Russian Hackers Sow Disinformation Via Leaks

Over the past year, the Kremlin’s strategy of weaponising leaks to meddle with democracies around the world has become increasingly clear, first in the US and more recently in France

But a new report by a group of security researchers digs into another layer of those so-called influence operations: how Russian hackers alter documents within those releases of hacked material, planting disinformation alongside legitimate leaks.

The report from researchers at the Citizen Lab group at the University of Toronto’s Munk School of Public Affairs documents a wide-ranging hacking campaign, with ties to known Russian hacker groups. The effort targeted more than 200 individuals, ranging from Russian media to a former Russian prime minister to Russian opposition groups, and assorted government and military personnel from Ukraine to Vietnam. 

Noteworthy among the leaks: A Russia-focused journalist and author whose emails were not only stolen but altered before their release. Once they appeared on a Russian hacktivist site, Russian state media used the disinformation to concoct a CIA conspiracy.

The case could provide the clearest evidence yet that Russian hackers have evolved their tactics from merely releasing embarrassing true information to planting false leaks among those facts. “Russia has a long history of experience with disinformation,” says Ron Deibert, the political science professor who led Citizen Lab’s research into the newly uncovered hacking spree. “This is the first case of which I am aware that compares tainted documents to originals associated with a cyber espionage campaign.”

Go Phish

In his 2003 book Darkness at Dawn, journalist David Satter alleged that Vladimir Putin had arranged for Russian security forces to bomb apartment buildings in Moscow in 1999, in an attempt to incite war with Chechnya. 

In October of last year, Satter received a phishing email that spoofed a message from Google security requiring him to enter his Gmail account credentials, the same tactic used to breach the inbox of Clinton campaign chairman John Podesta last year. Satter, too, fell for the ruse.

Later that month, a Russian hacker group calling itself CyberBerkut released a collection of emails from Satter’s inbox, just as Russian hackers dumped pilfered emails from Podesta, the Democratic National Committee, the political party of French president Emmanuel Macron, and others. But in Satter’s case, one of those emails had been very clearly altered.

The original message had included a report by Satter on Russia-focused work for Radio Liberty, the US government-backed news outlet. But the version of the report released by CyberBerkut had been altered to make it appear that Satter was instead coordinating the publication of critical articles on a wide swath of Russian opposition websites, including the site of Russian opposition leader Alexei Navalny. 

The additions even included a mention of an upcoming article about Russian officials and businessmen by one Russian journalist who hadn’t yet published it, suggesting that she’d been tracked or hacked as well.

CyberBerkut called the doctored leak evidence of US efforts to meddle in Russian politics, and even to inspire a popular revolution. Russian state media outlets RIA Novosti and Sputnik Radio picked up that thread, quoting sources linking the plot to the CIA.

Others have accused Russian hackers of this sort of disinformation trick. But when the Clinton campaign warned that its hacked emails, posted to WikiLeaks, shouldn’t be trusted, it couldn’t point to any specific fakes in the collection. 

The Macron campaign similarly warned that the emails published from its En Marche party contained unspecified spoofed documents, though in that case En Marche had seemingly planted them as well, in an effort to confuse hackers. The Satter case provides a concrete example.

Citizen Lab notes that CyberBerkut has published fake documents in other cases, as well. They confirm a Foreign Policy report that found the group had altered documents in a late 2015 release to make it appear that George Soros’ Open Society Foundation had funded Russian opposition media and Navalny’s anti-corruption group.

Hacks of State

The Citizen Lab report goes further, though, showing new evidence that the CyberBerkut isn’t just an independent hacktivist organisation. They also show that CyberBerkut has key links to the group known as Fancy Bear or APT28, which cybersecurity firms and US intelligence agencies have agreed pulled off the attacks on the Democratic National Committee and the Clinton campaign.

That detective work began when Citizen Lab analysed the URL shortener, known as Tiny.cc, that the hackers had used to generate the link that led Satter to the phishing site. They found they could generate “adjacent” URLs that were almost certainly created by the same user, and that one of those had been used to hack a reporter at the journalism outlet Bellingcat, an attack that the cyber-security firm ThreatConnect had tied to Fancy Bear.

In analyzing more of the “adjacent” URLs, they found the hundreds of other likely targets of the Russian hackers, including Russian dissidents and foreign government officials. They also discovered that another of the URLs was tied to what appeared to be a test account that security firm FireEye had previously linked to Fancy Bear. And, of course, the Gmail phishing technique matched exactly with the one used against Podesta earlier in 2016.

Citizen Lab’s Deibert admits that none of this is a “smoking gun.” But it’s strong new evidence linking CyberBerkut’s fake leaks to a group already believed to be backed by the Kremlin. “All we can say is that the indicators we uncovered overlap extensively with other public reporting on APT28,” he says. “These, alongside the context of the targets, which match Russian strategic interests both domestically and abroad, provide very strong evidence that Russia is involved in some manner.”

All of which adds up to the strongest evidence yet that Russian hackers are indeed mixing fakes into their leaks, what the report calls “falsehoods in a forest of facts.” And that could reduce the credibility, Deibert says, of journalists who report on the leaks. It adds a new layer of falsehoods to an era fraught with fake-news accusations. “Campaigns of this sort have the potential to undermine the public’s already low confidence in media,” Deibert says.

But evidence that Russian hackers are fabricating their leaks could also make them less effective. Mixing fakes in with facts may work for Russian propaganda outlets. When it comes to involving US media in Russia’s influence operations, though, reporters may now think twice about trusting the contents of the next dumped inbox covered in Russian fingerprints.

Wired:

You Might Aslo Read:

Just Who Are Russia's Cyber Warriors?:

We Are Not Paid Agents of Russia…:

Macron Hackers Linked To Russian Intelligence:

 

 

« WannaCry Outbreak Is Just A Tip Of An Iceberg
Eight Steps To The GDPR Countdown »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

LRQA Nettitude

LRQA Nettitude

LRQA Nettitude is an award-winning global provider of cybersecurity services, bringing innovative thought leadership to the ever-evolving cybersecurity marketplace.

IABG

IABG

IABG offer independent, product-neutral consulting as well as technical and scientific services for the use of safety-relevant systems and technologies.

Computer Forensics Consult (CFC)

Computer Forensics Consult (CFC)

Computer Forensics Consult provides disaster recovery, computer forensics, electronic discovery and litigation support services in the growing area of Cyber Security.

IoT Defense

IoT Defense

IoT Defense (IOTD) is a cybersecurity and networking company building solutions that enable the protection of networks and the ever-increasing prevalence of IoT devices.

SoSafe

SoSafe

SoSafe empowers organizations to build a security culture and mitigate risk with its GDPR-compliant awareness programs.

Learn How To Become

Learn How To Become

At LearnHowToBecome.org, our mission is to help any job-seeker understand what it takes to build and develop a career. We cover many specialist areas including cybersecurity.

Dale Peterson

Dale Peterson

Dale Peterson, a leading ICS security and control system IT information expert, provides consulting services to assess and improve the security of SCADA and DCS.

Concentric

Concentric

Concentric Data Risk Monitoring and Protection. Deep Learning to discover, monitor and remediate risks to sensitive data on-premises and in the cloud.

Defensity

Defensity

Defensity offer bespoke & pre packaged IT Security Solutions for Small business to help companies reduce overall IT related risk.

LibraSoft

LibraSoft

Librasoft creates solutions to protect information from external and internal threats.

Noname Security

Noname Security

Noname Security detects and resolves API vulnerabilities and misconfigurations before they are exploited.

KT Secure

KT Secure

KTSecure’s mission is to provide proven and productive cyber security solutions and managed services, backed by our highly qualified and passionate team of experts.

Prevasio

Prevasio

Prevasio is a next-gen Cloud Security Posture Management (CSPM) with a built-in Vulnerability and Anti-Malware Scan for Containers.

Cyberplc

Cyberplc

Cyberplc is a global cybersecurity consulting firm providing services to government, the public sector and enterprises.

Radiance Technologies

Radiance Technologies

Radiance solutions provide technological advantage and operational superiority for our nation in the areas of intelligence, cyber and advanced weapon systems.

Strata Information Group (SIG)

Strata Information Group (SIG)

Strata Information Group (SIG) is a trusted partner in IT solutions and consulting services.