A sophisticated cyber-espionage attack used by notorious Russian advanced persistent threat (APT) Fancy Bear at the outset of the current Russia-Ukraine war demonstrates a novel attack vector that a threat actor can use to remotely infiltrate the network of an organization far away by compromising a Wi-Fi network in close proximity to it.
Fancy Bear (aka APT28 or Forest Blizzard) breached the network of a US organization using this method, which the researchers at Volexity are calling a “Nearest Neighbor” attack.
“The threat actor accomplished this by daisy-chaining their approach, to compromise multiple organizations in close proximity to their intended target, Organization A,” Volexity researchers Sean Koessel, Steven Adair, and Tom Lancaster wrote in a post detailing the attack. “This was done by a threat actor who was thousands of miles away and an ocean apart from the victim.”
The hack demonstrated “a new class of attack” for an attacker so far away from the intended target to use the Wi-Fi method, the researchers said. Volexity tracks Fancy Bear — a part of Russia’s General Staff Main Intelligence Directorate (GRU) that’s been an active adversary for at least 20 years — as “GruesomeLarch,” one of the APT’s many names.
Volexity first discovered the attack just ahead of Russia’s invasion of Ukraine in February 2022, when a detection signature Volexity had deployed at a customer site indicated a compromised server. Eventually, the researchers would determine that Fancy Bear was using the attack “to collect data from individuals with expertise on and projects actively involving Ukraine” from the Washington, DC-based organization.
