Western Hackers Used Russia's Own Ransomware Against It In Cyberattack on Roscosmos: Report

Nearly a month after a cyberattack on Russia's space agency Roscosmos, it has been revealed that the hackers used Kremlin's own medicine against them. 

According to The Telegraph, hackers linked to Anonymous - Network Battalion 65 or NB65 - had revealed last month that they had stolen a bunch of files from the Roscosmos. They had stated that Russian President Vladimir Putin “no longer has control over spy satellites”. To prove that they had the files, the group even shared a tweet that claimed to be Russian space agency's server information. 

JUST IN: Hacking group 'NB65', affiliated with #Anonymous has shut down the Control Center of the Russian Space Agency 'Roscosmos'. #Russia has no more control over their own Spy-Satelites. #OpRussia#OpKremlin #FreeUkraine #FckPutin pic.twitter.com/1iZBDN48rw

— Anonymous TV ???????? (@YourAnonTV) March 1, 2022

Now, a month later, some of the files that were downloaded from the server and uploaded to the internet have been analysed. Citing Intezer Analyze, The Telegraph reported that one file's source code was made up of 66 per cent “of the same code as that of Conti”, which is a Russian cybercrime ransomware that caused havoc on IT systems across the globe. 

The group that invented ‘Conti' had used the ransomware to extort millions of dollars from the United States and Europe when their cyberattacks targeted hospitals and health services. The hackers using 'Conti' had even declared support for Russian leader Vladimir Putin and warned that it will retaliate if cyberattacks are launched against the Kremlin. 

However, now the Intezer Analyze looked into the source code from the NB65 hack on Roscosmos and revealed that the hackers used Conti's medicine against them. The Anonymous hackers were able to get the source code for the cyberattack after it was uploaded to VirusTotal, which helps detects malware and ransomware around the world. 

According to The Telegraph, William Thomas, a cybersecurity expert at Curated Intelligence - a research organisation, said, “We know NB65 have made a modified version of Conti thanks to the sample on VirusTotal.”

Meanwhile, it is imperative to note here that when the Western hackers had announced that they had broken into Roscosmos last month, the space agency had downplayed the attack. Roscosmos Director General Dmitry Rogozin had tweeted stating that nothing had happened. “The information of these scammers and petty swindlers is not true,” he had said, adding that “all our space activity control centres are operating normally.”

The information of these scammers and petty swindlers is not true. All our space activity control centers are operating normally. https://t.co/MY0qzlLqCI

— РОГОЗИН (@Rogozin) March 2, 2022

Further, the Russian official even went on to say that Kremlin would be treating any hacking of satellites as justification for war. But the notorious hacking group, Anonymous, continues to launch a series of cyberattacks in retaliation for Putin's invasion of Ukraine. On Tuesday, the group again insisted that it will continue hacking and releasing confidential information until Russia withdraws from its offensive.