The attackers tried to attack the Baltic Defense College in Estonia, the Austrian Chamber of Economics and the NATO e-learning platform JDAL. The Baltic Defense College was established by Estonia, Latvia and Lithuania. This educational institution provides military education and holds conferences for high-ranking officers from the founding countries, as well as NATO allies, the EU and other European countries, including Ukraine. The Austrian Chamber of Economics participates in the decision-making and administrative procedures of the Austrian Government. According to a report by Sekoia, a cybersecurity company, the nature of the attacks indicates the hackers’ interest in the defense sector of Eastern Europe and topics related to economic sanctions against the Russian Federation.
Turla (also known as Uroborus, Snake and Venomous Bear) is a Russian–speaking group engaged in cyber espionage. In the past, attackers have organized attacks on foreign ministries and organizations dealing with defense issues.
According to the researchers, in the latest espionage campaign, hackers did not use malware, but limited themselves exclusively to intelligence.
Recall that this spring, spyware from Turla was discovered by Lab52 specialists. The malware could record audio and track the victim’s location.