APT29 has struck again. According to U.S. news sources, the Russian hacker collective known as Cozy Bear, believed to be affiliated to the country’s foreign intelligence service, the SVR, has successfully hacked the U.S. State, Treasury, Homeland Security, and Commerce departments, as well as other government agencies. The hack is just the latest scalp for the group, which has been linked to the 2016 hack on the Democratic National Committee and attacks on the Norwegian government, COVID-19 vaccine outfits, and the cybersecurity firm FireEye. For the United States and allied governments, the conclusion must be that their countries need not just better cybersecurity but, crucially, more innovative ways of retaliating. And they should be even more concerned about another aspect of cyber-aggression: cyber-weapon proliferation.
The four federal departments were just the last entries in a long list of APT29’s victims this year. Others “have included government, consulting, technology, telecom, and oil and gas companies in North America, Europe, Asia and the Middle East,” the Washington Post reported. Adding insult to injury, in the case of FireEye, APT29 stole the firm’s red-team tools, the tools with which a company or government agency impersonates attackers so as to improve its defense. When highly sophisticated hackers attacked COVID-19 vaccine research organizations in the United States, the United Kingdom, and Canada earlier this year, the British government’s National Cyber Security Agency not only identified APT29 but also noted that the group is “almost certainly part of the Russian intelligence services.”
