jsr / jsr is on Nostr

Chasing digital badness at the citizen lab. All words here are my own.

Last Notes

2025-06-20 13:40:33 UTC

🚨NEW REPORT from us: exposing a new social engineering/hacking tactic.
🇷🇺Russian state-backed hackers successfully compromised a prominent (& professionally paranoid) expert on Russian military operations.
Shocking, right? But the attack is solidly clever & worth understanding. I expect more like it.
https://blossom.primal.net/151037fad612bb0112412f07189b1ec3479e3ebd709221dd99af94e1b4123507.png
ATTACK FLOW
Keir Giles gets a message purporting to be from
U.S. State Dept asking for a consultation.
The attackers send the message from a gmail, but CC'd a bunch of email addresses state.gov email addresses. Including one from with same name as the purported sender.
https://blossom.primal.net/e9b747098271f185e66adda014e5d050f570a0120000d74724fd0f376eaa56ba.png
Strong credibility signal to have a bunch of gov ppl on the CC line right?
Well, what the attackers were counting on is that the State Dept mailserver just accepts all email addresses without emitting a bounce.
So they seem to have just created some fake State Dept staff names and addresses.
INTRODUCING THE DECEPTION
The attackers wait for the 2nd interaction to introduce the pivotal deception: getting him to 'connect to a secure platform.'
https://blossom.primal.net/da077358623aab8cc204741a4db027cf41d461254422fadec7872c2d0a94ed4f.png
In the next days they patiently walk him through what they want him to do, even sending a very official looking (but fake) State Dept. document.
https://blossom.primal.net/e4dcc76e9e00377d285dfd3392171aeb604f8be0dac94746db4e11459cee65b8.png
The attack works like this: the attackers try to deceive the target into creating and sharing an App-Specific Password (ASP) with them.
They do this by reframing ASPs as something that will let him access a secure resource (spoiler: not how this works)
REMINDER: WHAT IS AN ASP?
What's an ASP? Well, not every app that users want to use supports Multi-Factor Authentication.
Some older email clients for example don't. So providers like #Google let users create a special password just for those apps.
https://blossom.primal.net/ecc8d336f426eaa27ae4744e7f4cb4c2cac3edd0ec17d6da83bc77b4673aeac8.png
There were so many clever bits to this attack, it's easy to imagine a lot of people falling for it.
https://blossom.primal.net/8d0ed38e7478f802ad67adabc91a6e7f8d4e8453b1dd7c2328732864b5aa0815.png
Everything was clean. Doc looked real. The language was right. Email addresses at the State Dept. seemed to be CC'd.. I could go on.
They even had Keir enter "ms.state. gov" into the ASP name...
SLOW FOOD SOCIAL ENGINEERING
This attack was like slow food. 10 email exchanges over several weeks! Very much not your run-of-the-mill phishing.
It's like they know what we all expect from them...and then did the opposite.
Ultimately, he realized something was wrong and got in touch with us at #citizenlab ... but not before the attackers got access.
He's said that he expects some sort of 'leak' constructed out of a mixture of his real messages & carefully added falsehoods. I tend to agree, this is a pretty common tactic.
Here's what that looks like, btw, from a report we did back in 2017 where we compared what was released after a hack by Russian hackers vs the original:
https://blossom.primal.net/d78c6546306d909b92b1f2df20371c9eeff07b1bfe9081cff27cadf7dc14e1ab.png
Coda: Hilariously (to me at least) the attackers called the fake platform it *MS DoS*
https://blossom.primal.net/ccba459e840ce297664a2bda301d1438b3b8e51b585d169addcf8d21964c7fff.png
WHO DID IT?
Enter the Google Threat Intelligence Group w/analysis & attribution.
GTIG had been working on their own parallel investigation. Our friendly social engineers are: 🇷🇺 #UNC6293, a #Russian state-sponsored threat actor.
https://blossom.primal.net/515d82cd455084e58ae7dff4d35bd5d435912eb37851c400975a236e0ee498b0.png
Google adds bonus additional low confidence association to #APT29 (that would be Russia's #SVR).
Nice people.
TAKEAWAYS?
Takeaway: some gov-backed groups are feeling pressure & experimenting.
Moving from smash & grab phishing... to subtler, slower & perhaps less detectable.
Targeting App-Specific Passwords is novel.
But it's just part of a trend of state-backed attackers innovating & moving beyond simple phishing that targets credentials (maybe multi-factor codes) towards other mechanisms of account access.
https://blossom.primal.net/336640b188c251fa283158375999307dcca111d77eae861bd0a35f74543eed45.png
A lot of more sophisticated attackers are also spreading attacks across platforms.. for example starting the attack on Signal/Telegram, then later pivoting to email, etc. The folks at Volexity (above pic showing a similarly complex operation) have some good reporting on that (link below)
GET SAFER
Do you think you face increased risk because of who you are & what you do?
✅Use Google's free Advanced Protection Program.
Set it up now: https://landing.google.com/intl/en_in/advancedprotection/
https://blossom.primal.net/e5cf606d56a80fd5beff0b27169d03de332bb6653b95bcff6fe4335ec5630dac.png
✅Exercise extra skepticism when unsolicited interactions slide into suggesting you change account settings!
https://blossom.primal.net/56bd9a26f59aa26cfccb5d6aa4570a7b9cb0ad34b25f36fe692098baa3d80e19.png
✅Talk to your IT/ Security team about ASPs. Share the report, we've made some suggestions for them..
READ THE REPORTS
Ours at Citizen Lab: https://citizenlab.ca/2025/06/russian-government-linked-social-engineering-targets-app-specific-passwords/
Google's Post: https://cloud.google.com/blog/topics/threat-intelligence/creative-phishing-academics-critics-of-russia
Other citations:
Our Tainted Leaks report where we walk through how materials got manipulated & leaked after a Russian gov hack: https://citizenlab.ca/2017/05/tainted-leaks-disinformation-phish/
Volexity's recent report:
https://www.volexity.com/blog/2025/04/22/phishing-for-codes-russian-threat-actors-target-microsoft-365-oauth-workflows/