Serguei Skripal was a GRU agent who was arrested in 2004. He was accused of collaborating with the British MI6 and sentenced for high treason until 2010, when he was exchanged for Russian agents arrested as part of the ‘Operation Illegal’. Since then, he had lived in the United Kingdom, apparently away from any “annoying” activity linked to his past as a member of the Service. However, in March 2018, he was found unconscious together with his daughter Yulia – she was visiting the United Kingdom – in a bank in Salisbury, allegedly the victim of an attack with Novichok, a Soviet nerve agent. The United Kingdom blames Russia for this attack without much detail.

At the end of June two Britons, a man and a woman, were admitted to the Salisbury District Hospital. An ambulance brought them from Amesbury, a few kilometres from where the former GRU agent and his daughter were poisoned. The investigation confirmed that they had also been poisoned with Novichok, apparently by accident: none of them had any previous connection with what happened in March and, possibly, they found by chance the nerve agent in what appeared to be a bottle of perfume abandoned in a park. The woman died in early July as a result of the effects of the poisoning.

[Read more…]

As we have said, if until this year the GRU was one of the most opaque services in the world, in 2018 everything changes. Three facts stand out in the chronography, which conclude with the death of Lieutenant General KOROBOV in November; we will see in this section the first of them -and in the coming ones the other two, which occurred in the month of July.

On July 13, the US Department of Justice (DoJ) publishes [1], a document accusing twelve GRU agents – directly summoned by name and surnames – of possible Russian interference in the 2016 presidential elections. The person signing the document is none other than Robert Mueller, an advisor to the DoJ who coordinates investigations in this area – that of Russia’s relationship with the US presidential elections- and who, among other things, was director of the FBI for more tan ten years. After this accusation, the FBI includes among its “Cyber most wanted” the twelve agents of the service, highlighting that they can be armed and dangerous. Until then, the only Russian service that had the privilege of having agents among the most wanted by the FBI was the FSB. [Read more…]

The GRU, Military Unit 44388, obtains and processes intelligence from multiple disciplines, including IMINT, SATINT and, of course OSINT, with information needs linked to the military, political, technological, economic and ecological/energy fields ([1]). It was already indicated in the article dedicated to the GRU, within the series on the Russian Cyberintelligence Community, that the Sixth Directorate of the GRU has historically had the SIGINT (COMINT and ELINT) attributions of the Service. An excellent description of these attributions can be found in [2]; in the image, the historical structure of the GRU:

The Sixth Directorate, which reports directly to the Service’s Deputy Director for Technical Affairs, was divided into four divisions [Read more…]

As we already mentioned in the post about it, within the series on the Russian Cyberintelligence Community, the GRU (GU) is the most opaque of the Russian services, maintaining almost intact its Soviet heritage against the “westernized” FSB o SVR: in fact, the structure and operation of the Service has not been especially well known, being the main reference [1] until rather recently. Beyond specific data of operations without a clear attribution, or the identities of its Director and Deputy Directors -no secret-, little or nothing was known about the Service. However, and certainly very much in spite of the GRU, in 2018 there are – up to now – three facts that give a radical turn to this opacity: [Read more…]

For a few months we have published a series of posts about Russian cyber intelligence in SecurityArtWork, which we hope you have liked and they have helped you to better understand Russian capabilities, groups, structures, APT… without a doubt, Russia has been and continues to be one of the main players in the field of security, intelligence and defense (and of course in cybersecurity, cyber intelligence and cyber defense … or cyber things in general) and, as such, we must know it well if we work on these issues.

As we have seen in this series, Russia is a world power in many fields (as was the USSR in its day) and still retains Soviet reminiscences; the “Cold War Mode”, which we have referred to in different posts, perfectly defines its current cyber strategy and the management of information that the country has historically done, which are applied in this broad concept of information warfare which we have also referred to on many occasions, significantly different from the West, and which includes propaganda or deception, to give just a few examples. If Russia is your mother and your mother is in danger you will do whatever is necessary to save her. Period. No further discussion.
[Read more…]

The First General Directorate of the KGB was responsible for all operations of the service outside the USSR; this Directorate included departments focused on different geographical areas of the world, which were the operational nucleus of the General Directorate and were responsible, among other things, for the duties of almost all KGB-linked companies operating outside Soviet territory. And within these geographical departments, the Fifth was concerned with France, Italy, the Netherlands, Ireland … and Spain. Certainly we did not reach the level of the United States and Canada (First Department, exclusively occupied by these two countries) but we were not very far, perhaps on a second level. For different reasons that have obviously changed over the years, since the Civil War until now Spain has been a historical objective (not the most important, but relevant) for Soviet intelligence and now it is still so for Russian intelligence: from the NKVD during its lifetime to the current services, obviously passing through the KGB from the middle to the end of the last century. Exactly the same as the USSR, or Russia today, it also is and has been an important objective for the West: for example, we have only to read something about the operation Mari, in the 60s ([2]).

A good example of Russian activities in Spain in the 1970s and 1980s is SOVHISPAN. This Spanish Soviet consignee, founded in 1971 and operating until 1993, took advantage of the strategic situation of the Canary Islands in order to deploy a capacity to supply Soviet vessels operating on African coasts or to make technical stops on transatlantic voyages (passenger or scientific). At first sight, an interesting business relationship between two countries and a spectacular source of income for the Islands, with direct flights between Las Palmas and Moscow operated, among others, by Aeroflot. But also a perfect cover for the KGB and GRU and their interests in Spain: from the delivery of the Sahara or the arrival of democracy, to the use of Canarian independence as a possible destabilizing element to prevent Spain from entering NATO. The Spanish services were no stranger to this situation, and led to the expulsion of Soviets accused of espionage; it is estimated that between 1977 and 1985 at least fifteen KGB and GRU agents were expelled from Spain, some of them directly related to SOVHISPAN, such as the company’s own CEO, Yuri Bitchkov (1981).

Neither years ago, as we have already indicated, nor nowadays, with different information needs: Spain is not the priority objective of Russian intelligence. To give some examples, in NATO we are a medium power compared with countries like France or Germany, we are geographically far from Moscow ([1]), we cannot destabilize Mother Russia by our influence in the area of Eastern Europe nor by our energy reserves, we do not have a military capability that poses a real threat to Russian borders (but on the other hand, we are in NATO) … However, not being the priority objective does not mean not being an objective; we must consider Spain as a significant objective today for Russian interests, as the entire NATO or “West” continue to be ([3]). And for this it is not necessary to go back to the last century and to the activities of SOVHISPAN: more recently different cases of Russian espionage against Spain have been identified that have jumped to the public opinion. At the end of 2010, two members of the Russian embassy in Spain were expelled from the country accused of espionage (in fact, everything was more discreet: they were invited to leave the national territory for actions outside their diplomatic status…), which Russia reacted as usual, expelling two Spanish diplomats from Moscow. It was also spread throughout the general press the arrest of a former member of the CNI in 2007 who had been identified as a double agent who sold sensitive information to Russian services until 2004; the first man convicted of treason in democracy, who is still in prison today.

But what does Russian intelligence look for in Spain? In terms of Russian information needs, seen earlier in this series, we again identify four major areas of interest for Russian services in Spain or, generalizing, anywhere in the world: scientific-technical intelligence, political intelligence and diplomatic, military intelligence and economic intelligence; we include the “ecological” (energy) area as being of special interest in almost all of them. We will analyze each of these areas in the current Spanish scenario, both in the Public Administration and in companies, starting from the fact that, on paper and formally, Spain and Russia have had an agreement for years for the mutual protection of classified information, especially political, military, technical-military and economic information ([5]). These areas ring a bell, don’t they? It is also true that this agreement explicitly refers to information “exchanged in the course of cooperation”, not “non-exchanged” information…

Let us focus first on the Public Administration; the Autonomous Administrations (much less the local ones) need not be a Russian target, at least habitual, although it is necessary to remember that in certain cases it could be interesting for Russia to accede to autonomic information. If this were the case, the Autonomous Communities with the greatest potential interest for Russia could be Catalonia, Valencia, Andalusia and the Canary Islands, and for obvious reasons the Community of Madrid. In all these Communities there are Russian Consulates (in some of them, honorary consuls). This has a simple explanation: on the Catalan coast, on the Costa del Sol, in the Valencian Community and in the archipelago is where more Russian citizens are concentrated (Barcelona is the city and Alicante is the province of Spain with more Russian population). In this way, occasionally and potentially, as always – it might be interesting for Russian intelligence to access a medical history of a citizen of this nationality who is being treated in a Spanish hospital, to give an example, so that the areas with more chances of being a specific target would be those cited.

But beyond occasional interests, if we talk about the Spanish Public Administration, it is necessary to look at the General State Administration (AGE), a presumed key objective for Russia, as a presumed key objective for the services of any country in the world; all the Ministries that make up the AGE are a Russian target. The AGE obviously has a political and diplomatic interest, one of the basic needs of Russian intelligence, and even some of its Ministries have a scientific-technical interest (Defense, Development, Education …) or economic interest; the Ministry of Defense deserves a separate mention, with the addition of military interest for Russian intelligence. In fact, according to the CCN-CERT the main Russian objectives in Spain are governmental; but although all Spanish Ministries are an objective, for different reasons, there may be some that are more than others … what could be the main objectives? Perhaps, only perhaps, the following – with its corresponding formal denomination: Presidency, Foreign Affairs, Defense, Interior and Economy. Why these five? Because of the sensitivity of the data they manage, they would be of any foreign service in general: not in vain was the CDGAI (Government Delegate Commission for Intelligence Affairs formed [4]).

Apart from Secretariats, Directorates General, etc., each Ministry has different Public Organisms linked; focusing on the previous five, within the Presidential dependents the key objective by definition will surely be the National Intelligence Center, the main actor of Spanish intelligence, or the Department of Homeland Security, of course far above other agencies such as the BOE or National Heritage. In the case of Foreign Affairs, the main objectives could be the AECID (Spanish Agency for International Cooperation for Development) or the Center for International Studies – a good part of the rest are cultural centers – while if we speak of Defense, everything is a potential Russian target: from INTA or DGAM to ISFAS (although this one is certainly less interesting than the first two). For the Interior, the Police, the Civil Guard or Penitentiary Institutions can be especially sensitive – let us remember the vast ecosystem of Russian intelligence and its relations with third parties – and finally, in Economics, perhaps the biggest focus of interest are organizations such as the CDTI or CSIC, for the scientific-technical advantage that their information can bring to Russian services and companies.

Apart from their own Administration special mention should also be made of the public companies (or semi-public) ascribed. In the Inventory of Entities of the State Public Sector (INVESPE), all the mercantile companies belonging to Ministries are listed. We have more than 150 public companies ranging from some with so little potential interest – in this context – such as “Zona Franca, SL” or ” Compañía Española de Tabaco en Rama, S.A.”, both ascribed to the Treasury, to others that may be a clear objective, as ISDEFE, S.A. (Defense) or INCIBE, S.A. (Industry).In this case, in companies’, the interests of Russian intelligence will not be so focused on politics and diplomacy, but will focus on scientific-technical and economic espionage, as they will in private business; for this reason, special mention may be made here of companies affiliated to particular ministries participating in multi-million euro projects, such as Development, for economic and technical espionage of which they may be subject (and not only Russian).

If we move onto the private sphere, that of companies, political or military espionage obviously lose strength in favor of the scientific-technical and economic espionage in different sectors – as we have said, likewise in the public enterprise – : Russian companies compete in large competitions with Spanish ones and their services will have a legitimate interest in favoring them, as well as the interest in obtaining a direct technical advantage through the theft of information. One of the main sectors of interest can be energy, main Russian driving force, so we can speak of the companies of this sector as a clear objective; without going any further, let us remember Lukoil’s interest in entering REPSOL severely a few years ago. All the major Spanish energy companies would enter in this group (without naming any, surely we all know them), as well as other companies directly or indirectly linked to the sector.

But beyond energy, when we talked about the Russian information needs a few posts ago we referred to other sectors marked as key by its National Security Strategy: ICT, biomedicine, pharmacy, nuclear technology, nanotechnology … in short, leading sectors that can advance a country in a meaningful way. Nothing strange either for Russian services or for any other country, of course. Companies in these sectors will be a potential target of Russian intelligence, as they surely will be for many other services: their research, projects, patents … are worth a lot of money. A relationship of Spanish companies in each of these sectors is no secret, and by consulting open sources we can get a rough idea of possible objectives in Spain with all details.

A particularly interesting area is that of scientific-technical espionage in companies linked to Defense, a possible target of both civil intelligence and Russian military intelligence. Here, the General Directorate of Armament and Material (DGAM) has some six hundred companies registered in its catalog; the data is classified, but one has only to consult WikiPedia to obtain an interesting list of companies in this sector; if we leave aside more classic companies and focus on technology (beware, not just computing, there are many interesting technologies for Defense … and especially faces, objects of Russian interest) we get a juicy business relationship in this area. Or even more simple: we can go to, for example, web pages of associations that bring together the companies of the sector where, in some case, in addition to providing the list of associates – something obvious – they are classified according to different parameters, such as the number of employees: thus we can easily identify Spanish companies working on technologies for the Defense sector or related to, for example, less than fifty workers. What does this mean? That we have an excellent list of interesting companies for Russian services but that are also small in size, which a priori – does not have to be so, and hopefully it is not – may imply that they are soft targets; to give us an idea, these companies work in environments as varied and interesting as the manufacturing of warships, military nanophotonics or submarine electronics…

In short, Spain has been and remains a target of Russian intelligence, not the highest priority but perhaps for sure at a second level; so it is not surprising that Russian services, or the Russian APTs, have Spain as their target, both in the Public Administration (priority) and in the private sector (biomedicine, ICT, defense…), looking for information aligned with their needs, of course always allegedly. As an example, if in the Targeted Cyberattacks Logbook of Kaspersky we select cyber espionage or information theft campaigns that had Spain in the Top 10 of its objectives we will find five, of which three are Turla, Agent.BTZ and Crouching Yeti. They ring a bell, right? Out of curiosity, the other two are Spanish-speaking: Machete and Careto. Other works clearly speak of Spain as a relevant target for APT28 ([6]), MiniDuke ([7], [8]) or Energetic Bear [9], to give just a few examples of allegedly Russian APTs that have impacted on our country. In fact, in its EMEA reports, FireEye indicates that in this area, Spain moved from tenth position in APT detection in 2014 to the third in 2015 ([10]), which shows that it is in the spotlight of different actors not just Russians.

To conclude this section, two comments. First of all, it should be recalled that the objectives identified here are by no means exhaustive; although these may be priorities, let us remember the capacity and voracity of Russian services and their broad information needs: few organizations whose information has political or economic value should consider Russia a distant threat – nor other actors. Secondly, everything reflected in this post has been extracted from public sources and in many cases are strictly personal opinions, as almost always…

Referencias
[1] Javier Morales, Eric Pardo. Rusia en la estrategia de seguridad nacional 2013. UNISCI Discussion Papers, número 35. Mayo, 2014.
[2] Claudio Reig. El espía que burló a Moscú. Ed. libros.com. Abril, 2017.
[3] Mira Milosevich-Juaristi. ¿Por qué Rusia es una amenaza existencial para Europa?. Real Instituto Elcano. Julio, 2015.
[4] Gobierno de España. Real Decreto 1886/2011, de 30 de diciembre, por el que se establecen las Comisiones Delegadas del Gobierno. BOE 315, de 31 de diciembre de 2011.
[5] Gobierno de España. Acuerdo entre el Gobierno del Reino de España y el Gobierno de la Federación de Rusia sobre la protección mutua de la información clasificada. BOE 312, de 26 de diciembre de 2014.
[6] Razvan Benchea y otros. APT28 Under the Scope. A Journey into Exfiltrating Intelligence and Government Information. BitDefender. 2015.
[7] F-Secure. The Dukes. 7 years of Russian cyberespionage. F-Secure Labs Threat Intelligence. September, 2015.
[8] Costin Raiu, Igor Soumenkov, Kurt Baumgartner, Vitaly Kamluk. The MiniDuke Mystery: PDF 0-day Government Spy Assembler 0x29A Micro Backdoor. Kaspersky Lab. February, 2013.
[9] Symantec. Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Symantec Security Response. July, 2014.
[10] Álvaro García. APT. Evolución de las tácticas. Situación de España en el panorama europeo. IX Jornadas STIC CCN-CERT. Diciembre, 2015.

Any country in the world is a potential target of Russian-or non-Russian-espionage. As an example, infiltration in America has historically been high, not only in the United States, a country of highest priority for Russian intelligence, but also throughout Latin America.

However, the maintenance of a large ecosystem of intelligence is not cheap – although it is certain that, thanks to the particularities and relations of the Russian services, it is not as expensive as it would be in other circumstances. So as in any country, Russians should prioritize their usual activities and interests, leaving for temporary occasions those temporary objectives: for example, the Middle East (Syria, Iran …) can be considered in the list of these temporary objectives, for reasons of security —counterterrorism— as well as economic —customers or suppliers of basic goods for Russia.

In addition to these, countries such as Australia or New Zealand, technologically developed and close to the West —not from the physical point of view, of course —are also targets of Russia for different reasons, such as industrial espionage. We have highlighted in gray the target countries of Russian espionage:

[Read more…]

Let us recapitulate: so far we have made several entries concerning the Russian ICC, in which we have contextualized Russian intelligence, we have described its different services with cyber attributions and have analyzed, as far as possible, their relations with third parties, thus describing the complex ecosystem of intelligence in Russia. With this ecosystem already described (we had to stop at some point), we will now try to analyze the objectives of this intelligence, its information needs: what is Russia looking for and where?

A bit of history: Vasili Mitrokhin was a KGB archivist who, after the dissolution of the USSR, defected and collaborated with the British MI6; the material exfiltrated by Mitrokhin, which gave rise to several books that are known together as “the Mitrokhin archive”, revealed among many other secrets that the Soviet leader Mikhail Gorbachev already considered industrial espionage as a key aspect for economic survival and for the restructuring of the country. This became clear after the dissolution of the USSR, so that in accordance with its legal basis ([3]), the objective of Russian intelligence has been to gather information in the political, economic, military, scientific, technical and ecological fields to support the economic development and scientific-technical and military progress of the Russian Federation; even the GRU has entrusted the acquisition of military, political-military, technological-military and economic-military information. In other words, Russia is concerned about its defense, both military and economic, from the Soviet era (from Mitrokhin’s information) to Russia at the end of the last century. Something, on the other hand, completely logical in any modern country. [Read more…]