FireEye speculates that behind the hack of France’s TV5Monde television channel there is the popular APT28 that used the pseudonymous ISIS Cyber Caliphate.

Security experts involved in the investigation on the hack of France’s TV5Monde television channel revealed that behind the pseudonym of ISIS “Cyber Caliphate” there were Russian hackers.

“Russian hackers posing as the ISIS “Cyber Caliphate” were likely behind the hack of France’s TV5Monde television channel, according to cybersecurity experts who have examined the attack.” states Sheera Frenkel from Buzzfeed that first disclosed the news.

The hackers belonging to the Cyber Caliphate group shut down transmissions on the TV5Monde network on April 8 and spread pro-ISIS propaganda messages through the social media accounts (Facebook and Twitter) of the French Channel.

According to security experts at FireEye, the Russian ATP28 (also known as Pawn Storm, Tsar Team, Fancy Bear and Sednit) may have used the name of ISIS as a diversionary strategy, the experts noticed a number of similarities in the TTPs used by the Russian group and the one who breached the network at TV5Monde.

“There are a number of data points here in common,” said Jen Weedon, manager of threat intelligence at FireEye. “The ‘Cyber Caliphate website,’ where they posted the data on the TV5Monde hack was hosted on an IP block which is the same IP block as other known APT28 infrastructure, and used the same server and registrar that APT28 used in the past.”

Weedon confirmed that at the time of the TV5Monde attack, other journalists were targeted by the APT28 group and the attacks were coordinated by the same hacking infrastructure used by the team.

Experts at FireEye published a detailed report on ATP28 in October 2014, speculating that the group is composed by state-sponsored hackers that are managing a long-running cyber espionage campaign on US defense contractors, European security organizations and Eastern European government entities.

The hackers also targeted the attendees of European defense exhibitions, including the EuroNaval 2014, EUROSATORY 2014, and the Counter Terror Expo and the Farnborough Airshow 2014.

The majority of the files analyzed by FireEye were set to Russian-language settings, the experts confirmed “that a significant portion of APT28 malware was compiled in a Russian-language build environment consistently over the course of six years.”

As usually happens in these cases, in order to profile the attacker the researchers analyzed compile times and discovered that they were aligned with working hours in Moscow and St. Petersburg, another element that suggests the involvement of a Russia-based team. Nearly 96 percent of the malware was compiled between a Monday and Friday during an 8 AM to 6 PM workday in the Moscow time zone.

“Russia has a long history of using information operations to sow disinformation and discord, and to confuse the situation in a way that could benefit them,” added Weedon. “In this case, it’s possible that the ISIS cyber caliphate could be a distraction. This could be a touch run to see if they could pull off a coordinated attack on a media outlet that resulted in stopping broadcasts, and stopping news dissemination.”

The Cyber Caliphate is also responsible for another cyber attack against a major target, in January, the group took credit for an attack that took over the social media accounts of the U.S. Central Command. The hackers posted several messages on the hacked account, including images of documents, which were allegedly stolen from hijacked mobile devices of the military personnel.

Misinformation campaigns have been already in the past by Russian State-sponsored hackers that are also specialized in PSYOPS operations. Recently the New York Times revealed the existence of a secret organization known as the Internet Research Agency, which was involved in such kind of activities.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – APT28, Cyber Caliphate)