Microsoft reveals Russian state-backed hackers targeted Ukrainian military equipment through SpaceX’s Starlink

Russian state-sponsored hackers compromised Ukrainian military equipment by identifying and locating IP addresses associated with Ukrainian military equipment. Muskowned Space Exploration Technologies Corporationof Starlink Network connections, according to a threat intelligence report released by Microsoft on Wednesday.

what happened: Hacker group, known as secret blizzard It was linked to Russia’s Federal Security Service and deployed malware to specifically selected target devices between March and April after identifying Ukrainian military units through Starlink IP address signatures.

Secret Blizzard is designed to ensure long-term access to intelligence collection systems, often targeting advanced research and politically sensitive information, leveraging a wide range of resources including multiple backdoors.

“Threat actors are selectively deploying tools to devices of greater interest, such as those originating from STARLINK IP addresses, a common feature of Ukrainian frontline military equipment,” Microsoft’s report said.

Microsoft researchers observed Secret Blizzard using malware called the Amadey bot to gain initial access and then deploying sophisticated backdoors called Tavdig and KazuarV2 to maintain long-term surveillance capabilities.

See also: ‘The biggest risk in artificial intelligence is that we don’t go big enough’, says Peter Thiel as his Founders Fund leads $600 million Crusoe investment

why it’s important: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) previously blamed the secret blizzard on Russia’s Federal Security Service (FSB) Center 16. The organization primarily targets ministries of foreign affairs, embassies, government agencies and defense-related organizations around the world.

Microsoft said it has notified affected customers directly and provided recommendations to strengthen network defenses against such attacks.

The company stresses that while this method of compromising existing access points is concerning, properly configured security measures can effectively detect and block these threats.

Read next:

Image from Shutterstock

Disclaimer: This content is generated in part with the help of artificial intelligence tools, and is reviewed and published by Benzinga editors.