GRU Unit 29155 targets NATO critical infrastructure with WhisperGate
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Russian military cyber actors conduct espionage, sabotage and reputational attacks against US and global critical infrastructure since 2020.
The FBI, CISA, and NSA assess that cyber actors affiliated with the Russian General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center, Unit 29155, are responsible for computer network operations against global targets including NATO members, EU countries, and Central Asian nations. Unit 29155 operates distinct from other known GRU groups (Unit 26165 and Unit 74455) and conducts campaigns for espionage, sabotage, and reputational harm. The group deployed the destructive WhisperGate malware against Ukrainian organizations beginning January 2022, and has expanded operations to target critical infrastructure sectors including government services, financial services, transportation, energy, and healthcare.
Unit 29155 cyber actors employ a blend of publicly available tools and custom malware. Their operational approach involves reconnaissance using Shodan, Acunetix, Nmap, and other scanners to identify vulnerabilities in internet-facing systems, followed by exploitation of known CVEs in Dahua cameras, Atlassian Confluence, Sophos firewalls and other products. Post-compromise, they conduct lateral movement using Impacket, CrackMapExec, BloodHound, and credential dumping techniques, establishing command and control over VPSs and using tunneling tools like GOST, DNS tunneling (dnscat/2, Iodine), and ProxyChains. Data exfiltration leverages Rclone to cloud storage services and mail server compromise with PowerShell for PST extraction.
Defenders should prioritize patching the CVEs exploited by this group, implement network segmentation and phishing-resistant MFA for all externally facing services, disable unnecessary protocols and services, conduct continuous monitoring with SIEM/EDR solutions, and monitor for the specific tool indicators and lateral movement techniques detailed in this advisory.
Mentioned in this report
Detection guidance
Rclone Execution With Copy or Sync Operation
Detects rclone (including renamed binaries via OriginalFileName) running copy/sync/move operations, the cloud-storage exfiltration method attributed to Unit 29155. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Rclone Execution With Copy or Sync Operation
description: Detects rclone.exe, or a renamed copy identified by its OriginalFileName,
running copy/sync/move sub-commands to push data to cloud storage. Generalises on
the tool and its transfer verbs, not on remote names or paths.
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
category: process_creation
product: windows
detection:
selection_tool:
- Image|endswith: \rclone.exe
- OriginalFileName: rclone.exe
selection_verb:
CommandLine|contains:
- ' copy '
- ' sync '
- ' move '
- ' copyto '
condition: selection_tool and selection_verb
falsepositives:
- Administrators using rclone for approved backup or migration jobs to cloud storage
- Developers syncing build artefacts with rclone on workstations
level: high
id: 2477d6e5-52e3-5e62-b105-cc90e991ec81
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a
PowerShell Exchange Mailbox Export to PST
Detects PowerShell invoking New-MailboxExportRequest with a .pst target, the mail-server PST extraction pattern described for Unit 29155. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PowerShell Exchange Mailbox Export to PST
description: Detects PowerShell command lines that use New-MailboxExportRequest to
write a mailbox to a PST file, a technique used for bulk email collection after
mail server compromise. Generalises on the cmdlet and the .pst output rather than
on mailbox names or paths.
tags:
- attack.collection
- attack.t1114
- attack.execution
- attack.t1059.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- \powershell.exe
- \pwsh.exe
selection_cmd:
CommandLine|contains|all:
- New-MailboxExportRequest
- .pst
condition: selection_img and selection_cmd
falsepositives:
- Exchange administrators performing approved mailbox exports for legal hold or migration
level: medium
id: b1c18ce9-302a-50b3-bcc6-93e685c34ea3
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a
4 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs