Cozy Bear Hackers Target Covid-19 Research Centres in UK, US and Canada

An advisory published by the UK National Cyber Security Centre (NCSC) warns of activity by Russian hacking group APT29 and explicitly calls out efforts to target the US, UK, and Canadian vaccine research, according to CNN.  Cyber actors from the Russian hacking group, which also goes by the name “the Dukes” or “Cozy Bear”, are targeting organisations involved in coronavirus vaccine development, according to the new warning issued today. APT29 uses a variety of tools and techniques, including spear-phishing and custom malware known as “WellMess” and “WellMail”, according to the NCSC, who have also assessed that the hacking group “almost certainly operate[s] as part of Russian Intelligence Services.”

Faiz Shuja, Co-Founder & CEO,  SIRP Labs
July 20, 2020
One way organisations look to ease the strain on their SOC is to introduce automation that can respond to these alerts through a range of playbooks.
Since the start of the COVID-19 pandemic, our systems have been capturing the changing patterns of security attacks experienced in the Security Operations Centres (SOCs) of our enterprise customers. The data points to a significant increase in state-sponsored APT attacks as nations look to take advantage of the perceived weaknesses of others, or to steal or destroy their COVID research from univer ....
[Read More >>]
Jake Moore, Cybersecurity Specialist,  ESET
July 17, 2020
They are quick to target vulnerabilities, wherever they may lie.
Criminal attackers revel in the weaknesses that humans offer. They are quick to target vulnerabilities, wherever they may lie. Such organisations conducting the research would not usually find themselves such a target, like financial institutions often are, but currently a coronavirus vaccine is more valuable. Research centers are the epicenter for the latest and most up-to-date information on a v ....
[Read More >>]

If you are an expert on this topic:

Submit Your Expert Comments

In this article