Russia-Linked Hackers Attacking Governmental And Political Organizations

Two pro-Russian threat actors launched a distributed denial-of-service (DDoS) attack campaign against Japanese organizations on October 14, 2024.

The campaign targeted logistics, manufacturing, government, and political entities. 

An attack leveraged various non-spoofed direct-path DDoS attack vectors, including well-known nuisance networks, cloud providers, and VPN networks, where the campaign using the DDoSia botnet is ongoing and continues to target new Japanese organizations.

The Russian Ministry of Foreign Affairs expressed concern over Japan’s increasing militarization on October 11, 2024.

In response, pro-Russian threat actors NoName057(16) and the Russian Cyber Army Team launched coordinated DDoS attacks against Japanese targets on October 14-16. 

Join ANY.RUN's FREE webinar on How to Improve Threat Investigations on Oct 23 - Register Here 

The delay in the attacks was due to NoName057(16)’s previous focus on disrupting the Belgian elections, highlighting the coordination between these two threat actors, as seen in past attacks.

The NoName057(16) group primarily focused its cyberattacks on the logistics and manufacturing sector, particularly targeting harbors and shipbuilding facilities, which aligns with its usual tactics. 

They also launched many attacks against government, political, and social organizations, including the political party of Japan’s newly elected prime minister, which aimed to generate substantial publicity by targeting high-profile entities.

NoName057(16) has launched a sophisticated DDoS attack campaign against Japanese targets.

It uses the DDoSia botnet to execute direct-path attacks, employing various attack vectors, including TCP packet flooding (primarily SYN floods) and HTTP-based attacks to maximize impact. 

Multiple attack waves, each utilizing different configurations, have been directed at approximately 40 Japanese domains.

C2 server updates have been observed during typical Russian working hours, suggesting their involvement in the campaign.

NETSCOUT has observed a significant increase in DDoS attacks targeting Japanese networks, with approximately 2,000 attacks occurring daily.

While these attacks are impactful, they do not significantly alter the region’s threat landscape. 

As attack sources, the attackers utilize nuisance networks, cloud providers, and virtual private networks (VPNs), as well as common attack vectors, such as direct-path attack vectors. 

It has been identified that coordinated attacks by Russia-aligned threat actors NoName057(16) and the Russian Cyber Army Team target Japanese logistics, manufacturing, and government entities. 

These attacks, primarily DDoS, did not significantly change the overall threat landscape, but the ongoing threat of DDoS attacks highlights the importance of effective detection and mitigation strategies. 

How to Choose an ultimate Managed SIEM solution for Your Security Team -> Download Free Guide (PDF)