Search Results for: IoT

For a few months we have published a series of posts about Russian cyber intelligence in SecurityArtWork, which we hope you have liked and they have helped you to better understand Russian capabilities, groups, structures, APT… without a doubt, Russia has been and continues to be one of the main players in the field of security, intelligence and defense (and of course in cybersecurity, cyber intelligence and cyber defense … or cyber things in general) and, as such, we must know it well if we work on these issues.

As we have seen in this series, Russia is a world power in many fields (as was the USSR in its day) and still retains Soviet reminiscences; the “Cold War Mode”, which we have referred to in different posts, perfectly defines its current cyber strategy and the management of information that the country has historically done, which are applied in this broad concept of information warfare which we have also referred to on many occasions, significantly different from the West, and which includes propaganda or deception, to give just a few examples. If Russia is your mother and your mother is in danger you will do whatever is necessary to save her. Period. No further discussion.
[Read more…]

Any country in the world is a potential target of Russian-or non-Russian-espionage. As an example, infiltration in America has historically been high, not only in the United States, a country of highest priority for Russian intelligence, but also throughout Latin America.

However, the maintenance of a large ecosystem of intelligence is not cheap – although it is certain that, thanks to the particularities and relations of the Russian services, it is not as expensive as it would be in other circumstances. So as in any country, Russians should prioritize their usual activities and interests, leaving for temporary occasions those temporary objectives: for example, the Middle East (Syria, Iran …) can be considered in the list of these temporary objectives, for reasons of security —counterterrorism— as well as economic —customers or suppliers of basic goods for Russia.

In addition to these, countries such as Australia or New Zealand, technologically developed and close to the West —not from the physical point of view, of course —are also targets of Russia for different reasons, such as industrial espionage. We have highlighted in gray the target countries of Russian espionage:

[Read more…]

Let us recapitulate: so far we have made several entries concerning the Russian ICC, in which we have contextualized Russian intelligence, we have described its different services with cyber attributions and have analyzed, as far as possible, their relations with third parties, thus describing the complex ecosystem of intelligence in Russia. With this ecosystem already described (we had to stop at some point), we will now try to analyze the objectives of this intelligence, its information needs: what is Russia looking for and where?

A bit of history: Vasili Mitrokhin was a KGB archivist who, after the dissolution of the USSR, defected and collaborated with the British MI6; the material exfiltrated by Mitrokhin, which gave rise to several books that are known together as “the Mitrokhin archive”, revealed among many other secrets that the Soviet leader Mikhail Gorbachev already considered industrial espionage as a key aspect for economic survival and for the restructuring of the country. This became clear after the dissolution of the USSR, so that in accordance with its legal basis ([3]), the objective of Russian intelligence has been to gather information in the political, economic, military, scientific, technical and ecological fields to support the economic development and scientific-technical and military progress of the Russian Federation; even the GRU has entrusted the acquisition of military, political-military, technological-military and economic-military information. In other words, Russia is concerned about its defense, both military and economic, from the Soviet era (from Mitrokhin’s information) to Russia at the end of the last century. Something, on the other hand, completely logical in any modern country. [Read more…]

The relations of the Kremlin (by extension, of its intelligence services) with “classic” organized crime, with Russian mafias, is a fact more or less proven. Without going any further, in documents leaked by WikiLeaks the Spanish prosecutor Jose Grinda directly links the Russian mafia with the intelligence services of the country.

But beyond these leaks of WikiLeaks and their degree of reliability, in public reports – in this case, of the very prosecutor – this relationship has been officially and openly revealed [1], saying, verbatim: “[…]part of the FSB, which has implemented an organized crime regime in certain spheres of Russian power through the increased control of organized crime, a thesis that was already supported by the late Litvinenko“. In other words, Alexander Litvinenko’s theses are assumed that Russian services completely control the country’s mafia groups, gaining a mutual benefit from this relationship.

Let us remember that Litvinenko, a former agent of the KGB and the FSB, was murdered with Polonio 210 after his harsh criticism of the FSB and its activities outside of any legislation, a murder by which the UK attempted to extradite former FSO officer Andrey Lugovoy, who happens to enjoy immunity in Russia for being a member of the Duma. Of the history of Litvinenko, and of his special collaboration with the Spanish Justice and services, you can obtain an excellent vision in [2].

It is to be expected that the relations of the Russian services with organized crime, of which we already gave traces of its origin in the post of this series on the ecosystem of intelligence, extend into the field of technology, to what we call cybercrime – or organized cybercrime; always in a hypothetical way, of course … In fact, it is officially the opposite: the FSB, within its police powers has mandated activities against cybercrime, according to some analysts even replacing with its 16th Directorate, which we have already spoken about in previous posts, to the famous Directorate K of the Russian Ministry of the Interior ([6]), which officially investigates cybercrime and illegal technology-related activities in Russia. Let us also remember that this FSB Directorate has CNA capabilities, which may be activated against cybercriminals whenever it is interesting for Mother Russia … in any case, at least on paper, the two Directorates of both agencies complement each other perfectly in their activities against technological delinquency ([3]).

It is a fact that the Russian government, through both the FSB and the Directorate K of its Ministry of the Interior, has taken steps to combat criminal activity on the Internet, although it is also true that such efforts have focused more on combating such activities when they have impacted against Russian interests that, when originating in Russia, have impacted against foreign interests.

As an example, in [10] we analyze some of the press releases published in 2016 by the FSB in this sense: in total, three notes to report:

• The arrest of an organized Russian group that had stolen several million euros from Russian banks (June).
• The discovery of a harmful code (unspecified source) that had compromised different governmental, military, research … Russian organizations (July).
• The warning to the Russian government and citizenship regarding massive cyberattacks against their infrastructures from foreign services, an attack that ultimately did not occur or was completely mitigated by Russian capabilities (December).

As we see, the main actions were aimed at protecting Russia and its interests (obviously, by the way) rather than collaborating with third parties to mitigate problems originating in Russia, but also – without an official press release – it is public knowledge that in November of last year the FSB detained the group behind the bank malware Dyre, of Russian origin but with victims from almost all over the world … except from Russia.

The last of the most notorious activities of the Service during the past year, also without an associated press release, was the arrest of Sergey Mikhaylov and Ruslan Stoyanov in December, both related in one way or another, past or present, with government units specialized in the fight against cybercrime, although such detention does not seem to be related to such a struggle: the official accusation speaks, quite simply, of “betrayal”, which can be interpreted in many ways (it even points to its collaboration with the CIA or FBI), not all positive in order to demonstrate the interest of the Russian authorities to combat crime in the RuNET.

Historically, Russia has been the cradle of very high technical capabilities, capabilities that can be used for good or for bad. We spoke in an earlier post of the establishment of relations of Russian services with their ecosystem of intelligence and the situation lived at the end of last century. Extrapolating this situation to the cyber sphere, it is easy to understand how Russian technical skills can be easily oriented towards non-legal businesses, to what we call cybercrime: from spam or phishing to child pornography, through falsification and sale of official documents. A general review of Russian cybercrime may be reflected in [11].

And as for the relationship between intelligence and organized crime in this cyber domain, at the end of the last century, in the Moonlight Maze operation, there was talk of possible relations between the FSB and cybercriminals to cover certain activities in which services should not be involved directly.

If we want to talk about Russian cybercrime, it is obligatory to refer to the RBN (Russian Business Network), perfectly analyzed in [4], perhaps the most complete study on it, where the RBN is defined as “a complete infrastructure for the provision of harmful services, further indicating that “there is not a single legitimate client in the RBN”; no comment. In short, a provider of solutions for crime, adjusted to the needs of its customers … and disappeared (or not) in November 2007. Chapter 8 of [3] summarizes the curious story of this “disappearance”, in the opinion of many a simple restructuring of the RBN to make their activities less visible. Some of the main operators of the RBN have had close relations with the Russian services: it is public knowledge that at least one of them, Alexandr Boykov, was Lieutenant Colonel of the service ([5]).

In addition, some analysts defend the symbiotic relationship between RBN, patriotic hackers and the Russian government or services ([8], [9], works already referenced in previous posts in this series). This relationship is based on the permissiveness of the former in relation to criminal activities provided they are executed outside of Russia in exchange for the support of the latter when a situation requires: Georgia, Estonia … In other words: we will let you work but do not bother our compatriots; and if we need you, you have to lend us a hand. Remember: nobody says no to the FSB. In fact, some analysts defend the hypothesis that the FSB can commute prison sentences in exchange for active collaboration; honestly speaking, it offers those imputed for cybercrime freedom in exchange for “special” jobs (although it is also true that this has been popularly said of many other services).

The last example that has come to light and reveals the close relationship – potential, potential… – between cybercrime and Russian intelligence is perhaps the Yahoo hacking in 2014, which according to the US Department of Justice is attributed to the Direct collaboration of the FSB with individual actors associated with cybercrime (DoJ press release, [7], published in March 2017). It was an official accusation of relations between Russian services and organized crime groups, coming from nothing more and nothing less than the US government (with two alleged FSB agents cited with photo, first and last names, Dmitry Aleksandrovich Dokuchaev and Igor Anatolyevich Sushchin, among the most wanted in the cyber field by the FBI), and as always with the corresponding official denial of the Russian government.

The FBI also accuses Evgeniy Bogachev, the most wanted cyber-criminal and for whom offers a reward of three million dollars, not only for activities associated with economic crime (he is the creator of Gameover Zeus and Cryptolocker), but also for the possible interference – operated by the FSB – in the US electoral process. Another proof of this potential relationship? Negative information provided by the US government? Who knows … In short, we sense, although we cannot be sure, that there is a direct relationship between cybercrime and intelligence services in Russia, as there seems to be a relationship between these services and classic organized crime. Possibly yes, or possibly not, as almost always in this war…

References
[1] José Grinda González. Regulación nacional e internacional del crimen organizado. Experiencia de la Fiscalía Anticorrupción. Fiscalía General del Estado. España. Septiembre, 2015.
[2] Cruz Morcillo, Pablo Muñoz. Palabra de Vor. Espasa, 2010.
[3] Jeffrey Carr. Inside Cyber Warfare: Mapping the Cyber Underworld. O’Reilly, 2011.
[4] David Bizeul. Russian Business Network Study. November, 2007. http://fatalsystemerrorbook.net/pdf/Bizuel_onRBN.pdf
[5] Casimir C. Carey III. NATO’s Options for Defensive Cyber Against Non-State Actors. United States Army War College. April, 2013.
[6] Timothy Thomas. Russia’s Information Warfare Strategy: Can the Nation Cope in Future Conflicts?. The Journal of Slavic Military Studies. Volume 27, Issue 1. 2014.
[7] US DoJ. U.S. Charges Russian FSB Officers and Their Criminal Conspirators for Hacking Yahoo and Millions of Email Accounts. https://www.justice.gov/opa/pr/us-charges-russian-fsb-officers-and-their-criminal-conspirators-hacking-yahoo-and-millions. March, 2017.
[8] Viktor Nagy. The geostrategic struggle in cyberspace between the United States, China, and Russia. AARMS. Vol. 11, No. 1 (2012) 13–26.
[9] Jeffrey Carr. Project Grey Goose Phase II Report: The evolving state of cyber warfare. Greylogic, 2009.
[10] Filip Kovacevic. Security Threats to Russia: The Analysis of the 2016 FSB Press Releases (Part 3 – Hacking & Other Challenges). https://www.newsbud.com/2017/01/12/security-threats-to-russia-the-analysis-of-the-2016-fsb-press-releases-part-3-hacking-other-challenges/. Enero, 2017.
[11] Brian Krebbs. Spam Nation: The Inside Story of Organized Cybercrime-from Global Epidemic to Your Front Door. Sourcebooks, 2014.

We cannot conceive the Russian intelligence community, described in this series, as a set of services dependent on political or military power. The degree of penetration of these services throughout Russian society is very high, both officially and unofficially. It is no secret that former KGB or FSB officials occupy positions of responsibility in politics or big companies in the country. As a curiosity, in 2006 it was reported that 78% of the country’s top 1,000 politicians had worked for the Russian secret services [1]. So much so that these profiles have a proper name: siloviki, a term that comes to mean people in power. And it is no secret who is the most well-known siloviki: Vladimir Putin, President of the Russian Federation, who was agent of the KGB in the Soviet era and later Director of the FSB.

To understand this degree of penetration of Russian intelligence in certain organs of power it is necessary to go back especially to the 1990s. The dismemberment of the Soviet Union caused a chaotic situation in Russia, with high unemployment or poverty rates. Many people had lost their jobs – among them, it is estimated that 40% of the KGB (2) – and the easy exit for these citizens was obviously illegal. Many former members of the security forces, the army or the intelligence services ended up swelling the ranks of organized crime groups or working in the legal or illegal protection of oligarchs or mafia leaders. This transfer of specialized personnel to organized crime groups was not only the way of survival of these people, but also a considerable reinforcement of these groups, both in volume and quality: thanks to these new signings, many of them went from small, un-specialized small groups who used basic techniques of intimidation, to be converted in perfectly organized mafia groups, with better human and material resources and highly specialized tactics. And especially, with better relations with the Russian security, defense or intelligence services, the cradle of a good part of the new personnel of the mafia groups.

In this convulsive situation, it seemed that the most stable business was organized crime; for example, the number of homicides had tripled in 1995 compared to the 1988 figures. When the Russian Government began to privatize state enterprises and services, organized crime groups, with a lot of money and power, identified the opportunity to position themselves In these, which automatically not only increases their economic power, but also positions mafias in the front line of political power.

Let us recapitulate: organized crime maintained a close relationship with the security or intelligence services, since many of its members came from them, and also with the large privatized companies and therefore with national politics. A perfect combination to become a key piece for the country. The Russian Government was aware that, in order to return the country to a situation of relative normality, organized crime had to be compulsory. So much so that in 1994 Boris Yeltsin came to call Russia “the greatest mafia state in the world”.

But the arrival of Vladimir Putin to the government in 1999, tries to change this situation with two objectives: to return the control of the strategic assets to the state and to let the world know that the state controlled these assets again – and, therefore, Russia was a world power as was the USSR. It takes control of the main companies and command posts to oligarchs and criminals and places former KGB officers or their successor, the FSB, in the assurance that they all identified the same Mother Russia of which we have already spoken about in this series.

With a hard-handed dose, Vladimir Putin achieves his challenge and largely eliminates organized crime from strategic positions for the country; but the power acquired by the Mafia groups during the 1990s was too high, and trying to eliminate their activities altogether could even destabilize Russia [2], thus Putin should be content with removing them from these strategic positions but veiledly allow them to continue their illegal business.

Let’s look at the big spider web: Russian intelligence maintains connections with organized crime, gained in the 1990s, and widespread penetration in the country’s political (government) and economic (strategic enterprises) circles of power, gained in the first decade of this century. With this degree of infiltration into the power circles, Russian intelligence achieves two clear objectives: coverage and control (or collaboration, depending on the degree required in each case). This has been the case since the Soviet era and it is – coincidentally or not – in the Russian. In fact, until recently, a high percentage of senior Russian government officials were siloviki, although with Medvedev this percentage has been reduced and the siloviki have lost some of their power in politics, although they still constitute a relevant lobbying group (or several, as there are several “families” of siloviki). With the election of Medvedev as Russian Prime Minister, Putin reinforced the liberals (economists and lawyers, many of them from St. Petersburg) in front of the siloviki, headed by Sergei Ivanov, who was granted the Presidential Executive Office Headquarters; an interesting movement between two opposing clans that from that moment have a nexus of union almost unique: President Putin himself.

In addition to these circles of power, Russian services are closely related to citizen movements and even to the Russian Orthodox Church; although this last relation we are not going to describe – we are focusing on, or attempting to do so in a cyber environment – it does not fail to be a good indication of the extent to which there is a broad social penetration of intelligence in Russian society. And we will see that this penetration is not restricted to classical intelligence, but is automatically extrapolated to the cyber domain.

The relations of the Russian services with some of these actors are generally protected by the Law and can only cause ethical prejudices; however, in “unofficial” relationships legality is more than doubtful, not only with organized crime (in our case, with organized cybercrime) but also with movements like patriotic hackers, which have launched real offensive campaigns against the Russian homeland, perhaps covered by the country’s own services…

We will review in these next entries the relations of the Russian intelligence community, previously described, with the different actors relevant to that community, which allow it to increase its control and its acting capacities, especially unofficially.

References
[1] Alexander Klimburg, Heli Tirmaa-Klaar. Cybersecurity and cyberpower: concepts, conditions and capabilities for cooperation for action within the EU. Directorate-General for External Policies of the Union. Directorate B. Policy Department. European Parliament, 2011.

[2] Fred Burton, Scott Stewart. Russia and the Return of the FSB. Stratford Security Weekly. April, 2008.