Th, 25.07.2024
●Estonian news
VKG hit by cyberespionage
Lennart Ruuda, reporter
30th March 2017, 15:27
Please note that the article is more than five years old and belongs to our archive. We do not update the content of the archives, so it may be necessary to consult newer sources.
:format(webp)/nginx/o/2014/11/28/3560811t1hfc1e.jpg)
Photo: Toomas Huik
Servers of one of Estonia's biggest oil shale companies Viru Keemia Grupp (VKG) hosted malware associated with Russian foreign military intelligence GRU.
Latest news
Estonian news
Businesses allowed to produce ammunition and munitions at Amari from 2025
Opinion
Mait Raava ⟩ The new finance minister still has one last chance to act in a statesmanlike manner
Opinion
ANDREY KUZICHKIN ⟩ Utility catastrophe in Russia calls into question the future of the Putin regime
Opinion
Helir-Valdor Seeder ⟩ New coalition agreement is a disappointment and confirms only one thing
Estonian news
Estonia's former chief of defense, joins Milrem Robotics
Estonian news
President appoints Estonia's new government to office
Suspicious traffic was monitored in the company's network last year that led to the discovery of Mimikatz software used to collect identity keys, like passwords and password hashes, in Windows systems. The inspection also came across backdoor software used to connect to a control server, a report by the State Information System Authority reveals.
„The existence of this malware allows an attacker to access information stored in the system and meddle in management of services, for example production facilities,“ said Deputy Director of RIA Toomas Vaks. He said that VKG is a company of considerable regional importance that offers a vital service. „RIA is tasked with the cybersecurity of vital services in Estonia, and we take these kinds of incidents very seriously,“ he said. „Cyberattacks against vital services, like the assault on Ukraine's power grid during Christmas of 2015, could endanger the property, health, and lives of hundreds of thousands of people,“ Vaks added.
„Luckily we have no information to suggest the incident at VKG directly jeopardized the functionality of a vital service; however, such a scenario cannot be ruled out in a situation where potential attackers have access to control systems.“ RIA said that both VKG's web traffic and pieces of malware found in computers suggest an orchestrated attack. The malware and control server used have been associated with cyberespionage group APT28, which cyberespionage circles believe could be linked to GRU.
Most read news
Opinion
Mait Raava ⟩ The new finance minister still has one last chance to act in a statesmanlike manner
Opinion
ANDREY KUZICHKIN ⟩ Utility catastrophe in Russia calls into question the future of the Putin regime
Opinion
Helir-Valdor Seeder ⟩ New coalition agreement is a disappointment and confirms only one thing
Estonian news
Estonia's former chief of defense, joins Milrem Robotics
Estonian news
Kallas to Macron: Estonia and France can help Ukraine achieve victory
Estonian news
President appoints Estonia's new government to office
„It is possible this particular software is also used by cybercriminals. However, RIA has no information regarding the persons and motives behind the attack, whereas providing such assessments isn't our task,“ Vaks said.
CEO of VKG Ahti Asmann said when commenting on the incident that the attack was in no way active and did not affect the company's work. „It is just a question of risks and their potential materialization. However, that is a comment you will have to get from the information system watchdog,“ Asmann said. He could not say why the company's servers could have been infected with the malware. „There is always something going on in our field, and new dangers crop up. We have identified these things by today and will move on with our work,“ he said.
Terms
●Ahti Asmann
●companies
●Venemaa sõjaväeluure (GRU)
●intelligence
●Viru Keemia Grupp
●vkg
Top
Today's editor
Marek Kuul
Contact
Hint: 507 3066,
vihje@postimees.ee
Paper subscription: 666 2525
Editor's secretary: 666 2202,
sekretar@postimees.ee
Advertising
Order advertising: veebireklaam@postimees.ee
Online ads: 666 2230
Print ads: 666 2445
Classifieds: 666 2171
Technical feedback:
tehnoloogia@postimeesgrupp.ee
Privacy Notice Privacy Policy Terms and conditions Contact People Advertising Subscriptions Announcements Newsletter
:format(webp)/nginx/o/2014/11/28/3560811t1hfc1e.jpg)