Russia's Criminal Hackers

A global epidemic of digital ransomware is crippling local governments, hospitals, school districts and businesses by scrambling their data files until they pay up and law enforcement agencies appear  powerless to stop it.

Russia-based hacker groups have been accused of many of these massive ransomware attacks on major businesses and government agencies in the past year.  Ransomware exploits are dominated by Russian-speaking cyber criminals who are shielded and apparently sometimes employed, by Russian national intelligence agencies, according to security researchers and now by the Biden administration.

The hacking group, REvil, that was believed to be based in Russia, and has been linked by the FBI to the ransomware attack in May on JBS USA, the nation’s largest beef producer.  The more recent attack on Kaseya impacted up to 1,500 companies, many of them small businesses. On 13 July 2021, REvil websites and other infrastructure vanished from the Internet, but it returned two months later.

REvil, also known as Sodinokibi, emerged as one of the most commonly reported ransomware criminals in 2021. “Russian law enforcement and the FSB in particular have a very good idea of what is going on and they are monitoring it, but as long as the fraud is restricted to other parts of the world they don’t care,” said cyber crime expert Misha Glenny

One indication that the Russian government can effectively enforce the law if it so chooses is the fact that malware used by Russian and east European cyber criminals is often designed so that it “purposefully avoids infecting computers if the program detects the potential victim is a native resident.” 

The DarkSide criminal hacking group rose to notoriety following its attack on the Colonial Pipeline, a major US fuel pipeline, which disrupted fuel distribution along the southeastern US. DarkSide is believed to be based in Russia but Biden has said that the US intelligence has no evidence that their work is state-sponsored.

Recently, the US Justice Department said  that it had seized 63.7 bitcoins currently valued at approximately $2.3 million that had been paid to DarkSide as ransom. The funds recovered allegedly represent the proceeds of the ransom payment to individuals in a group known as DarkSide, which had targeted Colonial Pipeline, resulting in critical infrastructure being taken out of operation.  

Former British intelligence cyber chief Marcus Willett has called the ransomware scourge “arguably more strategically damaging than state cyber spying.” 

According to Gemini Advisory analytics, the DarkSide group are regarded as prolific professionals in their field and even possess their own code of ethics and customer service, serving as an intermediary by providing services and assistance to other hackers. 

  • The FBI has linked Russia-based hacker group REvil to the cyber attack on JBS, the world’s biggest meat processor which ended up paying an $11 million ransom. The JBS attack took place within three weeks of the Colonial Pipeline attack, exposing vulnerabilities in the systems of U.S. corporations and government agencies. 
  • REvil has also been associated with the massive cyber attack on US software company Kaseya, which serves over 40,000 customers in the US and worldwide. REvil demanded $70 million in ransom following the Kaseya hack, which affected an estimated 1,500 businesses. 
  • A Russia-based group called Nobelium has been linked to the massive 2020 SolarWinds hack that compromised about 100 US companies, including Microsoft, Intel and Cisco, in addition to a dozen government agencies including the Treasury, Justice and Energy departments and the Pentagon. 
  • In May, Microsoft said there had been a series of phishing attempts launched by Nobelium. A security update from Microsoft stated that Nobelium has stepped up attacks, notably targeting government agencies involved in foreign policy as part of intelligence-gathering efforts.

The US Treasury Department has accused Russia’s intelligence services of cultivating and co-opting cyber criminals. US intelligence agencies believe that Russian-speaking cyber criminals are shielded and often employed by the Russian government. 

The hacker groups operate within the Russian-speaking ecosystem and remain wary of Western intelligence services infiltrating their forums, The Washington Post said. 

Since taking office Biden has repeatedly told Moscow to take responsibility for the cyber attacks, warning that if the Kremlin does not take action the US will. And at their June 16 summit in Geneva, Biden presented President Vladimir Putin with a list of 16 areas of critical infrastructure that “should be off limits” to Russian cyber attacks.

Moscow denies any association with the hacking groups and has responded to questions on Russia’s alleged harboring of cyber criminals by saying that the US does the same. 

  • In April, the US hit  Russia with new sanctions in response to malicious cyber activities, accusing Russia’s intelligence services of being behind the SolarWinds hack. 
  • In May, DarkSide said that it had lost control of its servers a day after Biden announced US plans to disrupt the hackers behind the Colonial Pipeline cyber attack.  
  • Recently the REvil group also said that it plans to stop attacking sensitive social sectors like healthcare, educational institutes, and the government networks of any country, which it believes could draw unwanted attention to its operation, such as the attention DarkSide is getting right now.

Cyber security experts believe the Kremlin gives approval to cyber criminals on Russian territory as long as they don’t target Russia or its allies, protecting them from prosecution. 

President Vladimir Putin said in 2016 that if hackers “did not break Russian law, there is nothing to prosecute them for in Russia.” Russia’s Constitution forbids the extradition of its own citizens to other countries, an issue that has forced American authorities to arrest suspected hackers once they exit Russia’s borders.

NBC:        US Dept. of Justice:        Moscow Times:       Recorded Future:     Gemini Advisory:      NPR

Carnegie Endowment:    The Hill:     NY Times:    The Record:    The Hacker News:     Washington Post

You Might Also Read: 

Cyber Attacks May Lead To A “shooting war”:

 

« Ever Increasing Attacks On Maritime Ports & Systems
Ukraine Police Arrest Botnet Attack Controller »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

CloudEndure

CloudEndure

CloudEndure offers Disaster Recovery and Continuous Replication for the Cloud.

Security Affairs

Security Affairs

Security Affairs is a blog covering all aspects of cyber security.

Cloud Security Alliance (CSA)

Cloud Security Alliance (CSA)

The CSA is a not-for-profit organization with a mission to promote the use of best practices for providing security assurance within Cloud Computing

Wheel Systems

Wheel Systems

Wheel Systems specialize in privileged access management, user authentication and authorization and SSL/TLS encrypted traffic inspection.

Logscape

Logscape

Logscape provides a big data analytical tool for log file analysis and operational analytics.

Orange Cyberdefense

Orange Cyberdefense

Orange Cyberdefense is the expert cybersecurity business unit of the Orange Group, providing managed security, managed threat detection & response services to organizations around the globe.

Nixu

Nixu

Nixu is the largest Nordic specialist company in information security consulting.

BitSight Technologies

BitSight Technologies

BitSight transforms how companies manage information security risk with objective, verifiable and actionable Security Ratings.

OutThink

OutThink

OutThink is a web-based platform (SaaS) that has been developed specifically to identify and reduce risky workforce behaviours and build a risk aware culture.

Firedome

Firedome

Firedome's tailormade solution for IoT companies is designed to proactively prevent, detect, and respond to inevitable vulnerabilities in connected devices.

DataNumen

DataNumen

The fundamental mission of DataNumen is to recover as much data from inadvertent data disasters as possible.

Krypsis

Krypsis

Krypsys is an information security company with a focus on helping you defend your information and data against emerging security threats.

Imageware

Imageware

Imageware is a leader in biometric cybersecurity. Protect against costly, damaging ransomware hacks by employing biometric cybersecurity solutions.

Airgap Networks

Airgap Networks

Airgap is fixing the fundamental flaw of excessive trust. We help enterprises modernize their network for a simple and secure infrastructure.

Infinipoint

Infinipoint

Infinipoint pioneers the first Device-Identity-as-a-Service (DIaaS) solution, addressing Zero Trust device access and enabling enterprises of all sizes to automate cyber hygiene.

Emtec

Emtec

Emtec’s cyber security team provides advisory, assessment, & managed security services that help you build the cyber security policies, toolsets & best practices to elevate your cyber security posture