‘Wagner Mercenary’ Hackers Destroy Russian Satellite Comms – Source: securityboulevard.com

“Restoration may take several months”

A group of previously unknown hackers has claimed responsibility for a cyberattack on the Russian satellite communications provider Dozor-Teleport. … Dozor’s parent company, Amtel Svyaz, also suffered a significant outage.

…

The group behind the hack claims to be affiliated with the notorious Wagner Group, the Russian private mercenary army that made global headlines last week when it marched toward Moscow to rebel against the Russian government. … Its commander, Yevgeny Prigozhin, fled to Belarus. [But some] experts expressed skepticism that the group was involved.

…

The hackers claim that they damaged some of the satellite terminals and leaked and destroyed confidential information stored on the company’s servers. … Restoring the core network could [take] a few days [or] weeks, while reprogramming user equipment and achieving full restoration may take several months.

“It serves the Russian military”

Two groups claimed responsibility for the attack, one describing itself as a hacktivist organization and the other as part of the Wagner Group. … Multiple self-proclaimed hacktivists have attacked websites and critical infrastructure in Russia and Ukraine since the war began, but many of them coordinate with or are cover for military forces.

…

A connection to Wagner could be faked to promote more division in Russia. A real one would be more interesting.

…

Dozor’s … customers include Russian soldiers in Ukraine. … It serves the Russian military and other federal services. … Military units on the move could find it … vital.

“Remains unclear”

In a Telegram message, the hacking group claims [it] defaced four Russian websites with a message titled: Who are the Wagners?

…

“On June 24th, the whole world watched our actions, listening to our every word. We showed how easily we can reach Moscow in a day without meeting any resistance. … We have shown that we must be reckoned with and that our strength cannot be curbed. … This is just the beginning—more to come.”

…

But it remains unclear if [it’s] connected to the real Wagner group. So far, the official Telegram channel for the Russian military organization has yet to comment. … It’s possible that disgruntled segments of Wagner continue to revolt against Russian leadership. But some researchers suspect the hacks come from other parties looking to sow chaos in Russia.

How many months until they’re using those old vacuum-tube box radios that they strap on someone’s back?

Wagner has a lot of experience with cyber crimes. I’m glad they’re using their skills on a deserving target for once.

I take this as a sign that the major core thrust of the spring campaign has now begun. … Nearly every exploit you find is single-use only. If you do something as dramatic as knocking out a satellite network, huge resources will be devoted to figuring how exactly how you did it, and how to keep you from doing it again.

…

Because of this, you don’t just deploy these on mass scale on a whim. [You] hoard them and deploy them at critical times. What better time to destroy Russian military communications than right when you start your main offensive thrust?

So far it’s difficult to trust any information about this incident. [But] Dozor uses common iDirect equipment, not a custom modem. [So,] if terminals have been actually wiped, the same approach would work for many other SATCOM providers.

Recent Articles By Author