{"id":616,"date":"2019-10-31T15:34:31","date_gmt":"2019-10-31T14:34:31","guid":{"rendered":"https:\/\/lab52.es\/blog\/?p=616"},"modified":"2019-10-31T16:29:42","modified_gmt":"2019-10-31T15:29:42","slug":"the-geopolitical-and-potential-cyber-influence-of-russia-in-africa","status":"publish","type":"post","link":"https:\/\/lab52.io\/blog\/the-geopolitical-and-potential-cyber-influence-of-russia-in-africa\/","title":{"rendered":"The geopolitical and potential cyber influence of Russia in Africa"},"content":{"rendered":"\n<p>In this report there is an analysis about the\ncurrent geopolitical relationship between Russia and Africa. Furthermore, it\nshows several malicious campaigns presumably attributed to Russia with diplomatic,\nenergetic and defense targets.<\/p>\n\n\n\n<p><strong>Geopolitical\nRussian influence over Africa:<\/strong><\/p>\n\n\n\n<p>Africa has been an historical geostrategic\ntarget for most relevant countries with a significant power in the order of the\nworld. Recently, China has become one of the most popular actors which are\ninfluencing geopolitically in Africa. However, there is another relevant actor\nwhich step by step is having more influence in Africa, Russia. &nbsp;In olden times, when the USSR was quite active,\nits geostrategic strategy was in Africa. Most of the governments of these\ncountries, after obtaining their independence, they received diplomatic or\nmilitary support from the USSR: Uganda, Guinea-Bissau, Mozambique, Angola, Egypt,\nSomalia, Ethiopia, Benin, and Democratic Republic of Congo ([1]). &nbsp;<\/p>\n\n\n\n<p>Since President Vladimir Putin was appointed\nPresident of Russia, the diplomatic, military and economic interactions with\nAfrican countries have grown by approximately 185%. Russia has different kinds\nof interests, one of the most important is the energy resources in Africa\nincluding oil, gas and nuclear resources ([2]). <\/p>\n\n\n\n<p>Furthermore, Russia has an important influence\nin Africa through its softpower and hardpower as well. The strategy of Russia\nin Africa since 31<sup>st<\/sup> of December 2015 is to develop the trading,\neconomic and military cooperation in each country that Russia has interests in.\n([4])<\/p>\n\n\n\n<p>The most influenced locations in Africa by Kremlin are shown below, divided per fields ([3]):<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/lab52.es\/blog\/wp-content\/uploads\/2019\/10\/image.png\" alt=\"\" class=\"wp-image-617\" width=\"448\" height=\"423\" srcset=\"https:\/\/lab52.io\/blog\/wp-content\/uploads\/2019\/10\/image.png 392w, https:\/\/lab52.io\/blog\/wp-content\/uploads\/2019\/10\/image-300x283.png 300w\" sizes=\"(max-width: 448px) 100vw, 448px\" \/><figcaption><em> Illustration 1. Geopolitical Russian influence in Africa (Source: Bloomberg 2019) <\/em><br><br><\/figcaption><\/figure><\/div>\n\n\n\n<p>There are three main Russian geostrategic plans in Africa:<\/p>\n\n\n\n<p><strong>Diplomatic: <\/strong><\/p>\n\n\n\n<p>For Russia it is highly important to get an extensive diplomatic influence over Africa, as in the voting process in the General Assembly of the United Nations to approve or reject international questions. It is important to consider that 54 African countries represent 1\/3 of the full representation in the United Nations ([4]). Russia would put under pressure several African countries in these international approbations in the United Nations. <\/p>\n\n\n\n<p>In the last 5 years, the Trump\nAdministration reduced its diplomatic presence in Africa and Russia has taken\nadvantage of the new geopolitical situation developing new diplomatic\nrelationships.<\/p>\n\n\n\n<p>The following chart shows the diplomatic activity between Russia and several African countries ([5]):<\/p>\n\n\n\n<table class=\"wp-block-table\"><tbody><tr><td><strong>Country<\/strong><\/td><td><strong>President<\/strong><\/td><td><strong>Date<\/strong><\/td><\/tr><tr><td>South Africa<\/td><td>J. Zuma<\/td><td>2015<\/td><\/tr><tr><td>Zimbawe<\/td><td>R. Mugabe<\/td><td>2015<\/td><\/tr><tr><td>Sudan<\/td><td>O. Al Bashir<\/td><td>2015-2017-2018<\/td><\/tr><tr><td>Guinea<\/td><td>A. Cond\u00e9<\/td><td>2016-2017<\/td><\/tr><tr><td>African Republic<\/td><td>F. Archange<\/td><td>2018<\/td><\/tr><tr><td>Rwanda<\/td><td>P. Kagame<\/td><td>2018<\/td><\/tr><tr><td>Gabon<\/td><td>B. Ondimba<\/td><td>2018<\/td><\/tr><tr><td>Senegal<\/td><td>M. sall<\/td><td>2018<\/td><\/tr><tr><td>Zimbawe<\/td><td>E. Mnangagwa<\/td><td>2019<\/td><\/tr><tr><td>Angola<\/td><td>J. Louren\u00e7o<\/td><td>2018-2019<\/td><\/tr><tr><td>Congo<\/td><td>S. Nguesso<\/td><td>2019<\/td><\/tr><tr><td>Mozambique<\/td><td>F. Nyusi<\/td><td>2019<\/td><\/tr><\/tbody><\/table>\n\n\n\n<p><strong>Energetic:<\/strong><\/p>\n\n\n\n<p>Moreover, Russia has achieved energy and mineral trading agreements with several African governments. Also, their energy agreements will be followed by military forces to ensure their secure and proper energy exploitation process. The main Russian industries tend to apply a dominance in the African market. <\/p>\n\n\n\n<p>Rosneft, the most relevant Russian energy organization is spreading its influence around Africa. In 2018, this organization got 21 licenses to operate in Equatorial Guinea, Libya, Mozambique, Nigeria, South of Sudan and Uganda ([7]). However, as the Rosneft annual report shows, the only official project of Rosneft is located in Mozambique.&nbsp;&nbsp;&nbsp;&nbsp; <\/p>\n\n\n\n<p>Rosatom is another important energy (nuclear)\norganization from Russia. This organization has already signed memorandums with\n14 African countries, looking to cooperate in several fields like medicine,\nagriculture, and hydroelectricity. As an example, in South Africa, Rosatom got\nan agreement to build power reactors for $ 76 billion ([7]). This agreement between the\norganization and the government provoked an important confrontation with\nactivists and opponents. Furthermore, Rosatom offers grants to African students\nto study in Russia, trying to build up a soft power influence in the African\ncontinent.&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;<\/p>\n\n\n\n<p>The energy organization Lukoil has\nseveral important projects in Nigeria, Cameroon and Ghana ([8]). Gazprom, one of the most powerful energy\norganizations in Russia has relevant energy projects in Senegal, Mozambique,\nTanzania and Nigeria ([9]). <\/p>\n\n\n\n<p>The energy exploitation strategy of Russia makes an important geopolitical influence on each country with its presence, as it guarantees more development in multiple fields. <\/p>\n\n\n\n<p><strong>Militarist: <\/strong><\/p>\n\n\n\n<p>Russia developed several defense agreements with African countries to have military bases around Africa. Once they are based in this locations, Russia could execute a geostrategic surveillance to some important maritime routes and energy resource areas to keep their interests saved. Moreover, being a country\u2019s main supplier of weapons &nbsp;grants an important geopolitical influence in the area. The following chart shows the millions spent by each country on Russian weapons. &nbsp;&nbsp;<\/p>\n\n\n\n<table class=\"wp-block-table\"><tbody><tr><td>\n  &nbsp;\n  <\/td><td>\n  2014\n  <\/td><td>\n  2015\n  <\/td><td>\n  2016\n  <\/td><td>\n  2017\n  <\/td><td>\n  2018\n  <\/td><td>\n  2009-2018\n  <\/td><td>   2009-2013   <\/td><td>\n  2014-2018\n  <\/td><\/tr><tr><td>\n  Angola\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  27\n  <\/td><td>   98   <\/td><td>\n  63\n  <\/td><td>\n  63\n  <\/td><td>251   <\/td><td>\n  00\n  <\/td><td>\n  251\n  <\/td><\/tr><tr><td>\n  Burkina Faso\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>14   <\/td><td>15   <\/td><td>\n  1\n  <\/td><td>\n  14\n  <\/td><\/tr><tr><td>\n  Camer\u00fan\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  27\n  <\/td><td>  11   <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>45   <\/td><td>\n  77\n  <\/td><td>\n  38\n  <\/td><\/tr><tr><td>\n  Chad\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>77   <\/td><td>\n  77\n  <\/td><td>\n  00\n  <\/td><\/tr><tr><td>\n  RDC\n  <\/td><td>77   <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>14   <\/td><td>\n  77\n  <\/td><td>\n  77\n  <\/td><\/tr><tr><td>\n  G. Ecuatorial\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>77   <\/td><td>77   <\/td><td>\n  00\n  <\/td><td>\n  77\n  <\/td><\/tr><tr><td>\n  Etiop\u00eda\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>54   <\/td><td>\n  54\n  <\/td><td>\n  00\n  <\/td><\/tr><tr><td>\n  Ghana\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>41   <\/td><td>\n  41\n  <\/td><td>\n  00\n  <\/td><\/tr><tr><td>\n  Guinea\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>1   <\/td><td>\n  1\n  <\/td><td>\n  00\n  <\/td><\/tr><tr><td>\n  Kenia\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>20   <\/td><td>\n  20\n  <\/td><td>\n  00\n  <\/td><\/tr><tr><td>\n  Mali\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  23\n  <\/td><td>\n  &nbsp;\n  <\/td><td>23   <\/td><td>\n  00\n  <\/td><td>\n  23\n  <\/td><\/tr><tr><td>\n  Nigeria\n  <\/td><td>58   <\/td><td>\n  87\n  <\/td><td>\n  &nbsp;\n  <\/td><td>  24   <\/td><td> 24   <\/td><td>192   <\/td><td>\n  00\n  <\/td><td>\n  192\n  <\/td><\/tr><tr><td>\n  Ruanda\n  <\/td><td>14   <\/td><td>\n  27\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;&nbsp; \n  <\/td><td>41   <\/td><td>\n  00\n  <\/td><td>\n  41\n  <\/td><\/tr><tr><td>\n  Sud\u00e1frica\n  <\/td><td>50   <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>50   <\/td><td>\n  00\n  <\/td><td>\n  50\n  <\/td><\/tr><tr><td>\n  Sud\u00e1n del Sur\n  <\/td><td>\n  &nbsp;\n  <\/td><td> 18    <\/td><td> 44   <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>82   <\/td><td>\n  60\n  <\/td><td>\n  22\n  <\/td><\/tr><tr><td>\n  Sud\u00e1n\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  51\n  <\/td><td>  51   <\/td><td>24   <\/td><td>\n  &nbsp;\n  <\/td><td>349   <\/td><td>\n  224\n  <\/td><td>\n  125\n  <\/td><\/tr><tr><td>\n  Uganda\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  629\n  <\/td><td>\n  629\n  <\/td><td>\n  00\n  <\/td><\/tr><tr><td>\n  Zambia\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  14\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;\n  <\/td><td>\n  &nbsp;14\n  <\/td><td>\n  00\n  <\/td><td>\n  14\n  <\/td><\/tr><tr><td>\n  Total\n  <\/td><td>156   <\/td><td>\n  224\n  <\/td><td>164   <\/td><td>134   <\/td><td>108   <\/td><td>\n  1835\n  <\/td><td>\n  1051\n  <\/td><td>\n  784\n  <\/td><\/tr><\/tbody><\/table>\n\n\n\n<p>According to the research of the Stockholm\nInternational Peace Research Institute ([10]), Russia has provided weapons to 18\nAfrican countries. The most relevant advantages of the Russian weapons are\ntheir cheap price and reliability. Russia has supplied weapons to countries\nwith no human rights guarantees, as Nigeria, Sudan or Zimbabwe. <\/p>\n\n\n\n<p>Russia not only tries to develop their military\nindustry, the Kremlin also tries to develop their influence structure in most\nof Africa through&nbsp; dependency on weapons.\n<\/p>\n\n\n\n<p><strong>APT groups which target\ndiplomatic, defense and energy organizations:<\/strong><\/p>\n\n\n\n<p>As it has been showed in the report, the\ndefense, diplomatic, energy and mineral sectors are highly relevant for Russia\nin its own influence to Africa. There are several APT groups presumably\nattributed to Russia, as APT28, APT29, Turla or Energetic Bear which target\norganizations from those fields. <\/p>\n\n\n\n<p>The following part shows some examples of malicious campaigns from threat groups presumably attributed to Russia targeting the fields mentioned before:<\/p>\n\n\n\n<p><strong>APT28 campaign against the diplomatic and defense sector:<\/strong><\/p>\n\n\n\n<p>The Threat group APT28 in 2018 carried out an\nimportant cyberattack on an important number of Ministers of Foreign Affairs\naround the world. The target of that malicious campaign was the Foreign affairs\norganizations and the Defense industry ([11]).<\/p>\n\n\n\n<p>As it is shown in the following image, the phishing email identified tried to supplant the Jane\u2019s 360 organization and the attached malicious doc was an infected excel document with the title \u201cevent calendar\u201d. Jane\u2019s 360 is an important company that supplies intelligence, defense and international relations information.&nbsp;&nbsp; Consequently, the targets were professionals from those fields. <\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/lab52.es\/blog\/wp-content\/uploads\/2019\/10\/email-1024x577-1024x577.png\" alt=\"\" class=\"wp-image-652\" width=\"882\" height=\"495\"\/><figcaption> <em>Illustration 2. Spear Phishing<\/em> <\/figcaption><\/figure><\/div>\n\n\n\n<p>The most important aim of the title document is to catch the attention of potential victims and persuade them to download the malicious document. The Microsoft Excel XLS document has the script with the malicious macro ([11]). <\/p>\n\n\n\n<figure class=\"wp-block-image is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/lab52.es\/blog\/wp-content\/uploads\/2019\/10\/c\u00f3digo-2-1024x440.png\" alt=\"\" class=\"wp-image-660\" width=\"1181\" height=\"507\" srcset=\"https:\/\/lab52.io\/blog\/wp-content\/uploads\/2019\/10\/c\u00f3digo-2-1024x440.png 1024w, https:\/\/lab52.io\/blog\/wp-content\/uploads\/2019\/10\/c\u00f3digo-2-300x129.png 300w, https:\/\/lab52.io\/blog\/wp-content\/uploads\/2019\/10\/c\u00f3digo-2-768x330.png 768w, https:\/\/lab52.io\/blog\/wp-content\/uploads\/2019\/10\/c\u00f3digo-2.png 1777w\" sizes=\"(max-width: 1181px) 100vw, 1181px\" \/><figcaption>  <em>Illustration 3. Diff of macros in Lucky strike generated document (left) and Sofacy\u2019s delivery document (right)<\/em> <\/figcaption><\/figure>\n\n\n\n<p><strong>Energy Bear Campaign against energy organizations: <\/strong><\/p>\n\n\n\n<p>The APT Iron Liberty group, also known as TG-4192, Energetic Bear, Dragonfly and Crouching Yeti, has been identified since 2010. It is an APT group particular interest in energy organizations and critical infrastructure. It is a group presumably attributed to the Russian government ([15]).<\/p>\n\n\n\n<p>Before 2014, Iron Liberty used the malware\nSysmain, Havex and XFrost, currently it is known as Karagany ([13]). During the campaigns analyzed in\n2014, the targets were Norwegian energy companies, specifically from the oil\nand gas sector. This group, also used to carry out similar cyber-attacks on\norganizations in the energy sector in the United States, the United Kingdom and\nCanada ([14]). The main objective of Iron Liberty is to collect intelligence from energy\norganizations worldwide, this classified information can give advantage to the decision\nmaking procedure of the Russian government.<\/p>\n\n\n\n<p>The &#8220;tools&#8221; used by Iron Liberty with\nthe karagany malware during 2018 contains links and similarities that had been\nused by the Iron Lyric group, also known as Teamspy.<\/p>\n\n\n\n<p>IRON LIBERTY delivers MCMD manually by either\nof these two mechanisms ([14]):<\/p>\n\n\n\n<p>\u2022 As an add-on downloaded through Karagany\nmalware<\/p>\n\n\n\n<p>\u2022 By installing using Active Directory (AD)\ncredentials through Microsoft PS Excec.<\/p>\n\n\n\n<p>Below is an example Spear Phishing\u2019s content used by Iron Liberty. As you can see, it is a job offer within the energy field ([13]):<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/lab52.es\/blog\/wp-content\/uploads\/2019\/10\/image-3.png\" alt=\"\" class=\"wp-image-621\" width=\"604\" height=\"411\" srcset=\"https:\/\/lab52.io\/blog\/wp-content\/uploads\/2019\/10\/image-3.png 487w, https:\/\/lab52.io\/blog\/wp-content\/uploads\/2019\/10\/image-3-300x204.png 300w\" sizes=\"(max-width: 604px) 100vw, 604px\" \/><figcaption>  <em>Illustration 4. Spear Phishing email<\/em> <\/figcaption><\/figure><\/div>\n\n\n\n<p>The job offer is highly similar to a real one\nand it is located in Dounrey (Scotland). It is very feasible that it was a real\noffer in the DSLR Dounreay organization.<\/p>\n\n\n\n<p>The chronology of the different identified campaigns of Iron Liberty ([13]) is shown below:<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/lab52.es\/blog\/wp-content\/uploads\/2019\/10\/image-4.png\" alt=\"\" class=\"wp-image-622\" width=\"581\" height=\"291\" srcset=\"https:\/\/lab52.io\/blog\/wp-content\/uploads\/2019\/10\/image-4.png 411w, https:\/\/lab52.io\/blog\/wp-content\/uploads\/2019\/10\/image-4-300x150.png 300w\" sizes=\"(max-width: 581px) 100vw, 581px\" \/><figcaption>  <em>Illustration 5. Chronology of the Energetic Bear\u2019s activity<\/em> <br><\/figcaption><\/figure><\/div>\n\n\n\n<p>As it has been showed in the chronology, Iron\nLiberty group targets organizations from the energy, defense and critical\ninfrastructure sectors. <\/p>\n\n\n\n<p>In addition, Karagany malware is designed to disturb\nthe forensic analysis process. This malware removes files in order to difficult\nthe identification of the same group. C2 servers for MCMD malware include a\nself-destruct script that attempts to erase the evidence of the compromised\nsystem tool.<\/p>\n\n\n\n<p>Various investigations have identified the\nfollowing add-ons with the karagany malware ([12]):<\/p>\n\n\n\n<p>\u2022 Listrix &#8211; file enumeration and directory\nlisting<\/p>\n\n\n\n<p>\u2022 IKLG &#8211; keylogger<\/p>\n\n\n\n<p>\u2022 ScreenUtil &#8211; screenshot<\/p>\n\n\n\n<p>\u2022 MCMD &#8211; interactive command shell module<\/p>\n\n\n\n<p>\u2022 SysInfo &#8211; enumeration of system information<\/p>\n\n\n\n<p>\u2022 Browser data viewer: data theft and browser\ncredentials<\/p>\n\n\n\n<p>\u2022 LogKatz: custom Mimikatz script for\ncredential theft<\/p>\n\n\n\n<p>Russia is carrying out a strategy of influence in the whole of Africa. This influence is based on the diplomatic, energy and defense power applied by Russia. It is important to consider that, as it is shown in the report, presumably, Russia has several threat actors from APT groups, with enough capabilities and background to attack specific organizations which belong to these fields. The threat actor\u2019s main goal would be to collect classified information to keep increasing its geopolitical control in Africa. The European and North American organizations linked to Foreign Affairs, Defense and Energy Ministries or organizations with interests in Africa would be an important target for this APT groups. <\/p>\n\n\n\n<p><strong>IOCs<\/strong><\/p>\n\n\n\n<table class=\"wp-block-table\"><tbody><tr><td>SHA256  <br><\/td><\/tr><tr><td>ff808d0a12676bfac88fd26f955154f8884f2bb7c534b9936510fd6296c543e8 <\/td><\/tr><tr><td>12e6642cf6413bdf5388bee663080fa299591b2ba023d069286f3be9647547c8<br><\/td><\/tr><tr><td>cb85072e6ca66a29cb0b73659a0fe5ba2456d9ba0b52e3a4c89e86549bc6e2c7<br><\/td><\/tr><tr><td>23411bb30042c9357ac4928dc6fca6955390361e660fec7ac238bbdcc8b83701<br><\/td><\/tr><tr><td>Domains    <\/td><\/tr><tr><td>Cdnverify[.]net <\/td><\/tr><tr><td>Email Subject <\/td><\/tr><tr><td>Upcoming Defense events February 2018 <\/td><\/tr><tr><td>Filename <\/td><\/tr><tr><td>Upcoming Events February 2018.xls <\/td><\/tr><tr><td>domain satanal.info  <\/td><\/tr><tr><td>domain tureg.info  <\/td><\/tr><tr><td>hostname ecco0.b13x.org <\/td><\/tr><tr><td>hostname kanri.rbridal.net <\/td><\/tr><tr><td>hostname ecco0.b13x.org  <\/td><\/tr><tr><td>hostname kanri.rbridal.net <\/td><\/tr><tr><td>URL hxxps:\/\/ecco0.b13x.org\/ajax\/base\/include\/list.php  <\/td><\/tr><tr><td>URL hxxps:\/\/kanri.rbridal.net\/json\/renew.php  <\/td><\/tr><tr><td>URL hxxps:\/\/kanri.rbridal.net\/json\/renew.php  <\/td><\/tr><tr><td>URL hxxps:\/\/kanri.rbridal.net\/json\/renew.php  <\/td><\/tr><tr><td>URL hxxps:\/\/smarttoys.com.ua\/bitrix\/services\/ajax\/refresh\/refresh.php  <\/td><\/tr><tr><td>URL hxxps:\/\/vr-bangers.com\/wp-content\/cache\/keep-alive\/alive.php  <\/td><\/tr><tr><td>SHA256 00a1b9fd9af9c5e366ef19908f028e9cca0462ec16adab9763e8c8b017b0f6bc  <\/td><\/tr><tr><td>SHA256 172be9ebd26946bdfe19150e304c8abd59d43a7bf92afa270f028c9a4a29fd99 <\/td><\/tr><tr><td>SHA1 18a4ab7f7783c06d6fd782908f8495e7c1ea15fa <\/td><\/tr><\/tbody><\/table>\n\n\n\n<p><strong>References:<\/strong><\/p>\n\n\n\n<p>&nbsp;[1] Qz. Russia is expanding its strategic\ninfluence in Africa. &nbsp;<a href=\"https:\/\/qz.com\/africa\/1546037\/russia-is-expanding-its-strategic-influence-in-africa\/\">https:\/\/qz.com\/africa\/1546037\/russia-is-expanding-its-strategic-influence-in-africa\/<\/a><\/p>\n\n\n\n<p>[2]\nISSAFRICA. Russia and Africa meet again. &nbsp;<a href=\"https:\/\/issafrica.org\/iss-today\/russia-and-africa-meet-again\">https:\/\/issafrica.org\/iss-today\/russia-and-africa-meet-again<\/a><\/p>\n\n\n\n<p>[3]\nBloomberg. Putin\u2019s chef. &nbsp;<a href=\"https:\/\/www.bloomberg.com\/news\/features\/2018-11-20\/putin-chef-yevgeny-prigozhin-is-now-meddling-in-africa\">https:\/\/www.bloomberg.com\/news\/features\/2018-11-20\/putin-chef-yevgeny-prigozhin-is-now-meddling-in-africa<\/a><\/p>\n\n\n\n<p>[4]IEEE.<a href=\"http:\/\/www.ieee.es\/Galerias\/fichero\/docs_marco\/2019\/DIEEEM10_2019JUAMOR_Rusiafrica.pdf\">http:\/\/www.ieee.es\/Galerias\/fichero\/docs_marco\/2019\/DIEEEM10_2019JUAMOR_Rusiafrica.pdf<\/a><\/p>\n\n\n\n<p>[5]\nCarnegie endowment, Late to party Russia\u2019s return to Africa. <a href=\"https:\/\/carnegieendowment.org\/2019\/10\/16\/late-to-party-russia-s-return-to-africa-pub-80056\">https:\/\/carnegieendowment.org\/2019\/10\/16\/late-to-party-russia-s-return-to-africa-pub-80056<\/a><\/p>\n\n\n\n<p>[6] France\n24 <a href=\"https:\/\/www.france24.com\/en\/20191018-oil-diamonds-and-nuclear-power-russia-eyes-africa-business\">https:\/\/www.france24.com\/en\/20191018-oil-diamonds-and-nuclear-power-russia-eyes-africa-business<\/a><\/p>\n\n\n\n<p>[7]\nCarnegie endowment <a href=\"https:\/\/carnegieendowment.org\/2019\/10\/16\/late-to-party-russia-s-return-to-africa-pub-80056\">https:\/\/carnegieendowment.org\/2019\/10\/16\/late-to-party-russia-s-return-to-africa-pub-80056<\/a><\/p>\n\n\n\n<p>[8] Lukoil. <a href=\"http:\/\/www.lukoil.com\/Business\/Upstream\/Overseas\">http:\/\/www.lukoil.com\/Business\/Upstream\/Overseas<\/a><\/p>\n\n\n\n<p>[9] Africa\nOil Power. <a href=\"https:\/\/africaoilandpower.com\/wp-content\/uploads\/2018\/09\/AOP-2018-Gazprom.pdf\">https:\/\/africaoilandpower.com\/wp-content\/uploads\/2018\/09\/AOP-2018-Gazprom.pdf<\/a><\/p>\n\n\n\n<p>[10]\nStockholm International Peace Research Institute, <a href=\"https:\/\/www.sipri.org\/databases\">https:\/\/www.sipri.org\/databases<\/a><\/p>\n\n\n\n<p>[11] Unit 42. Palo&nbsp;\nAlto. &nbsp;<a href=\"https:\/\/unit42.paloaltonetworks.com\/unit42-sofacy-attacks-multiple-government-entities\/\">https:\/\/unit42.paloaltonetworks.com\/unit42-sofacy-attacks-multiple-government-entities\/<\/a><\/p>\n\n\n\n<p>[12] Secureworks.\nUpdated karagany malware targets energy sector.&nbsp;\n<a href=\"https:\/\/www.secureworks.com\/research\/updated-karagany-malware-targets-energy-sector\">https:\/\/www.secureworks.com\/research\/updated-karagany-malware-targets-energy-sector<\/a><\/p>\n\n\n\n<p>[13] Secureworks.\nResurgent Iron Liberty targeting energy sector.&nbsp;\n<a href=\"https:\/\/www.secureworks.com\/research\/resurgent-iron-liberty-targeting-energy-sector\">https:\/\/www.secureworks.com\/research\/resurgent-iron-liberty-targeting-energy-sector<\/a><\/p>\n\n\n\n<p>[14] Secureworks. MCMD\nmalware analysis. <a href=\"https:\/\/www.secureworks.com\/research\/mcmd-malware-analysis\">https:\/\/www.secureworks.com\/research\/mcmd-malware-analysis<\/a><\/p>\n\n\n\n<p>[15] Brica. Dragonfly\ntargets ICS system using man on the middle site attacks additional IOCs. <a href=\"https:\/\/brica.de\/alerts\/alert\/public\/1268842\/dragonfly-targets-ics-systems-using-man-on-the-site-attacks-additional-iocs\/\">https:\/\/brica.de\/alerts\/alert\/public\/1268842\/dragonfly-targets-ics-systems-using-man-on-the-site-attacks-additional-iocs\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>In this report there is an analysis about the current geopolitical relationship between Russia and Africa. Furthermore, it shows several malicious campaigns presumably attributed to Russia with diplomatic, energetic and defense targets. Geopolitical Russian influence over Africa: Africa has been an historical geostrategic target for most relevant countries with a significant power in the order [&hellip;]<\/p>\n","protected":false},"author":6,"featured_media":625,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[1],"tags":[14,4,15,13,8],"class_list":{"0":"post-616","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-uncategorised","8":"tag-africa","9":"tag-apt","10":"tag-campaign","11":"tag-geostrategy","12":"tag-russia","13":"entry"},"featured_image_src":"https:\/\/lab52.io\/blog\/wp-content\/uploads\/2019\/10\/african-3078750_1920-600x400.jpg","featured_image_src_square":"https:\/\/lab52.io\/blog\/wp-content\/uploads\/2019\/10\/african-3078750_1920-600x600.jpg","author_info":{"display_name":"Dex","author_link":"https:\/\/lab52.io\/blog\/author\/dex\/"},"_links":{"self":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/616"}],"collection":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/comments?post=616"}],"version-history":[{"count":43,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/616\/revisions"}],"predecessor-version":[{"id":672,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/616\/revisions\/672"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/media\/625"}],"wp:attachment":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/media?parent=616"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/categories?post=616"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/tags?post=616"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}