Ransomware

Russian GRU Targeting Western Logistics Entities and Technology Companies

Fonte ufficiale

Sintesi operativa EudorIA

Cosa significa

Priorità 90/100

CISA Cybersecurity Advisories ha pubblicato un advisory sul ransomware Russian GRU Targeting Western Logistics Entities and Technology Companies. Le misure indicate vanno confrontate con esposizione, identita, segmentazione e capacita di ripristino.

Perché conta

L'advisory descrive attivita ransomware osservate e misure difensive pubblicate da un'autorita. Non prova che il proprio perimetro sia compromesso, ma richiede una verifica prioritaria di esposizione e controlli.

Azioni consigliate

Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.
Verificare sistemi esposti, accessi remoti e versioni rispetto all'advisory ufficiale.
Confermare che backup offline e immutabili siano separati e ripristinabili.
Correlare TTP e IOC pubblicati con la telemetria autorizzata del proprio perimetro.

Benefici operativi potenziali

Prioritizzazione delle esposizioni Internet e delle vulnerabilita sfruttate
Verifica dei controlli su accessi remoti, movimento laterale ed esfiltrazione
Validazione documentata della capacita di ripristino

Indicazioni da confermare sul perimetro tecnico e organizzativo del cliente.

Controlli pertinentiVulnerability managementIdentity and access managementNetwork segmentationBackup and recoveryDetection and response

DestinatariITSOCCISOManagement

Centro informazioni

Traduzione in elaborazione

CISA

Il contenuto ufficiale è disponibile nella lingua originale. La versione italiana verrà pubblicata al termine dei controlli automatici.

Testo acquisito dalla fonte

Cybersecurity Advisory Russian GRU Targeting Western Logistics Entities and Technology Companies Last Revised April 17, 2026 Alert Code AA25-141A CISA Product Feedback Survey Related topics: Cybersecurity Best Practices , Critical Infrastructure Security and Resilience Executive Summary This joint cybersecurity advisory (CSA) highlights a Russian state-sponsored cyber campaign targeting Western logistics entities and technology companies. This includes those involved in the coordination, transport, and delivery of foreign assistance to Ukraine. Since 2022, Western logistics entities and IT companies have faced an elevated risk of targeting by the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (85th GTsSS), military unit 26165—tracked in the cybersecurity community under several names (see “ Cybersecurity Industry Tracking ”). The actors’ cyber espionage-oriented campaign, targeting technology companies and logistics entities, uses a mix of previously disclosed tactics, techniques, and procedures (TTPs). The authoring agencies expect similar targeting and TTP use to continue. Executives and network defenders at logistics entities and technology companies should recognize the elevated threat of unit 26165 targeting, increase monitoring and threat hunting for known TTPs and indicators of compromise (IOCs), and posture network defenses with a presumption of targeting. This cyber espionage-oriented campaign targeting logistics entities and technology companies uses a mix of previously disclosed TTPs and is likely connected to these actors’ wide scale targeting of IP cameras in Ukraine and bordering NATO nations. The following authors and co-sealers are releasing this CSA: United States National Security Agency (NSA) United States F

Indicatori CISA verificabili

78 valori IOC dalla fonte ufficiale. Non sono una lista di blocco automatica: verificare data, contesto e applicabilita.

Ultima verifica: 2026-09-26T13:31:59.385064+00:00

Scarica STIX 2.1

Tipo	Indicatore (non cliccabile)	File
ipv4-addr	`91[.]149[.]253[.]20`
ipv4-addr	`70[.]34[.]254[.]245`
ipv4-addr	`91[.]149[.]253[.]198`
ipv4-addr	`70[.]34[.]253[.]247`
ipv4-addr	`213[.]134[.]184[.]167`
ipv4-addr	`91[.]149[.]253[.]118`
ipv4-addr	`70[.]34[.]253[.]13`
ipv4-addr	`212[.]127[.]78[.]170`
ipv4-addr	`91[.]149[.]223[.]130`
ipv4-addr	`70[.]34[.]252[.]222`
ipv4-addr	`194[.]187[.]180[.]20`
ipv4-addr	`91[.]149[.]219[.]23`
ipv4-addr	`70[.]34[.]252[.]186`
ipv4-addr	`192[.]162[.]174[.]67`
ipv4-addr	`91[.]149[.]219[.]158`
ipv4-addr	`70[.]34[.]252[.]168`
ipv4-addr	`185[.]234[.]235[.]69`
ipv4-addr	`91[.]149[.]203[.]73`
ipv4-addr	`70[.]34[.]245[.]215`
ipv4-addr	`178[.]37[.]97[.]243`
ipv4-addr	`91[.]149[.]202[.]215`
ipv4-addr	`70[.]34[.]244[.]100`
ipv4-addr	`178[.]235[.]191[.]182`
ipv4-addr	`90[.]156[.]4[.]204`
ipv4-addr	`70[.]34[.]243[.]226`
ipv4-addr	`147[.]135[.]209[.]245`
ipv4-addr	`89[.]64[.]70[.]69`
ipv4-addr	`70[.]34[.]242[.]220`
ipv4-addr	`138[.]199[.]59[.]43`
ipv4-addr	`83[.]29[.]138[.]115`
ipv4-addr	`64[.]176[.]71[.]201`
ipv4-addr	`95[.]215[.]76[.]209`
ipv4-addr	`83[.]23[.]130[.]49`
ipv4-addr	`64[.]176[.]70[.]238`
ipv4-addr	`93[.]105[.]185[.]139`
ipv4-addr	`83[.]168[.]78[.]55`
ipv4-addr	`64[.]176[.]70[.]18`
ipv4-addr	`91[.]221[.]88[.]76`
ipv4-addr	`83[.]168[.]78[.]31`
ipv4-addr	`64[.]176[.]69[.]196`
ipv4-addr	`91[.]149[.]255[.]195`
ipv4-addr	`83[.]168[.]78[.]27`
ipv4-addr	`64[.]176[.]67[.]117`
ipv4-addr	`91[.]149[.]255[.]19`
ipv4-addr	`83[.]168[.]66[.]145`
ipv4-addr	`46[.]248[.]185[.]236`
ipv4-addr	`109[.]95[.]151[.]207`
ipv4-addr	`91[.]149[.]255[.]122`
ipv4-addr	`83[.]10[.]46[.]174`
ipv4-addr	`46[.]112[.]70[.]252`
ipv4-addr	`209[.]14[.]71[.]127`
ipv4-addr	`91[.]149[.]254[.]75`
ipv4-addr	`79[.]185[.]5[.]142`
ipv4-addr	`31[.]42[.]4[.]138`
ipv4-addr	`162[.]210[.]194[.]2`
ipv4-addr	`103[.]97[.]203[.]29`
ipv4-addr	`91[.]149[.]253[.]204`
ipv4-addr	`79[.]184[.]25[.]198`
ipv4-addr	`31[.]135[.]199[.]145`
ipv4-addr	`192[.]162[.]174[.]94`
email-addr	`maint[@]goldenloaduae[.]com`
email-addr	`jayam[@]wizzsolutions[.]com`
email-addr	`commerical[@]vanadrink[.]com`
email-addr	`tv[@]coastalareabank[.]com`
ipv4-addr	`124[.]168[.]91[.]178`
ipv4-addr	`159[.]196[.]128[.]120`
ipv4-addr	`194[.]126[.]178[.]8`
email-addr	`sarah[@]cosmicgold469[.]co[.]za`
email-addr	`ashoke[.]kumar[@]hbclife[.]in`
email-addr	`m[.]salim[@]tsc-me[.]com`
email-addr	`mdelafuente[@]ukwwfze[.]com`
email-addr	`md-shoeb[@]alfathdoor[.]com[.]sa`
email-addr	`franch1[.]lanka[@]bplanka[.]com`
email-addr	`karina[@]bhpcapital[.]com`
email-addr	`vikram[.]anand[@]4ginfosource[.]com`
email-addr	`accounts[@]regencyservice[.]in`
ipv4-addr	`207[.]244[.]71[.]84`
ipv4-addr	`213[.]32[.]252[.]221`

Provenienza

Allegato ufficiale CISA · 2026-04-17T18:27:37Z

SHA-512: a3b6fb5f09046d2f913072e362a898c48ef76b49c1dbb7a14c40819d8d74712f26a4b4943d1fa3e92385906d737fbd9aaecff75459373857eba97ac11d1f7a80

Fonte: CISA Cybersecurity Advisories
Entità pubblicatrice: CISA
Tipo entità: Autorità nazionale
Area: North America · US
Lingua originale: en · traduzione in preparazione
Pubblicazione: 17/04/2026 14:00
Condivisione: TLP:CLEAR
MITRE ATT&CK: T1003.003, T1021.001, T1029, T1048, T1053.005, T1056, T1059, T1059.001, T1059.003, T1059.005, T1059.006, T1070.001, T1087.002, T1090.002, T1090.003, T1098.002, T1104, T1110, T1110.001, T1110.003, T1111, T1114, T1114.002, T1119, T1125, T1133, T1187, T1190, T1199, T1204.001, T1204.002, T1547.001, T1547.009, T1552.006, T1556.006, T1560, T1560.001, T1566, T1566.001, T1566.002, T1566.004, T1573, T1574.001, T1586.002, T1586.003, T1589.002, T1591, T1591.002, T1591.004, T1592, T1627, T1627.001, T1659, T1665
CVE: CVE-2023-23397, CVE-2020-12641, CVE-2020-35730, CVE-2021-44026, CVE-2023-38831
Classificazione: Critica
Paese indicato: US

Perimetro tecnico

Prodotti e versioni interessati

Verifica in corso

Informazione non ancora acquisita.

Il collector verificherà NVD e gli advisory vendor ufficiali disponibili.

Azione indicata dalla fonte

Verificare e correggere con priorita i sistemi Internet-facing indicati dalla fonte; applicare MFA resistente al phishing, segmentazione e backup offline immutabili con prove di ripristino.

Riferimenti tecnici ufficiali

Apri la fonte originale