With Friends Like These: China Spies on Russian IT Orgs

A Chinese state-aligned hacking group, APT31, has been spying on Russia's IT sector, utilizing commercial cloud services for command-and-control communications. This espionage campaign, which began in late 2022, involved targeted phishing emails and sophisticated malware to steal authentication data and other sensitive information. APT31's tactics included using backdoors tailored to different operating systems and leveraging platforms like Microsoft OneDrive and Yandex Cloud for data exfiltration.

The campaign appears to target not only IT companies but also government contractors, indicating a broader geopolitical interest. Experts highlight the challenges in preventing such abuses of legitimate cloud services.