False Flags: The Kremlin’s Hidden Hand

The notorious hacking gang calling itself the Cyber Caliphate might not be what it claims to be.

For two years the so-called Cyber Caliphate has been the online weapon brandished by the Islamic State against its enemies. Its hacking offensive, including aggressive use of social media, made front-page news around the world, heralding a new front in that murderous group’s worldwide jihad against “infidels.”

Pledging support to ISIS, the Cyber Caliphate hacked and defaced U.S. Government websites and social media feeds, including those of Central Command, the Pentagon’s Middle East headquarters. Numerous smaller cyber-attacks followed. They also hacked into Department of Defense databases and posted the personal information of 1,400 American military affiliates online.

The Cyber Caliphate has attacked targets in many countries, including allegedly accessing top secret emails belonging to senior British government officials. The most public of their attacks was the April 2015 hijacking of several feeds belonging to the French channel TV5Monde, which included defacing its website with the slogan “Je suis ISIS.” This assault, seen by millions of people worldwide, gave the group the notoriety it craved.

The American-led coalition against ISIS has taken the Cyber Caliphate threat seriously, devoting significant intelligence resources to tracking and studying the group. Western fears increased this April with the announcement that disparate ISIS hackers were merging, creating a new United Cyber Caliphate, designed to be a major expansion of the existing Cyber Caliphate. Drawing together jihadist hackers from many countries, this would constitute a major online threat.

In response, the Pentagon in late February announced the unleashing of real cyber-war against ISIS, including attacks by U.S. Cyber Command against the Islamic state’s communications, in an effort to disrupt their activities both kinetic and online. Neither are the Pentagon’s efforts to shut down the Islamic State’s online antics limited to the Internet. In August 2015, a drone-strike at Raqqa, ISIS’s Syrian stronghold, killed Junaid Hussain, a 21-year-old British jihadist of Pakistani origin who was the group’s best-known hacker.

However, there have long been whispers that the Cyber Caliphate is not what it claims to be. French intelligence examined the group closely after the TV5Monde attack and concluded that the hackers involved actually had nothing to do with the Islamic State. Rather, they were affiliates of a hacking collective known to be affiliated with the Kremlin, in particular APT 28, a notorious group that’s a secret arm of Moscow, according to Western security experts.  In other words, the Cyber Caliphate is a Russian intelligence operation working through what spies term a cut-out.

Cyber Caliphate is a Russian false-flag operation—nastier intelligence services will masquerade as terrorists to further their agenda.

US secret agencies, including the National Security Agency, which controls American cyber-espionage and works closely with CYBERCOM, came to similar conclusions. “APT 28 is Russian intelligence, it’s that simple,” explained an NSA expert to me recently. Hence the mid-2015 State Department security report that, while assessing the jihadist hackers as a formidable threat, nevertheless concluded, “Although Cyber Caliphate declares to support [the Islamic State], there are no indications—technical or otherwise—that the groups are tied.”

This has become the consensus view among Western intelligence services that have closely examined ISIS hacking efforts. From the newsmagazine Der Spiegel we now learn that German spy services too have concluded that the Cyber Caliphate is really a secret Russian operation. German intelligence assesses that the Kremlin has some 4,000 hackers on the payroll of its security agencies, including the General Staff’s Main Intelligence Directorate or GRU, the Foreign Intelligence Service or SVR, and the Federal Security Service or FSB. Together, this is a formidable offensive cyber force that operates through fronts and cut-outs to attack Western interests.

In other words, the Cyber Caliphate is a Russian false-flag operation. Although that loaded term has been hijacked by tinfoil-hat wearers and fringe websites, including lunatics who think horrific school shootings didn’t actually happen, it’s a perfectly legitimate espionage method of venerable vintage. Spy agencies routinely pose as third parties for operational purposes such as agent recruitment and covert action. The nastier intelligence services will even masquerade as terrorists to further their agenda.

Nobody is more adept at this dodgy practice than the Russians, who have been using false-flags in their spy work for more than a century. Indeed, for the Kremlin, this commonplace practice constitutes a key element of what they term provocation (provokatsiya in Russian), meaning the use of spies and their agents to cause secret political effects that are helpful to Moscow and hurtful to Moscow’s enemies.

The idea that Vladimir Putin authorized his intelligence agencies to go to cyber war against the West under an ISIS cloak is anything but shocking to anybody informed about longstanding Russian espionage tradecraft, what they tellingly refer to as konspiratsiya (yes, “conspiracy”). The only innovation here is the online aspect. Everything else reflects a century of “lessons learned” in Kremlin spy work. These are the sorts of clandestine things Putin was trained in and actually did as a KGB officer. And “there are no ‘former’ intelligence officers,” as the Russian president has stated.

This has implications far beyond the Islamic State. News this week that Russian-affiliated hackers have pillaged Washington, DC, including raiding the Democratic National Committee and Hillary Clinton’s campaign, ought not surprise. Among the items pilfered from the DNC include opposition research on Donald Trump, the presumptive Republican presidential nominee.

America has neglected counterintelligence for so long that we have allowed Russian intelligence into the heart of not just our security services but of our democracy itself.

Now we learn that these Kremlin hacking efforts extend far beyond the DNC. Targets in recent Russian cyber-attacks include numerous think-tanks, law firms, lobbyists, and consultants. There were also almost 4,000 Google accounts targeted in a “spear-phishing” campaign to steal personal and privileged information. It’s clear that this coordinated offensive aimed at the heart of our nation’s capital stole a great deal of inside knowledge about America’s political elite that would be of high value to any foreign intelligence service.

Inside information about how American politics actually works—including secret deals between politicians, lobbyists, lawyers, and consultants—would definitely be something Putin would want to know as his government seeks to understand and influence our political elite, including whoever is elected our next president.

America has neglected counterintelligence for so long that we have allowed Russian intelligence into the heart of not just our security services but of our democracy itself. Aided by top secret information stolen by their guest Edward Snowden from NSA about how US cybersecurity works, Kremlin spies are now feasting on whatever they like in Washington.

Whoever moves into the White House in January will face digging out from a security debacle of unprecedented proportions, with the Kremlin holding the upper hand across the board.

Observer:  

« Charge Companies for Cyber Security Failures
The Future Of Policing In The Digital Age »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

RKH Specialty

RKH Specialty

RKH Specialty, part of the Hyperion Insurance Group, is a provider of specialty insurance services including Cyber Risk cover.

Nexusguard

Nexusguard

Nexusguard is at the forefront of the fight against malicious Internet attacks, protecting organizations worldwide from threats to their websites, services, and reputations.

AAROH

AAROH

AAROH helps customers in Government, Law Enforcement, and Enterprises to identify, prevent, detect, resolve and protect from threats, crimes, breaches & fraud.

Rigado

Rigado

Rigado's mission is to enable commercial IoT success by providing high-performance secure and scalable wireless edge connectivity and network infrastructure.

Right-Hand Cybersecurity

Right-Hand Cybersecurity

Right-Hand Cybersecurity empowers businesses to monitor, measure and mitigate employee induced cyber risks in real-time.

River Loop Security

River Loop Security

River Loop Security specialize in solving complex cybersecurity challenges in the IoT and embedded devices space.

Spamhaus

Spamhaus

Spamhaus is the world leader in supplying realtime highly accurate threat intelligence to the Internet's major networks.

Atakama

Atakama

With Atakama, data remains encrypted until the very moment it is used, and the ability to decrypt is based on zero trust architecture.

Barikat Cyber Security

Barikat Cyber Security

Barikat is a provider of information security solution and services including security analysis and compliance, security testing, managed security services, incident response and training.

SynSaber

SynSaber

SynSaber is a data collection, detection, and visibility solution that forms the foundation of industrial cybersecurity.

Cybaverse

Cybaverse

Cybaverse (formerly North Star Cyber Security) was founded to create the perfect blend of a Managed Security Service Provider (MSSP) and a Cyber Security Consultancy in one.

IPKeys Cyber Partners

IPKeys Cyber Partners

IPKeys Cyber Partners, together with the IPKeys Power Partners unit, provide Cyber Security and CIP Compliance for utilities, grid operators and public safety organization across the USA.

Tracer

Tracer

Tracer (formerly Appdetex) is a next-generation brand protection solution. It constantly finds, analyzes, and stops brand abuse across Web2 and Web3 digital channels.

US Insider Risk Management Center of Excellence (US-InRM)

US Insider Risk Management Center of Excellence (US-InRM)

The US-InRM Center of Excellence is a nonprofit organization dedicated to promoting private, public, and academic partnerships to foster knowledge sharing and resources to mitigate insider risk.

Datos Insights

Datos Insights

Datos Insights is a leading global provider of insights, data, and advisory services to the financial services, insurance, and retail technology industries.

London AI Safety Research (LASR)

London AI Safety Research (LASR)

London AI Safety Research Labs is a technical AI Safety research programme focussed on reducing the risk of loss of control to advanced AI.