Google Accounts Of US Military, Journalists Targeted By Russian Attack Group

The Threat Group 4127 that hit the Democratic National Committee also went after 1,800 other targets with info interesting to Russian government, says SecureWorks.

A Russian attack group used the Bitly URL-shortener to disguise malicious links in order to carry out spearphishing campaigns not only against the Democratic National Committee, but also against some 1,800 Google accounts of US military and government personnel and others.
Researchers at SecureWorks Counter Threat Unit today said the spearphishing campaign, carried out in mid-2015 by Threat Group 4127 (TG-4127), mostly targeted people inside Russia and former Soviet states, but it also targeted individuals who were publicly critical of the Russian Federation or who had information valuable to the Russian Federation.
SecureWorks tracks them as Threat Group 4127 (TG-4127), but components of their operations have been reported under the names APT28, Sofacy, Sednit, Fancy Bear, and Pawn Storm by other security companies. SecureWorks assesses with moderate confidence that TG-4127 operates from the Russian Federation and gathers intelligence on behalf of the Russian government.
The group registered the domain acco
o
unts-google.com to host a spoofed Google login page, and used the Bitly URL-shortener to cloak that location within the spearphishing messages. In all, some 1,881 Google account users were phished. Some were only sent one message, while others were sent several; the attackers used a total of 4,396 phishing URLs.
Betweeen March 2015 and September 2015, 59% of the malicious URLs were accessed, suggesting that the recipients at least opened the phishing page, and were possibly compromised.
SecureWorks believes that TG-4127s information-gathering efforts primarily focus on individuals and organizations inside Russia and former Soviet states However, certain groups in the US and Western Europe are also targeted.
The researchers break TG-4127s Western targets into two main groups: those who are publicly critical of Russia, including journalists, activists, NGOs, and authors; and those who have information that is useful to the Russian government, like current and former US military personnel, government personnel, and people in the defense supply chain.
The group also targeted a considerable number of authors who write about being military spouses or family members -- 22% of the targeted authors and journalists fell into that category, compared to 53% who were experts on either Russia or Ukraine. SecureWorks theorized that the attackers might be looking for information on broader military issues in the US or gain operational insight into the military activity of the targets spouse.
Of the current and former military and government personnel targeted (excluding the military spouses), 64% were American personnel, according to
SecureWorks report
.
The cybersecurity industry was also in the bullseye. Other targets included a security consultant for NATO and the director of federal sales for the security arm of a multinational technology company. It is not clear how many organizations were actually compromised through this campaign.
Related Content:
Lone Hacker Taking Credit For DNC Breach Is Likely Russian, Says Researcher
Russian Hackers Breach Democrats To Steal Data On Trump
Guccifer 2.0: Red Herring Or Third DNC Hacker?

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Google Accounts Of US Military, Journalists Targeted By Russian Attack Group