CISA Alert AA24-249A: Russian GRU Unit 29155 Targeting U.S. and Global Critical Infrastructure

On 5 September 2024 a joint advisory from FBI/CISA/NSA and subsequent analysis attributed sustained offensive cyber operations to Russian GRU Unit 29155. The report details reconnaissance, initial access (exploited CVEs and default credentials), execution (PowerShell, reverse shells), persistence (web shells), credential theft (LSASS/SAM dumping), lateral movement (pass-the-hash), C2 techniques (multi-hop proxies, DNS tunneling, reverse TCP), and exfiltration (Rclone to cloud). It highlights destructive activity (WhisperGate) against critical infrastructure, provides example commands and IOCs, and maps behaviors to MITRE ATT&CK to inform defenses.