US Concerns Over Kremlin Links to Cyber Gangs

The relationship between Moscow and Russian cyber gangs may be tightening, spurred by international sanctions and disputes with the United States over military action in Ukraine and Syria, experts and federal lawmakers warn.

Moscow has long been known to source its technology, world-class hacking talent and even some intelligence information from local cyber crime rings, or "the Silicon Valley of Eastern Europe," said Tom Kellermann, chief cybersecurity officer at security research firm Trend Micro. In exchange, officials turn a blind eye to the rampant underground economy these cyber crime syndicates have constructed, fueled largely by mammoth data breaches at major US retailers and banks. “That symbiotic relationship has been going on for at least 10 years, if not longer,” said Jonathan Wrolstad, a cyber threat analyst with FireEye, a security firm that follows two of Russia’s more prominent intelligence hacking groups. Lawmakers tracking hacking threats agreed.

In Russia, “there are private actors, there are government actors, and there are some that have almost a contractual relationship with the government,” said Rep. Adam Schiff (D-Calif.), the top Democrat on the House Intelligence Committee. The quid pro quo has been mutually beneficial.
Often times, “when someone is identified as being technically proficient in the Russian underground,” a pending criminal case against them “suddenly disappears and those people are never heard from again,” said Dmitri Alperovitch, co-founder security firm CrowdStrike, which monitors critical infrastructure attacks. That hacker is now working for Russian intelligence services, he argues. “We know that’s going on,” Alperovitch added.

Moscow is also cherry picking software tools from these cyber gangs, such as Internet hosting services and cleverly designed malware, said Wrolstad. The result is some of the most sophisticated hacking teams in the world. Of the roughly two dozen hacking teams FireEye tracks, only two are Russian. The rest are Chinese. Yet those two groups surpass all the Chinese groups in terms of talent, Wrolstad said.
These teams write the “best pieces of malware,” he explained, some of which are “almost impossible for an organization to detect.”

A recent FireEye report explained how one hacking group covers up and coordinates its digital assaults through a complex method involving fake Twitter accounts and encrypted data buried in seemingly innocuous photos. The tactic, researchers said, displayed an unmatched “discipline and consistency."
Intelligence community briefings back up this sentiment, lawmakers told The Hill this week.
“The Russians are … more effective and more dangerous when it come to hacking,” said Rep. Jim Langevin D-R.I.), who co-chairs the Congressional Cybersecurity Caucus, comparing them to Chinese hackers. “They’re very good and they’re quiet about it.”

Russian spies even source their information from the robust underground digital market, Kellermann said.
When Eastern European cyber crime syndicates plunder sensitive data from companies, they put that information up for sale. If they crack into a device, they will sell that access. For instance, Russia-linked hackers attempted to infiltrate then-Secretary of State Hillary Clinton’s private email account in 2011. The fake email messages posed as speeding ticket notifications and asked Clinton to click on an attachment that would have given the digital intruders access to her account, a so-called “phishing” attack.

While there’s no evidence the fraudulent emails were any more than the basic spam all Americans receive, the access to Clinton’s email would have fetched considerable money on the black market had the tactic had been successful.  
What’s harder to work out is how much the Kremlin directs these outside groups, “without formally putting them on pay,” Alperovitch said.
“There’s a very grey, fuzzy line,” Kellermann agreed.
But according to Kellermann, the fuzzy line has grown more distinct as Russia clashes with the US and international community over its actions in Ukraine and Syria. He argued that Russian cyber criminals have tightened cooperation with Moscow, fueled by patriotic fervor.
Criminal hackers “that used to hunt banks eight hours a day are now operating two hours a day turning their guns on NATO and government targets,” Kellermann said.
These groups, he added, are “willingly operating as cyber militias.” Other cyber experts cautioned that they have not noticed a demonstrable change in links between the Kremlin and cyber underworld. “It’s very opaque, it’s very hard to tell,” Alperovitch said. “It’s always been pretty close.”  Wrolstad added, “In crisis situations the cyber criminals may feel pressure to help the government.”
But what the cyber community agrees on is that rising tensions between the Kremlin and the White House have coincided with a demonstrable rise in Russian cyberattacks against the US and its allies.
A slate of international sanctions slapped on the Russian economy over its military actions in Ukraine are closely linked with this increase, they concurred.
“The volume of attacks from Russia has escalated dramatically in the last year,” said Alperovitch. The hacks have peppered a variety of national security targets, including government agencies, think tanks and companies in the security community, as well as some financial and energy firms, he added.
Kellermann said he has seen cyber criminals rushing to join these efforts over the last two months, as Russia prepared to launch controversial airstrikes in civil war-torn Syria.

Russian President Vladimir Putin claims the strikes are meant to take out Islamic State in Iraq and Syria (ISIS) forces. But US officials believe Russia is simply going after the moderate rebels trying to oust Syrian President Bashar Al-Assad, who President Obama has called on to step aside.

Other cyber specialists said they hadn’t noticed a perceptible rise. “It’s kind of hard for us to distinguish, given we’re already at a high level,” said Nick Rossmann, a senior program manager of threat intelligence at FireEye.
National security-focused lawmakers agreed, telling The Hill this week they hadn’t received briefings on the matter. But the volume of cyberattacks is already so high, it could be hard to discern, they cautioned.
“It’s a constant threat so I’m not sure I would necessarily refer to it as an uptick,” said Senate Intelligence Committee Chairman Richard Burr. “But [Russia] continues to attack US systems literally daily.”
Given the strife in Syria, it would make sense for Moscow to want more intelligence on US military plans overseas, said Schiff, the California Democrat.
“It wouldn’t surprise me if there were a greater focus on Russian intelligence gathering in the United States of our intentions, our response,” Schiff said.
“They’re choosing a collision course with the United States in a number of arenas,” he added. “As they do so, I’m sure they prioritize the United States as a target of their intelligence gathering.
The Hill: http://bit.ly/1NAdTjt

 

« Robots Replace White Collar Jobs as Well
What’s The Value Of Your Data? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

Covenco

Covenco

Covenco is a data management and IT infrastructure specialist. Working with customers to transform their IT environments, with data protection and security at the forefront of everything we do.

Secure India

Secure India

Secure India provides Forensic Solutions that help Government and Business in dealing with prevention and resolution of Cyber related threats.

General Dynamics Information Technology (GDIT)

General Dynamics Information Technology (GDIT)

General Dynamics IT delivers cyber security services to defend critical information and infrastructure.

Duo Security

Duo Security

Duo combines security expertise with a user-centered philosophy to provide two-factor authentication, endpoint remediation and secure single sign-on tools.

Labris Networks

Labris Networks

Labris Networks specializes in DDoS mitigation, NG Firewall, Unified Threat Management, Centralized Management, Regulatory Compliances and SOC/CERT Services.

Irdeto

Irdeto

Irdeto is the world leader in digital platform security, protecting platforms and applications for media & entertainment, gaming, connected transport and IoT connected industries.

Government Communications Security Bureau (GCSB)

Government Communications Security Bureau (GCSB)

GCSB contributes to New Zealand’s national security by providing information assurance and cyber security to the New Zealand Government and critical infrastructure organisations.

Cyber Security Malta

Cyber Security Malta

Cyber Security Malta is part of Malta's National Cyber Security Strategy which aims to combat cybercrime, strengthen national cyber defence and provide cyber security awareness and education.

Dale Peterson

Dale Peterson

Dale Peterson, a leading ICS security and control system IT information expert, provides consulting services to assess and improve the security of SCADA and DCS.

HackHunter

HackHunter

HackHunter’s passive sensor network continuously monitors, detects and alerts when a malicious WiFi network and/or hacking behaviour is identified.

Cord3

Cord3

Cord3 delivers data protection, even from trusted administrators – or hackers posing as administrators – with high privilege.

Infopercept Consulting

Infopercept Consulting

Infopercept is a leading cybersecurity company in India, providing a critical layer of security to protect business information, infrastructure & assets across the organization.

Exterro

Exterro

Exterro is a leading provider of e-discovery and information governance software specifically designed for in-house legal, privacy and IT teams at Global 2000 and Am Law 200 organizations.

Moro Hub

Moro Hub

Moro Hub, a subsidiary of Digital DEWA, is a UAE-based digital data hub focused on digital transformation and operational services.

Cyber Explorers

Cyber Explorers

Cyber Explorers is a fun, free and interactive learning platform for future digital superstars. An exciting addition to UK curriculum delivery or after school activities.

Couno

Couno

Couno is a trusted provider of IT support services throughout the UK and Europe.