the United States. Anubis’s wiper feature used a /WIPEMODE parameter to permanently wipe the contents of files. Once wiped, the filenames and extensions remained displayed and untouched in the expected directories, but their file sizes were reduced to 0 KB.

A recent report revealed that ransomware is increasingly targeting cloud environments, and one of the most common types is data wiper ransomware. Threat actors, including ransomware operators, may leverage access to cloud environments to delete cloud storage, accounts, machine images, and other infrastructure that is critical to business operations. Although there is currently no evidence of wiper malware specifically targeting New Jersey, it does not mean that organizations, including critical infrastructure, are immune to this threat.

SMiShing at Scale:A Deep Dive into Toll Violation Text Scams

Many types of SMiShing scams continue to target New Jersey residents. Thank you and kudos to all who continue reporting scams to the NJCCIC. Each of you who reported scams recognized them for what they are: scams. Through reporting, the NJCCIC analyzes and paints a clearer picture of the current threat landscape, helps warn others, offers resources to those impacted, and takes action to help prevent any further expansion of these fraudulent campaigns.

The scope of these SMiShing campaigns is extensive, affecting numerous US states and resulting in significant financial losses. The FTC highlighted that consumers reported losses amounting to $470 million in 2024 due to scams initiated via text messages, marking a fivefold increase compared to 2020 figures. SMiShing text messages for unpaid tolls were specifically identified as a top text scam category.

Please read the NJCCIC report SMiShing at Scale: A Deep Dive into Toll Violation Text Scams for further information on how these scams are perpetrated and information to help prevent you from falling victim.

Draft NIST IR 7621r2 ipd- Small Business Cybersecurity: Non-Employer Firms

One Week Left to Comment—Small Business Cybersecurity: Non-Employer Firms

There is one week left to comment on the Initial Public Draft (IPD) of NIST Internal Report (NIST IR) 7621 Revision 2, Small Business Cybersecurity: Non-Employer Firms. The comment period closes at 11:59 p.m. EDT on June 30, 2025.

Image Credit: Adobe

Brief Document Timeline

October 2009 – NIST IR 7621, Small Business Information Security: The Fundamentals is first published.
November 2016 – NIST IR 7621 Revision 1 is published.
March 2024 – NIST issues a pre-draft call for comments for NIST IR 7621, Revision 2.
May 2025 – Draft NIST IR 7621 Revision 2 Initial Public Draft, Small Business Cybersecurity: Non-Employer Firms, is published for public comment.

Key Updates within Revision 2

This revision has a narrowed scope. Previous versions of this publication discussed the broader topic of information security; this revised publication is now focused specifically on cybersecurity, which is a subset of information security.
The audience has also been narrowed. Prior versions were focused generally on “small business,” which is a very broad and diverse population. This revision is tailored to a more specific population—non-employer firms.
Revision 2 reflects changes in technology and recent updates to NIST publications, including the Cybersecurity Framework (CSF) 2.0 and the NIST IR 8286 series.
The layout has also been updated to present the information in a tabular format to enhance readability.

Submitting Comments

We value and welcome your input and look forward to your comments. The comment period closes at 11:59 p.m. EDT on June 30, 2025. Please enter comments into this comment template (xlsx) and email the template to ir7621-comments@nist.gov with “Comments on NIST IR 7621 R2” in the subject field.

View the Publication