Just Who Are Russia's Cyber Warriors?

Western intelligence services and cyber security firms say they have identified two particular groups involved in the hack of the Democratic National Committee (DNC) that led to a series of embarrassing emails being leaked to the public ahead of the US presidential election.

The first group, known as APT 29, “Cozy Bear,” or “The Dukes,” penetrated the DNC in July 2015. It is believed to be linked to the FSB, the main successor agency to the KGB, the Soviet Union's sprawling intelligence outfit.

The second, which security experts call APT 28, or “Fancy Bear,” hacked in March 2016. Crowdstrike, the security firm hired by the DNC to investigate the hack, concluded it was linked to the Main Intelligence Directorate (GRU), the Russian ministry of defence's intelligence agency.

APT stands for Advanced Persistent Threat, a term cyber security experts use, to refer to known networks of hackers. Cozy and Fancy Bear are not the only ones linked to national governments. APT-1, for example, is believed to be a Chinese government operation.

How do they work?

Both Cozy Bear and Fancy Bear gained access to computers through a technique called “spear phishing,” where attackers use carefully tailored fake emails and websites to trick target individuals into uploading malware onto their computer systems.

But thinking of them as glorified bank scammers would be a big mistake, says Thomas Rid, the author of Rise of the Machines and an expert on espionage at King's College London.

In the DNC hacks, the emails they used were so carefully targeted and convincing that they achieved a success rate of one in seven emails.

“That’s not one in seven people who opened the email or clicked a link, that’s one in seven who actually typed in their passwords, a phenomenal success rate,” said Mr Rid. “It’s extremely sophisticated. Don’t think they wouldn’t fool you.”

So now Russia has divisions of nerds as well as tanks?

No one knows. The German intelligence services have estimated that Russia’s three main intelligence outfits, the FSB, GRU, and SVR (the foreign intelligence service, roughly Russia’s MI6), have up to 4,000 cyber agents. That's not an outlandish number, the United States said in 2014 it would seek to hire 6,000 such staff.

Between them they have targeted foreign political parties, the German parliament, defence companies, and media organisations.

But that doesn’t mean there are thousands of nerds wearing shoulder-board epaulettes. Much more likely, says Andrei Soldatov, co-author of The Red Web, is the use of “informal actors”, activists, criminal groups, and possibly even legitimate cyber tech firms, who are curated by and act for the state, but hold no formal rank or position.

Outsourcing is a tactic Russia has used elsewhere to create plausible deniability and lower the costs and risks of controversial overseas operations.

When Russian troops moved into Crimea and east Ukraine in 2014, they were preceded by nationalist activists who insist they were acting independently.

It also makes it difficult to build an accurate picture of the Russian cyber warfare programme. Given the information publicly available, says Mr Soldatov, it is difficult to see how intelligence agencies are so sure Fancy Bear is definitely the GRU, for example.

What about Mr Putin?

Dmitry Peskov, Vladimir Putin's spokesman, says US officials should "either stop talking about it or finally produce some evidence, otherwise it all begins to look unseemly."

However, it is generally believed that sophisticated cyber operations go up to the Kremlin, and strategic direction and final sign off on large scale operations like the one that targeted the DNC almost certainly sits with Mr Putin or one of his close advisors.

But most experts believe the Russian cyber programme is too big to be micro-managed by one man.

In fact, rival agencies appear to be running rival programmes, and they may not always be coordinating with one another.

APT 29, “Cozy Bear”, supposedly linked the FSB, for example, displayed a stealthy, low-profile modus operandi that you might associate with a civilian spy agency looking to gather intelligence.

They weren’t caught until APT 28, their presumably military colleagues, blundered in and set alarm bells ringing.

How does America fight back?

Barack Obama has promised to respond, but a tit-for-tat retaliation presents obvious risks.

For a start, it is not difficult to image how a war in cyberspace could spill into a war in the real world, said General Lord Richards, a former chief of the defence staff.

"You never really, quite know, where it's going to end up. Are they going to start having a go at our financial system, electricity?” he said on the BBC’s Today programme.

“You have got to be very, very careful and that is why he has been rather cagey, I think, in choosing his words the way he has," Lord Richards added.

And leaking politically compromising information related to the Russian government probably would not be as politically damaging to Vladimir Putin as it was to Hillary Clinton.

That’s partly because the Kremlin maintains a near monopoly on the Russian media landscape, and partly because many Russians have few illusions about their politicians.  

The Panama Papers, which revealed one of Mr Putin’s close friends had been handling suspiciously large sums of money, was largely greeted with a collective shrug, but also with the suspicion that it was a CIA operation trying to discredit the country’s leadership.
 
If anything, a mirror image response from Washington would confirm those suspicions, reinforcing the perception of Mr Putin is a strong leader defending the country against an aggressive US.

Telegraph

You Might Also Read:

Handbook Of Russian Information Warfare:

Bank Attack Hackers Use Russian Decoys:

Russian Military Was Behind Hacking Clinton Campaign:

Meet The Fancy Bears:

 

 

« What Happens If Criminals & Terrorists Get To Use AI
Rapid Detection Is Key To Cyber Attacks On Business »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

authen2cate

authen2cate

Authen2cate offers a simple way to provide application access with our Identity and Access Management (IAM) solutions for enterprise, small business, and individual customers alike.

CW Jobs

CW Jobs

CWJobs.co.uk is a leading specialist IT recruitment website covering all areas of IT including Cyber Security.

Council on Foreign Relations (CFR)

Council on Foreign Relations (CFR)

CFR is dedicated to better understanding the world and the foreign policy choices facing the USA and other countries. Cyber security is covered within the CFR topic areas.

Mako Group

Mako Group

The Mako Group specializes in protection - providing security through auditing, testing, and assessments. And, we do it all with the highest quality standards possible.

AuthenTrend

AuthenTrend

AuthenTrend provide biometric authentication products to achieve high security with extreme ease-of-use for the user.

Suprema

Suprema

Suprema is a leading global provider of access control and biometrics solutions.

Appvisory

Appvisory

Appvisory by MediaTest Digital is the leading Mobile Application Management-Software in Europe and enables enterprises to work secure on smartphones and tablets.

Odyssey

Odyssey

Odyssey is an ISO 27001 certified, Cyber -Security, Infrastructure and Risk Management Solutions integrator and a Managed Security Services Provider.

Fraud.com

Fraud.com

Fraud.com ensures trust at every step of the customer's digital journey; this complete end-to-end protection delivers unified identity, authentication and fraud detection and prevention.

T-REX

T-REX

T-REX is a coworking space, technology incubator, and entrepreneur resource center for technology startups.

Highland Capital Partners

Highland Capital Partners

Highland Capital Partners is an early stage venture capital firm focused on category-defining businesses in consumer and enterprise technology, including cybersecurity.

Cloud & Cyber Security Expo

Cloud & Cyber Security Expo

Cloud & Cyber Security Expo is the UK’s largest cloud and cyber security event.

Software Diversified Services (SDS)

Software Diversified Services (SDS)

SDS provides the highest quality mainframe software and award-winning, expert service with an emphasis on security, encryption, monitoring, and data compression.

Anthony Timbers LLC

Anthony Timbers LLC

Anthony Timbers is a cybersecurity consulting and penetration testing firm providing services to the Federal and Commercial sectors nationwide.

SE Ventures

SE Ventures

SE Ventures provides capital to big ideas and bold entrepreneurs who can benefit from Schneider Electric's deep domain expertise, R&D assets, and global customer base.

Panoplia Digital Protection

Panoplia Digital Protection

Panoplia Digital Protection is a cutting-edge cybersecurity company that leverages the power of AI and ML to help businesses and consumers protect themselves against cyber threats.