US: Russian hackers use Iranians to mask their identities

LONDON – The United States and the U.K. say they have exposed how a group of Russian hackers hijacked the tools of their Iranian counterparts to attack dozens of countries around the world.

The so-called Turla group, also known as Waterbug or Venomous Bear, is widely reported to be associated with Russian actors. The U.S. National Security Agency and Britain’s National Cyber Security Centre said Monday that Turla acquired control of the tools and infrastructure of Iranian hacking groups for their attacks in an attempt to mask their identity.

The attacks extracted documents from multiple sectors, including governments, and were mostly carried out in the Middle East.

Paul Chichester, the NCSC’s director of operations, said Monday: “Turla acquired access to Iranian tools and the ability to identify and exploit them to further their own aims.”