Breach Discloure: Federal Security Services (FSB)

Breach Disclosure: Federal Security Service (FSB)

The Federal Security Service (FSB) of the Russian Federation fell victim to a cyberattack after the Russian hacker group, Digital Revolution, breached a contractor for the FSB. According to an article on Forbes, the breach leaked technical documents, diagrams, and code fragments for an FSB project called Fronton. The FSB breach allegedly exposed the goal of the “Fronton Program” that aims to exploit IoT security vulnerabilities.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks

Details

The breached information, accounted for nearly 12 technical documents that date back to 2017/2018. This information was published on the Russian hacker group, Digital Revolution's website, on March 18, 2020. Chatter on Digital Revolution's official website and their Twitter page indicate that the exposed documents exhibit an IoT botnet building process.

Figure 1. Digital Revolution’s Twitter handle advertising the leaked files.

According to several news articles, including Forbes and BBC Russia, the Fronton botnet would potentially be capable of performing a wide spectrum of cyberattacks on IoT devices with default factory settings. Upon a successful attack, the targeted internet security cameras and digital recorders (NVRs) device would be captured in the botnet.

Figure 2. Leaked folders, files, and images

This is not the first time the FSB was targeted by the Digital Revolution. According to the reports, an FSS (Federal Security Service) contractor SyTech was hacked. FSS had been working on an internet surveillance technology, and was hacked by a group named “0v1ru$”. Digital Revolution subsequently published SyTech’s leaked data on their sites in mid-2019.