Pawn Storm

Pawn Storm, also known as APT28, Fancy Bear, Sofacy Group, Sednit, BlueDelta, and STRONTIUM, is a threat actor that has been active since at least 2007. The group is notorious for its complex operations that steal victims' credentials to enable surveillance or intrusion operations. It has targeted governments, militaries, and security organizations worldwide, employing various techniques such as shell scripts, SSH tunneling, credential phishing, and NTLMv2 hash relay attacks. The group's activities escalated in sophistication from April 2023, when it began using more elaborate methods in its attacks. Pawn Storm employed VPN services and established credential phishing websites using webhooks, with notable activity recorded in November and December of 2023. Additionally, the group exploited the EdgeRouter botnet, which dates back to 2016, for various purposes after likely brute-forcing the credentials of backdoored SSH servers. In January 2024, the US FBI disrupted the EdgeRouter botnet used by Pawn Storm. During the subsequent investigation into a Linux botnet targeted in this takedown, researchers discovered another Linux botnet running on some of the same EdgeRouters previously exploited by Pawn Storm. These compromised routers could be easily abused by Pawn Storm or any other threat actor due to poor protection by the criminal botnet operator. This information underscores the persistent and evolving threat posed by Pawn Storm and emphasizes the importance of robust cybersecurity measures.