STRONTIUM

Strontium, also known as APT28, Fancy Bear, Forest Blizzard, and several other names, is a threat actor linked to Russia's General Staff Main Intelligence Directorate (GRU). Active since at least 2007, the group has targeted governments, militaries, and security organizations worldwide. Strontium's activities range from cyber espionage operations against European countries, which have been condemned by NATO and the European Union, to the exploitation of various vulnerabilities in widespread software systems. The group's tactics have evolved over time, demonstrating a sophisticated understanding of cyber warfare. In one instance, Microsoft attributed Strontium's brute-forcing of Office365 credentials over Tor. This indicates an advanced capability for credential harvesting, a common but effective technique in cyber-espionage. Moreover, Palo Alto Networks’ Unit 42 reported that the group exploited the CVE-2023-23397 vulnerability in attacks aimed at European NATO members, further showcasing their technical prowess and strategic targeting. Recently, Strontium has been observed utilizing the Moobot botnet, a tool often used for distributed denial-of-service (DDoS) attacks, data theft, and delivering malware. Additionally, the group has been linked to a previously unknown tool named GooseEgg, which was used to exploit the Windows Print Spooler flaw CVE-2022-38028. These activities highlight the ongoing threat posed by Strontium, necessitating constant vigilance and robust cybersecurity measures from potential target entities.