Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure

This advisory details the GRU Unit 29155 cyber component’s operations since at least 2020, describing their use of publicly available scanning/exploitation tools, exploitation of CVEs, deployment of destructive malware (e.g., WhisperGate), lateral movement techniques (Impacket, psexec, secretsdump), anonymization/tunneling (VPNs, ProxyChains, GOST, DNS tunneling), and data exfiltration (Rclone, mega.nz), with observed impacts against NATO members, EU countries, and critical infrastructure sectors and appended IOCs and mitigation notes.