Russia's Criminal Hackers

A global epidemic of digital ransomware is crippling local governments, hospitals, school districts and businesses by scrambling their data files until they pay up and law enforcement agencies appear  powerless to stop it.

Russia-based hacker groups have been accused of many of these massive ransomware attacks on major businesses and government agencies in the past year.  Ransomware exploits are dominated by Russian-speaking cyber criminals who are shielded and apparently sometimes employed, by Russian national intelligence agencies, according to security researchers and now by the Biden administration.

The hacking group, REvil, that was believed to be based in Russia, and has been linked by the FBI to the ransomware attack in May on JBS USA, the nation’s largest beef producer.  The more recent attack on Kaseya impacted up to 1,500 companies, many of them small businesses. On 13 July 2021, REvil websites and other infrastructure vanished from the Internet, but it returned two months later.

REvil, also known as Sodinokibi, emerged as one of the most commonly reported ransomware criminals in 2021. “Russian law enforcement and the FSB in particular have a very good idea of what is going on and they are monitoring it, but as long as the fraud is restricted to other parts of the world they don’t care,” said cyber crime expert Misha Glenny

One indication that the Russian government can effectively enforce the law if it so chooses is the fact that malware used by Russian and east European cyber criminals is often designed so that it “purposefully avoids infecting computers if the program detects the potential victim is a native resident.” 

The DarkSide criminal hacking group rose to notoriety following its attack on the Colonial Pipeline, a major US fuel pipeline, which disrupted fuel distribution along the southeastern US. DarkSide is believed to be based in Russia but Biden has said that the US intelligence has no evidence that their work is state-sponsored.

Recently, the US Justice Department said  that it had seized 63.7 bitcoins currently valued at approximately $2.3 million that had been paid to DarkSide as ransom. The funds recovered allegedly represent the proceeds of the ransom payment to individuals in a group known as DarkSide, which had targeted Colonial Pipeline, resulting in critical infrastructure being taken out of operation.  

Former British intelligence cyber chief Marcus Willett has called the ransomware scourge “arguably more strategically damaging than state cyber spying.” 

According to Gemini Advisory analytics, the DarkSide group are regarded as prolific professionals in their field and even possess their own code of ethics and customer service, serving as an intermediary by providing services and assistance to other hackers. 

  • The FBI has linked Russia-based hacker group REvil to the cyber attack on JBS, the world’s biggest meat processor which ended up paying an $11 million ransom. The JBS attack took place within three weeks of the Colonial Pipeline attack, exposing vulnerabilities in the systems of U.S. corporations and government agencies. 
  • REvil has also been associated with the massive cyber attack on US software company Kaseya, which serves over 40,000 customers in the US and worldwide. REvil demanded $70 million in ransom following the Kaseya hack, which affected an estimated 1,500 businesses. 
  • A Russia-based group called Nobelium has been linked to the massive 2020 SolarWinds hack that compromised about 100 US companies, including Microsoft, Intel and Cisco, in addition to a dozen government agencies including the Treasury, Justice and Energy departments and the Pentagon. 
  • In May, Microsoft said there had been a series of phishing attempts launched by Nobelium. A security update from Microsoft stated that Nobelium has stepped up attacks, notably targeting government agencies involved in foreign policy as part of intelligence-gathering efforts.

The US Treasury Department has accused Russia’s intelligence services of cultivating and co-opting cyber criminals. US intelligence agencies believe that Russian-speaking cyber criminals are shielded and often employed by the Russian government. 

The hacker groups operate within the Russian-speaking ecosystem and remain wary of Western intelligence services infiltrating their forums, The Washington Post said. 

Since taking office Biden has repeatedly told Moscow to take responsibility for the cyber attacks, warning that if the Kremlin does not take action the US will. And at their June 16 summit in Geneva, Biden presented President Vladimir Putin with a list of 16 areas of critical infrastructure that “should be off limits” to Russian cyber attacks.

Moscow denies any association with the hacking groups and has responded to questions on Russia’s alleged harboring of cyber criminals by saying that the US does the same. 

  • In April, the US hit  Russia with new sanctions in response to malicious cyber activities, accusing Russia’s intelligence services of being behind the SolarWinds hack. 
  • In May, DarkSide said that it had lost control of its servers a day after Biden announced US plans to disrupt the hackers behind the Colonial Pipeline cyber attack.  
  • Recently the REvil group also said that it plans to stop attacking sensitive social sectors like healthcare, educational institutes, and the government networks of any country, which it believes could draw unwanted attention to its operation, such as the attention DarkSide is getting right now.

Cyber security experts believe the Kremlin gives approval to cyber criminals on Russian territory as long as they don’t target Russia or its allies, protecting them from prosecution. 

President Vladimir Putin said in 2016 that if hackers “did not break Russian law, there is nothing to prosecute them for in Russia.” Russia’s Constitution forbids the extradition of its own citizens to other countries, an issue that has forced American authorities to arrest suspected hackers once they exit Russia’s borders.

NBC:        US Dept. of Justice:        Moscow Times:       Recorded Future:     Gemini Advisory:      NPR

Carnegie Endowment:    The Hill:     NY Times:    The Record:    The Hacker News:     Washington Post

You Might Also Read: 

Cyber Attacks May Lead To A “shooting war”:

 

« Ever Increasing Attacks On Maritime Ports & Systems
Ukraine Police Arrest Botnet Attack Controller »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

CSIRT Malta

CSIRT Malta

CSIRT Malta supports critical infrastructure organisations in Malta on how to protect their information infrastructure assets and systems from cyber threats and incidents.

TechDefence Labs

TechDefence Labs

TechDefence Labs provide pentesting and security assessment services for networks, web apps, mobile apps and source code reviews.

Digital Guardian

Digital Guardian

Digital Guardian is a next generation data protection platform designed to stop data theft.

Cyberlitica

Cyberlitica

Cyberlitica provides a Workforce Threat Intelligence application that significantly augments companies’ cyber threat prevention efforts.

LEADS

LEADS

LEADS is considered as a leading ICT Solution Provider and an IT partner of choice in Bangladesh.

Fyde

Fyde

Fyde helps companies with an increasingly distributed workforce mitigate breach risk by enabling secure access to critical enterprise resources.

CYQUEO

CYQUEO

CYQUEO is your professional partner and system integrator. We secure your organization against advanced cyber threats.

Axonius

Axonius

Axonius is the only solution that offers a unified view of all assets and their coverage, empowering customers to take action to enforce their organization’s security policies.

ValidSoft

ValidSoft

ValidSoft is a security software company, providing telecommunications-based multi-factor authentication, identity and transaction verification technology.

AttackIQ

AttackIQ

AttackIQ delivers continuous validation of your enterprise security program so you can strengthen your security posture and your response capabilities.

RhodeCode

RhodeCode

RhodeCode is an open source repository management platform. It provides unified security and team collaboration across Git, Subversion, and Mercurial.

ConnectWise

ConnectWise

The Unified ConnectWise Platform offers intelligent software and expert services to easily run your business, deliver your services, secure your clients, and build your staff.

Akito

Akito

Akito was set up to become a point of reference in the ICT market for issues related to Security and in particular Cyber Security.

Upfront Security

Upfront Security

Upfront Security helps companies with innovative products & services to prevent, recognise and recover from (identity) fraud.

Bosch Global Software Technologies (BGSW)

Bosch Global Software Technologies (BGSW)

Bosch Global Software Technologies offer an advanced innovation for AI security. The Bosch AIShield is the definite answer to safeguard your business against model extraction attacks.

OSC Edge

OSC Edge

OSC was founded with the vision of providing expert solutions in IT to government and businesses. OSC Edge empowers organizations with solutions that prepare them for today and tomorrow.