US Indicts 7 Russian Intel Officers for Hacking Anti-Doping Organizations

The US Department of Justice has indicted seven Russian military intelligence officers for alleged hacking activities that were designed to undermine the credibility of international anti-doping organizations and officials.

Four of the indicted officers travelled to the Netherlands to try and break into systems belonging to an organization investigating a deadly nerve agent that was used to try and kill a former Russian spy in Britain recently.

The Dutch government Thursday separately announced it had expelled the four individuals — in the country on diplomatic passports—after disrupting the hacking attempt midway and finding equipment for breaking into WiFi networks in their rental car. In the statement, they described the Russian military intelligence team to which the four belonged as Fancy Bear — a well-known APT group that many have long suspected of Russian-government involvement.

One of the officers is also accused of attempting to break into the networks of Westinghouse Electric, a nuclear power company that has supplied power to Ukraine.

In charges unsealed today in the Western District of Pennsylvania, the US government accused the Russian intelligence officers of breaking into and stealing information from computers belonging to entities that had investigated a massive Russian state-sponsored doping program.  

The investigations began in 2015 and resulted in 111 Russian athletes being banned from the 2016 Summer Olympics in Brazil, and all Russian athletes being banned from the Paralympic Games also held in Brazil that year.

US officials allege that the Russian intelligence operatives stole credentials and personal medical histories, including data pertaining to the therapeutic use of otherwise prohibited substances, of some 250 athletes from 30 countries. They then released the information in a selective and often misleading manner and made it appear as if it was being leaked by Fancy Bear, a hacking outfit that has long been suspected of being associated with Russia's GRU.

The goal was to retaliate against the organizations and the individuals that had exposed Russia's doping program by systematically spreading misinformation to discredit and delegitimize their efforts, the DOJ said in a statement announcing the indictments Thursday. Among the goals was an effort to damage the reputations of athletes by making misleading claims about their use of banned or performing enhancing drugs, the DOJ said.

The indictments are the latest in a string of similar actions that the US government has taken recently against Russian agents for a variety of alleged hacking activities — including most notably those related to tampering with the 2016 presidential election. In fact, three of the individuals indicted for the hacks against the anti-doping organizations were indicted previously on charges related to their alleged role in the 2016 election tampering.

The indictments demonstrate the US government's ability to track malicious activities. But in practical terms it means very little, says Ross Rustici, senior director of intelligence services at Cybereason. "It does help build the public narrative regarding the extent of Russian activity," he says. "If they follow it up with DHS/FBI technical information it might have some small effect on defensive measures."

According to the DOJ, the seven indicted officers are all members of GRU, Russia's Main Intelligence Directorate. The activities on which they been charged allegedly began around Dec. 2014 and continued through at least May this year.

The seven are alleged to have conducted "persistent and sophisticated computer intrusions" against a slew of organizations including the U.S. Anti-Doping Agency, the World Anti-Doping Agency, the International Association of Athletics Federations, and the Court of Arbitration for Sport.

Most of the hacking activities were carried out from Russia and included the use of spear-phishing emails to try and obtain login credentials from individuals with access to systems and information of interest to the Russian campaign. In situations where the remote activities did not work or failed to product the intended result, a team of four intelligence officers would travel to locations where the targets were physically located in order to conduct close-access attacks via Wi-Fi networks.

In 2016, for instance, when an official from the US Anti-Doping Agency traveled to the Olympics in Rio de Janeiro, members of the Russian close-access team targeted his computer via Wi-Fi access points at the hotel and other locations. As a result of the attacks, the Russian intelligence team managed to gain access to the official's computer, which contained summaries athlete test results including prescription medication they were taking.

Hacking from the Rental Car

The four individuals who were expelled from the Netherlands this week were in fact conducting such a close-access attack against the Organization for the Prohibition of Chemical Weapons (OPCW) when their activities were spotted and stopped by the Dutch defense intelligence service. Dutch authorities found equipment that the four were using to try and break into the OPCW Wi-Fi network partially hidden in the trunk of a Citroen C3 rental car. The car had been parked in the lot of the Marriott Hotel in The Hague with its trunk, with hacking equipment inside facing the OPCW building directly adjacent to the lot.

The individuals named in the indictment are Aleksei Morenets, 41, Evgenii Serebriakov, 37, Ivan Yermakov, 32, Artem Malyshev, 30, Dmitriy Badin, 27 Oleg Sotnikov, 46, and Alexey Minin, 46.

All are officers with the GRU and are currently based in Russia and will therefore not be extradited to the US to face the charges. However, the US government in recent years has shown an increasing willingness to go after and arrest such individuals when they have traveled to countries with formal extradition treaties with the US.

Many international hackers - including those from Russia - who are currently waiting trial in a US jail or are serving out lengthy prison sentences, were nabbed when they traveled outside their country to destinations friendly to US interests.

Related Content:

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.