Russia-Linked Brute-Force Campaign Targets EU via Microsoft Infrastructure

A Heimdal investigation shows the EU is experiencing a surge of brute force cyber attacks on corporate and institutional networks, mostly originating from Russia.

These attackers exploit Microsoft infrastructure, particularly in Belgium and the Netherlands, to avoid detection.

Heimdal’s data reveals that the attacks date back to May 2024, but evidence suggests they may have been occurring for an even longer period.

This aligns with European leaders’ belief that Russia is waging a ‘shadow war’ to unsettle Europe. 

At the NATO summit in July, leaders claimed Russia was behind cyberattacks, disinformation, sabotage, and other disruptive actions.

Danish Prime Minister Mette Frederiksen stated, “Russia is trying to destabilize all of us, using various measures.” She urged that countries “take it more seriously.”

The investigation into the Russian brute-force campaign has revealed several critical insights:

• Attackers are aiming for High-Value Targets (HVTs)
• Key infrastructure cities like Edinburgh and Dublin have been frequently targeted
• Over half of the attack IP addresses are linked to Moscow, targeting major cities in the UK, Denmark, Hungary, and Lithuania
• The rest of the investigated attack IPs can be traced back to Amsterdam and Brussels
• Major ISPs like Telefonica LLC and IPX-FZCO were significantly abused

Heimdal’s data shows these attacks date back to May 2024 but may have been happening even longer.

Prevalent Infiltration and Attack Techniques

The attackers primarily target administrative accounts using various case combinations and language variants.

Over 60% of attack IPs are new, with approximately 65% recently compromised and the rest previously abused, revealing a constantly evolving threat.

The threat actors employ known attack principles such as SMBv1 crawlers, RDP crawlers, and RDP alternative port crawlers, exploiting weak or default credentials through password guessing, spraying, and stuffing.

Additionally, their use of legitimate Microsoft infrastructure broadens the attack surface and complicates detection and response.

Data shows that attackers have actively exploited Microsoft infrastructure from the Netherlands and Belgium to increase their attack range and success odds.

Russia Leveraging State-Owned Networks to Propagate Attack

Major ISPs like Telefonica LLC and IPX-FZCO are significantly abused, with the former accounting for 27.7% of attacks from Russia.

The attackers also leveraged resources from Russian allies, including Indian telecom companies Bharat Sanchar Nigam Limited and Bharti Airtel Limited, both of which have faced recent data breaches.

Scope of Brute-Force Campaign

Russia’s motivation behind these cyberattacks is multifaceted.

The reasons for these actions likely include aims to destabilize and disrupt critical infrastructure in Europe, extract sensitive data, gain financial advantage to fuel ongoing cyber-war efforts, or deploy malware.

The threat actors’ mandates can span multiple types of subversive cyber-warfare ops, including seek-and-destroy, disruption of critical assets, and sabotage.

A Wake Up Call for the European Union

This persistent threat underscores the need for cybersecurity measures within EU countries, including strengthening cloud security, enforcing multi-factor authentication, conducting regular security audits, and educating employees.

Morten Kjaersgaard, founder of Heimdal, said:

This data shows that an entity in Russia is waging a hybrid war on Europe, and may have even infiltrated it. The threat actors are aiming to extract as much data or financial means as possible, leveraging Microsoft infrastructure to do so.

Whoever is responsible, whether it’s the state or another nefarious group, they have no shame in using Russia’s allies to commit these crimes.

The exploitation of Indian infrastructure is a strong example. The data also proves these attackers have strong ties with China.

Paul Vixie, co-founder of SIE Europe, added:

The data that Heimdal has uncovered is explosively evil, and SIE Europe data clearly shows how well built these Russian Wasp nests are and they show no signs of stopping.

SIE Europe does not ever traffic in Personally Identifiable Information, and this case shows the investigative power of public information once cooperatively assembled.

Read the full investigation here: Russia-Linked Brute-Force Campaign Targets EU via Microsoft Infrastructure (heimdalsecurity.com).

About Heimdal

Established in Copenhagen in 2014, Heimdal empowers CISOs, security teams, and IT administrators to improve their security operations, reduce alert fatigue, and implement proactive measures through a unified command and control platform.

Heimdal®'s award-winning cybersecurity solutions span the entire IT estate, addressing challenges from endpoint to network levels, including vulnerability management, privileged access, Zero Trust implementation, and ransomware prevention.

For further press information:

Maria Madalina Popovici
Media Relations Manager

Email: mpo@heimdalsecurity.com