Russian Cyber Campaign Targets Energy and Cloud Infrastructure: Implications for North East India
Unveiling a Multi-Year Cyber Espionage Campaign
Amazon's threat intelligence team has revealed details of a long-running Russian state-sponsored cyber campaign that targeted Western critical infrastructure between 2021 and 2025. The campaign, attributed with high confidence to Russia's Main Intelligence Directorate (GRU), targeted energy sector organizations, critical infrastructure providers, and cloud-hosted network infrastructure across Western nations, North America, and Europe.
Targeting Vulnerabilities in Edge Network Devices
The campaign exploited various vulnerabilities over five years, with a notable shift towards misconfigured edge network devices with exposed management interfaces. In 2021-2022, the WatchGuard Firebox and XTM flaw (CVE-2022-26318) was exploited, while Atlassian Confluence flaws (CVE-2021-26084 and CVE-2023-22518) were targeted in 2022-2023. Veeam flaw (CVE-2023-27532) was exploited in 2024, and the campaign continued to target misconfigured edge network devices in 2025.
Relevance to North East India
While the primary targets were Western nations and critical infrastructure providers, the use of misconfigured edge network devices as initial access vectors is a concern for all organizations, including those in North East India. It underscores the importance of securing network infrastructure and regularly auditing edge devices for potential vulnerabilities.
Credential Replay Attacks and Lateral Movement
The attacks aimed at obtaining a deeper foothold into targeted networks by leveraging credential replay attacks against victim organizations' online services. Although these attempts were unsuccessful, they highlighted the threat actor's interest in gathering credentials from compromised customer network infrastructure for follow-on attacks.
Relevance to Broader Indian Context
The targeting of energy, technology/cloud services, and telecom service providers across various regions, including North America, Europe, and the Middle East, underscores the global nature of cyber threats. As India continues to invest in digital infrastructure, it becomes increasingly important to prioritize cybersecurity measures to protect critical assets.
Coordinated Efforts and Infrastructure Overlaps
The intrusion set shares infrastructure overlaps with another cluster tracked by Bitdefender under the name Curly COMrades, suggesting complementary operations within a broader campaign undertaken by GRU. This aligns with GRU operational patterns of specialized subclusters supporting broader campaign objectives.
Looking Ahead: Protecting Against Advanced Threats
To protect against such advanced threats, organizations are recommended to audit all network edge devices for unexpected packet capture utilities, implement strong authentication, monitor for authentication attempts from unexpected geographic locations, and keep tabs on credential replay attacks.