Novel Russian hacking method daisy chains Wi-Fi networks to reach intended target

Why It Matters

A new hacking technique has emerged, raising concerns about the evolving landscape of cyber warfare and espionage. As nation-state actors develop more sophisticated methods, the distinction between physical and digital security is becoming increasingly blurred.

Russian hackers have developed a highly advanced method for breaching Wi-Fi networks from a distance, known as the “nearest neighbor attack.” This technique allows hackers to infiltrate target networks without physically approaching the premises.

This new approach involves a series of steps that exploit vulnerabilities in neighboring networks to breach the intended target. Unlike previous Wi-Fi hacking methods that required close proximity to the target, hackers can now execute their attacks from a safe distance.

The cybersecurity firm Volexity uncovered this innovative Wi-Fi hacking technique while investigating a network breach in Washington, DC, in 2022. The intrusion was linked to a Russian hacker group known by various names, including Fancy Bear, APT28, and Unit 26165, affiliated with Russia’s GRU military intelligence agency.

At the Cyberwarcon security conference in Arlington, Virginia, cybersecurity researcher Steven Adair shared how his firm identified this new technique.

The “nearest neighbor attack” involves a strategic series of steps. Hackers first breach a vulnerable network near the target, gain control of a laptop within that network, and use the device’s Wi-Fi to infiltrate the target network. This method allows hackers to maintain a safe distance while exploiting Wi-Fi vulnerabilities.

In the case investigated by Volexity, the attack involved multiple network breaches, with evidence of a daisy chain of up to three networks before reaching the final target. The success of the attack relied on various technical elements, including credential exploitation, two-factor authentication bypass, and domain name leakage. The hackers demonstrated persistence by making multiple intrusion attempts even after detection.

This technique represents an evolution of the GRU’s previous “close-access” hacking methods. In 2018, Russian spies were caught attempting to hack the Wi-Fi network of the Organization for the Prohibition of Chemical Weapons in The Hague using concealed equipment in a car trunk. The “nearest neighbor attack” appears to address the operational security risks exposed by that incident.

This new attack vector poses significant challenges for cybersecurity professionals. Organizations now need to consider the security of neighboring networks as part of their threat landscape. The ability to conduct attacks from a distance expands the potential pool of attackers and makes it harder to identify the perpetrators.

In response to this emerging threat, cybersecurity experts recommend several protective measures, such as limiting Wi-Fi range, concealing network names, implementing stronger authentication protocols, and monitoring Wi-Fi access points near windows or external walls.

Experts caution that nearest-neighbor attacks may become more common. John Hultquist, a threat intelligence expert at Mandiant (owned by Google), believes this technique represents a significant advancement in close-access operations and is likely to be increasingly utilized by hackers.

Image credit: Volexity