NSA warns 'Sandworm' hackers targeting email servers

Leveraging a software vulnerability in Exim.

The US National Security Agency warned government partners and private companies about a Russian hacking operation that uses a special intrusion technique to target operating systems often used by industrial firms to manage computer infrastructure.

“This is a vulnerability that is being actively exploited, that’s why we’re bringing this notification out,” said Doug Cress, chief of the cybersecurity collaboration centre and directorate at NSA.

“We really want… the broader cybersecurity community to take this seriously.”

The notice is part of a series of public reports by the spy agency, which is responsible for both collecting foreign intelligence and protecting Defense Department systems at home, to share actionable cyber defense information.

Cress declined to discuss which business sectors had been most affected, how many organisations were compromised using the Russian technique, or whether the cyber espionage operation targeted a specific geographic region.

The NSA said the hacking activity was tied directly to a specific unit within Russia’s Main Intelligence Directorate, also known as the GRU, named the Main Center for Special Technologies.

The cybersecurity research community refers to this same hacking group as “Sandworm,” and has previously connected it to disruptive cyberattacks against Ukrainian electric production facilities.

Secretary of State Mike Pompeo also called out the same GRU unit in February for conducting a cyberattack against the country of Georgia.

A security alert published by the NSA on Thursday explains how hackers with GRU, Russia's military intelligence, are leveraging a software vulnerability in Exim, a mail transfer agent common on Unix-based operating systems, such as Linux.

The vulnerability was patched last year, but some users have not updated their systems to close the security gap.

“Being able to gain root access to a bridge point into a network gives you so much ability and capability to read email, to navigate across and maneuver through the network," said Cress, "so it’s more about the danger we’re trying to help people understand.”