Dagbladet reveals: – Russian cyber weapons found in Norway
Shortly before Russia invaded Ukraine, warned the UK’s National Data Security Center (NCSC) and several major players in a new malware, Cyclops Blink – which is linked to the Russian intelligence service GRU.
The damage created a botnett, which is a network of infected computers that can be used for massive cyber attacks and the spread of large amounts of viruses and spam. Those who own the machines usually do not know that they are affected and can be controlled.
Dagbladet can now report that the National Security Authority’s (NSM) cyber center NorCERT has been notified of at least five Cyclops Blink-infected units in Norway since 23 February.
– NSM is familiar with the situation, and has made some moves nationally, they say to Dagbladet.
They will not comment on the matter further.
Norway will not help the foreign fighters
The FBI intervened
In recent weeks, the US Department of Justice and the Federal Bureau of Investigation (FBI) have been given the green light to intervene ashore and remove the damage from «thousands of units»in what is being described as an aggressive step to break down the botnet – before it was mobilized and put into use.
It is primarily network routers from WatchGuard and Asus that are affected, and which could have made it possible for the culprits to misuse computers nearby.
– WatchGuard has played an important role in eliminating the threat from Cyclops Blink, by quickly mapping infected devices and issuing guides to detect and remove the malware – to protect its partners and customers. We have also collaborated with the US Department of Justice in their action to break down the botnet, a spokesman for WatchGuard told Dagbladet.
Dagbladet has not been able to find out whether the FBI has intervened in units in Norway, but we have been in contact with suppliers of WatchGuard products in this country – which confirms that they have been contacted by the company in connection with the operation.
Dagbladet has also been in contact with the cyber security organization Shadowserver, which delivers large amounts of data and analysis for private and public IT security players in the world. They have registered 210 WatchGuard devices as can have been exposed in Norway.
Asus has not responded to Dagbladet’s inquiry.
DDoS attack
Cyclops Blink is linked to the Russian GRU, or rather their cyber actors Sandworm, also known as APT28 and Fancy Bears – which was the group that the Police Security Service (PST) pointed out to be behind the data breach in the Storting in 2020.
The group has previously been behind a number of other attacks on Western democracies, and is also believed to have tried to influence the US election in 2016.
The botnet that has now been uncovered had primarily infected units at smaller companies and businesses. Its intent, according to the US Department of Justice and the FBI, may have been to carry out massive DDoS attacks, which means flooding websites or other online resources with traffic, and putting services out of play.
Had the Russian botnet succeeded in its alleged plans, it could have caused major damage, the FBI states – and points to the NotPetya attack in 2017, which affected thousands of computers around the world and affected especially large multinational companies and critical infrastructure.
It is estimated that the attack caused damage of 10 billion dollars, almost 90 billion kroner.