U.S. Defense Contractors Targeted with Phishing Attacks
A group of U.S. defense contractors have been targeted by a hacking group known as Fancy Bear, which is believed to be a cyber espionage group associated with the Russian military intelligence agency GRU. These defense contractors are both small and large and the individuals targeted work on classified programs for militarized drones, missiles, rockets, stealth fighter jets, cloud computing activities and other sensitive activities, according to the AP.
The 87 individuals that were targeted at these various organizations were sent email phishing attacks and nearly 40% of them clicked on the phishing links. This instantly put them and their organization at risk. The attacks primarily targeted the individual’s personal Gmail but some of these attacks were sent to corporate email accounts.
What is also interesting is the largest group of individuals targeted are people that worked on drones. It’s no secret that Russia is behind the U.S. when it comes to drone technology and they are racing to make better drones. They also targeted people working on space programs, cloud computing initiatives and more. All areas Russia is trying to get a leg up on the U.S. The specific defense contractors and individuals they targeted suggests that the Russians have noticed the advancements in technology that these contractors have been making.
What does this mean for defense contractors?
This isn’t the first targeted attack against U.S. government contractors and it certainly won’t be the last. Many believe the United States has the best offensive cyber capabilities however we could be in a “cyber arms race” for the next 60+ years.
“Every defense company is constantly under attack. If anybody tells you they’re not, it just means they don’t know,” said Northrop Grumman Chief Executive Wes Bush. “It is a threat that is broad-based. It’s not just from one source … and it’s just unceasing.”
While many of these defense contractors have likely put secure IT systems in place, they should seriously consider (if they haven’t already done so) beefing up their email security, specifically as it pertains to social engineering attacks. With 91% of cybersecurity attacks coming by way of a phishing email, the weakest link in their defense, their employees, can make the organization incredibly vulnerable. Implementing email security best practices and even employee training can help but adding additional layers of security is imperative to protect their employees and organization.
Graphus works for G Suite and Office 365 users and provides that additional layer of protection needed to detect, alert, and mitigate phishing attacks, spoofing, email scams, ransomware, and malicious threats. It does this in a simple, powerful and automated way making it a valuable solution for organizations of all sizes.
