Attacks/Breaches

7/13/2018
05:35 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Mueller Probe Yields Hacking Indictments for 12 Russian Military Officers

GRU hackers used bitcoin to fund US computer network infrastructure supporting and hiding the operation.

Twelve Russian military officers have been indicted on hacking charges as part of Special Counsel Robert Mueller's investigation into Russian meddling in the 2016 presidential election. Assistant Attorney General Rod Rosenstein today announced the indictment handed down by a federal grand jury in the District of Columbia.

The charges come on the eve of President Donald Trump's meeting with Russian president Vladimir Putin on Monday in Helsinki, where Trump has promised to raise US concerns over election-meddling. The indictment says the Russian officials allegedly hacked into the Democratic National Committee (DNC), the Democratic Congressional Campaign Committee (DCCC), and employees of Democratic presidential candidate Hillary Clinton's campaign, and waged strategic leaks online in an effort to damage Clinton's candidacy.

Eleven of the defendants are charged with conspiracy to commit computer crimes, eight counts of aggravated identity theft, and money-laundering conspiracy. Two of the defendants face charges of conspiracy to commit computer crimes.

The hacking indictment syncs with US intelligence agencies' previous conclusion that Russian nation-state actors had engaged in a widespread hacking, leaking, and social media influence campaign to sway the election toward Trump. Mueller's team in June accused 13 Russian nationals and three Russian entities for a massive operation intended to interfere with the 2016 US presidential election that included bot operations and named the Internet Research Agency in Russia as the center of the operation.

Today's indictment reveals that the Russian GRU officers also breached a state election board's website and stole information on 500,000 voters, as well as the systems at a company that supplied software that verified voter registration information.

"They targeted state and local offices responsible for administering the elections, and they sent spear phishing emails to people involved in administering elections, including attaching malicious software," Rosenstein said in a press conference today.

But like the historic DoJ indictments of Chinese military officers by the US Department of Justice in May 2014, the Russian military indictment is more of a political statement: It's unlikely the named suspects will ever face the US judicial system. US and Russia have no extradition agreements. 

Among some of the key details in the indictment was that to mask their location in Russia, the suspects used a network of US-based computers paid for via bitcoin cryptocurrency.

In addition, the indictment reveals that even after the Russian APT operatives' malware was removed from DNC systems in June 2016, some of the malware (X-Agent) remained on a Linux server. "Despite these efforts, a Linux-based version of X-Agent, programmed to communicate with the GRU-registered domain linuxkrnel.net, remained on the DNC network until in or around October 2016."

The affected system or systems was, according to the DNC, quarantined, however. "This Linux based version of X-agent malware was a remnant of the original hack and had been quarantined during the remediation process in June 2016," a DNC spokesperson said. "While programmed to communicate with a GRU-registered domain, we do not have any information to suggest that it successfully communicated, exfiltrated data, corrupted our newly built systems, or breached our voter file following the remediation process."

What the Mueller investigation's findings show via the indictment is that even nation-state intelligence officers can be unmasked, says John Bambenek, director of cybersecurity research for ThreatStop. "The broader story is how hard privacy is on the Internet. The [investigators] were able to turn them into names because their fingerprints were all over the place. Even intel agencies are having a hard time," Bambenek says.

"This is far from over," says Jim Zuffoletti, CEO of Social SafeGuard, a startup that provides a social platform security service. "Think of all the different places this stolen data could be, incriminating data. They may be finding it years from now."

Security and intel experts say the next shoe to drop from Mueller's investigation is likely to be an indictment of American citizens who interacted with the Russian hackers and operatives. Today's filing doesn't name any US citizens, but it does include a tidbit that a candidate for a US congressional seat in 2016 reached out to the attackers' Guccifer 2.0 persona for stolen information on his or her political opponent. Guccifer 2.0 sent the candidate the requested documents.

"They are going to have a bad rest of their life" when his or her name is released, Bambenek says of the congressional candidate. "I think the inclusion of that wasn't accidental. It was probably a way to say it wasn't just the Russians operating alone."

Another tidbit from the indictment: More than one GRU unit was behind the hacks. "The first of these units, Unit 26165, resembles APT28, the operator who we originally suspected of carrying out the DNC incident. The second of these two units, Unit 74455, is implicated in incidents affecting election systems," says John Hultquist, director on intelligence analysis at FireEye.  

Meantime, Otavio Freire, CTO of Social SafeGuard, says the indictments show how social media played a pivotal role in the Russian military's attack on the DNC. "The visibility of staffers in social media as well as private communications (DMs) and social media accounts needw a major security upgrade to avoid a new cycle in November," he says.  Securing email is only part of the leaked communications challenge."

Related Content:

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
7/17/2018 | 11:14:06 AM
Re: General aim of Putin
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
7/16/2018 | 8:00:41 AM
General aim of Putin
If you watch his actions, he is a disturber of the peace - just likes to gum up the works for everybody else in the world - to the benefit of Russia.  Here he was generally just aiming to cause discontent in the US election process, seed all kinds of emotions for both Clinton and Trump and make people just not trust the process.  Any discontent plays his game.  To this end he has succeeded quite well.  
Google Engineering Lead on Lessons Learned From Chrome's HTTPS Push
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
White Hat to Black Hat: What Motivates the Switch to Cybercrime
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
PGA of America Struck By Ransomware
Dark Reading Staff 8/9/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Now about that mortgage refinance offer from Wells Fargo .....
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-6970
PUBLISHED: 2018-08-13
VMware Horizon 6 (6.x.x before 6.2.7), Horizon 7 (7.x.x before 7.5.1), and Horizon Client (4.x.x and prior before 4.8.1) contain an out-of-bounds read vulnerability in the Message Framework library. Successfully exploiting this issue may allow a less-privileged user to leak information from a privil...
CVE-2018-14781
PUBLISHED: 2018-08-13
Medtronic MMT 508 MiniMed insulin pump, 522 / MMT - 722 Paradigm REAL-TIME, 523 / MMT - 723 Paradigm Revel, 523K / MMT - 723K Paradigm Revel, and 551 / MMT - 751 MiniMed 530G The models identified above, when paired with a remote controller and having the "easy bolus" and "remote bolu...
CVE-2018-15123
PUBLISHED: 2018-08-13
Insecure configuration storage in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows remote attacker perform new attack vectors and take under control device and smart home.
CVE-2018-15124
PUBLISHED: 2018-08-13
Weak hashing algorithm in Zipato Zipabox Smart Home Controller BOARD REV - 1 with System Version -118 allows unauthenticated attacker extract clear text passwords and get root access on the device.
CVE-2018-15125
PUBLISHED: 2018-08-13
Sensitive Information Disclosure in Zipato Zipabox Smart Home Controller allows remote attacker get sensitive information that expands attack surface.