Microsoft claims that Russian hackers targeted at least 16 anti-doping agencies and international sporting organizations during a slate of cyber attacks that began on Sept. 16. According to Microsoft, Russian government-backed cyber espionage group Fancy Bear is responsible for the attacks.
One week after the first attacks began, news began circulating that the World Anti-Doping Agency was considering banning Russia from global sporting events over ongoing investigations into the country’s alleged deletion of data to mask positive drug tests concerning Russian athletes. Microsoft says that most of Fancy Bear’s recent attacks failed, but some were successful. The tech company has worked with the targeted organizations, spanning three continents, to help secure compromised accounts and systems.
Fancy Bear is also known by monikers such as ATP28 and Strontium. The group’s latest doping-tied attacks included “spear-phishing, password spray, exploiting internet-connected devices and the use of both open-source and custom malware,” Tom Burt, Microsoft’s VP of customer security, relayed in a blog post.
Fancy Bear previously breached WADA’s internal servers in 2016 to leak confidential athlete medical data. Last year, seven members of the group were indicted by the U.S. Department of Justice in connection to the 2016 hack, though they were never arrested. Fancy Bear also perpetrated phishing attacks on emails associated with the Democratic National Committee in 2016, among other politically motivated cyber attacks.
“You had one of the wealthiest states in the world—Russia—running from its sports’ minister’s office down, with its government-run lab, its government-run anti-doping organization, [a doping program covering] hundreds if not thousands of athletes. That was exposed because testing caught a Russian doper through the athlete biological passport,” U.S. Anti-Doping Agency CEO Travis Tygart told SportTechie earlier this month.
