Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


05:35 PM
Connect Directly

Mueller Probe Yields Hacking Indictments for 12 Russian Military Officers

GRU hackers used bitcoin to fund US computer network infrastructure supporting and hiding the operation.

Twelve Russian military officers have been indicted on hacking charges as part of Special Counsel Robert Mueller's investigation into Russian meddling in the 2016 presidential election. Assistant Attorney General Rod Rosenstein today announced the indictment handed down by a federal grand jury in the District of Columbia.

The charges come on the eve of President Donald Trump's meeting with Russian president Vladimir Putin on Monday in Helsinki, where Trump has promised to raise US concerns over election-meddling. The indictment says the Russian officials allegedly hacked into the Democratic National Committee (DNC), the Democratic Congressional Campaign Committee (DCCC), and employees of Democratic presidential candidate Hillary Clinton's campaign, and waged strategic leaks online in an effort to damage Clinton's candidacy.

Eleven of the defendants are charged with conspiracy to commit computer crimes, eight counts of aggravated identity theft, and money-laundering conspiracy. Two of the defendants face charges of conspiracy to commit computer crimes.

The hacking indictment syncs with US intelligence agencies' previous conclusion that Russian nation-state actors had engaged in a widespread hacking, leaking, and social media influence campaign to sway the election toward Trump. Mueller's team in June accused 13 Russian nationals and three Russian entities for a massive operation intended to interfere with the 2016 US presidential election that included bot operations and named the Internet Research Agency in Russia as the center of the operation.

Today's indictment reveals that the Russian GRU officers also breached a state election board's website and stole information on 500,000 voters, as well as the systems at a company that supplied software that verified voter registration information.

"They targeted state and local offices responsible for administering the elections, and they sent spear phishing emails to people involved in administering elections, including attaching malicious software," Rosenstein said in a press conference today.

But like the historic DoJ indictments of Chinese military officers by the US Department of Justice in May 2014, the Russian military indictment is more of a political statement: It's unlikely the named suspects will ever face the US judicial system. US and Russia have no extradition agreements. 

Among some of the key details in the indictment was that to mask their location in Russia, the suspects used a network of US-based computers paid for via bitcoin cryptocurrency.

In addition, the indictment reveals that even after the Russian APT operatives' malware was removed from DNC systems in June 2016, some of the malware (X-Agent) remained on a Linux server. "Despite these efforts, a Linux-based version of X-Agent, programmed to communicate with the GRU-registered domain linuxkrnel.net, remained on the DNC network until in or around October 2016."

The affected system or systems was, according to the DNC, quarantined, however. "This Linux based version of X-agent malware was a remnant of the original hack and had been quarantined during the remediation process in June 2016," a DNC spokesperson said. "While programmed to communicate with a GRU-registered domain, we do not have any information to suggest that it successfully communicated, exfiltrated data, corrupted our newly built systems, or breached our voter file following the remediation process."

What the Mueller investigation's findings show via the indictment is that even nation-state intelligence officers can be unmasked, says John Bambenek, director of cybersecurity research for ThreatStop. "The broader story is how hard privacy is on the Internet. The [investigators] were able to turn them into names because their fingerprints were all over the place. Even intel agencies are having a hard time," Bambenek says.

"This is far from over," says Jim Zuffoletti, CEO of Social SafeGuard, a startup that provides a social platform security service. "Think of all the different places this stolen data could be, incriminating data. They may be finding it years from now."

Security and intel experts say the next shoe to drop from Mueller's investigation is likely to be an indictment of American citizens who interacted with the Russian hackers and operatives. Today's filing doesn't name any US citizens, but it does include a tidbit that a candidate for a US congressional seat in 2016 reached out to the attackers' Guccifer 2.0 persona for stolen information on his or her political opponent. Guccifer 2.0 sent the candidate the requested documents.

"They are going to have a bad rest of their life" when his or her name is released, Bambenek says of the congressional candidate. "I think the inclusion of that wasn't accidental. It was probably a way to say it wasn't just the Russians operating alone."

Another tidbit from the indictment: More than one GRU unit was behind the hacks. "The first of these units, Unit 26165, resembles APT28, the operator who we originally suspected of carrying out the DNC incident. The second of these two units, Unit 74455, is implicated in incidents affecting election systems," says John Hultquist, director on intelligence analysis at FireEye.  

Meantime, Otavio Freire, CTO of Social SafeGuard, says the indictments show how social media played a pivotal role in the Russian military's attack on the DNC. "The visibility of staffers in social media as well as private communications (DMs) and social media accounts needw a major security upgrade to avoid a new cycle in November," he says.  Securing email is only part of the leaked communications challenge."

Related Content:




Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
Kelly Jackson Higgins,
User Rank: Strategist
7/17/2018 | 11:14:06 AM
Re: General aim of Putin
User Rank: Ninja
7/16/2018 | 8:00:41 AM
General aim of Putin
If you watch his actions, he is a disturber of the peace - just likes to gum up the works for everybody else in the world - to the benefit of Russia.  Here he was generally just aiming to cause discontent in the US election process, seed all kinds of emotions for both Clinton and Trump and make people just not trust the process.  Any discontent plays his game.  To this end he has succeeded quite well.  
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-10-23
A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticat...
PUBLISHED: 2020-10-23
FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system.
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to, contains a vulnerability in the ShadowPlay component which may lead to local privilege escalation, code execution, denial of service or information disclosure.
PUBLISHED: 2020-10-23
An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access to the server.
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to, contains a vulnerability in NVIDIA Web Helper NodeJS Web Server in which an uncontrolled search path is used to load a node module, which may lead to code execution, denial of service, escalation of privileges, and information disclosure.