Russian hackers had months-long access to Denmark's central bank

Russian state hackers compromised Denmark’s central bank (Danmarks Nationalbank) and planted malware that gave them access to the network for more than half a year without being detected.

The breach was part of the SolarWinds cyber espionage campaign last year that the U.S. attributed to the Russian Foreign Intelligence Service, the SVR, through its hacking division commonly referred to as APT29, The Dukes, Cozy Bear, or Nobelium.

Hackers had access for months

The compromise came to light after technology publication Version2 obtained official documents from the Danish central bank through a freedom of information request.

The SolarWinds campaign is considered to be one of the most sophisticated supply-chain attacks as trojanized versions of the IT management platform SolarWinds Orion had been downloaded by 18,000 organizations across the world.

“The Solarwinds backdoor in Danmarks Nationalbank was open for seven months, before the attack was detected by coincidence by the American IT-security company Fire Eye [sic]” - Version2

Despite the hackers’ long-term access, the bank said that it found no evidence of compromise beyond the first stage of the attack, as it happened with thousands of organizations that installed the trojanized version of SolarWinds Orion.

This indicates that Denmark’s central bank was merely a victim of the larger attack and it was not a target of interest for the hackers, as was the case with numerous U.S. federal agencies.

In an email statement for Version2, the bank admitted that it was affected by the SolarWinds supply-chain attack and that it took action immediately after learning of the compromise.

“Action was taken quickly and consistently in a satisfactory manner, and according to the analyzes performed, there were no signs that the attack has had any real consequences” - Denmark Central Bank

The SolarWinds attack became known when cybersecurity company FireEye disclosed it in December 2020 after detecting the hackers’ presence on its network.

It soon became clear that the hackers focused on entities in the U.S., their goal being to gain access to cloud assets, email in particular [1, 2, 3], of specific targets, including multiple government agencies.

Tracking the group as Nobelium, Microsoft said last Friday that the hackers have been running new campaigns, with at least three entities being breached.

Microsoft’s investigation of the attacks revealed an information-stealing trojan on the computer of one of its customer support agents that provided access to a limited number of customers.

In April, the U.S. government provided clear attribution for the SolarWinds espionage campaign, naming the Russian SVR as the author of the attack, through its group of hackers known in the infosec industry as Cozy Bear.

The White House noted that “the scope of this compromise is a national security and public safety concern.” The gravity of the incident was also marked by a set of sanctions against several Russian technology companies for helping Russian intelligence services carry out malicious actions against the U.S.