US Concerns Over Kremlin Links to Cyber Gangs

The relationship between Moscow and Russian cyber gangs may be tightening, spurred by international sanctions and disputes with the United States over military action in Ukraine and Syria, experts and federal lawmakers warn.

Moscow has long been known to source its technology, world-class hacking talent and even some intelligence information from local cyber crime rings, or "the Silicon Valley of Eastern Europe," said Tom Kellermann, chief cybersecurity officer at security research firm Trend Micro. In exchange, officials turn a blind eye to the rampant underground economy these cyber crime syndicates have constructed, fueled largely by mammoth data breaches at major US retailers and banks. “That symbiotic relationship has been going on for at least 10 years, if not longer,” said Jonathan Wrolstad, a cyber threat analyst with FireEye, a security firm that follows two of Russia’s more prominent intelligence hacking groups. Lawmakers tracking hacking threats agreed.

In Russia, “there are private actors, there are government actors, and there are some that have almost a contractual relationship with the government,” said Rep. Adam Schiff (D-Calif.), the top Democrat on the House Intelligence Committee. The quid pro quo has been mutually beneficial.
Often times, “when someone is identified as being technically proficient in the Russian underground,” a pending criminal case against them “suddenly disappears and those people are never heard from again,” said Dmitri Alperovitch, co-founder security firm CrowdStrike, which monitors critical infrastructure attacks. That hacker is now working for Russian intelligence services, he argues. “We know that’s going on,” Alperovitch added.

Moscow is also cherry picking software tools from these cyber gangs, such as Internet hosting services and cleverly designed malware, said Wrolstad. The result is some of the most sophisticated hacking teams in the world. Of the roughly two dozen hacking teams FireEye tracks, only two are Russian. The rest are Chinese. Yet those two groups surpass all the Chinese groups in terms of talent, Wrolstad said.
These teams write the “best pieces of malware,” he explained, some of which are “almost impossible for an organization to detect.”

A recent FireEye report explained how one hacking group covers up and coordinates its digital assaults through a complex method involving fake Twitter accounts and encrypted data buried in seemingly innocuous photos. The tactic, researchers said, displayed an unmatched “discipline and consistency."
Intelligence community briefings back up this sentiment, lawmakers told The Hill this week.
“The Russians are … more effective and more dangerous when it come to hacking,” said Rep. Jim Langevin D-R.I.), who co-chairs the Congressional Cybersecurity Caucus, comparing them to Chinese hackers. “They’re very good and they’re quiet about it.”

Russian spies even source their information from the robust underground digital market, Kellermann said.
When Eastern European cyber crime syndicates plunder sensitive data from companies, they put that information up for sale. If they crack into a device, they will sell that access. For instance, Russia-linked hackers attempted to infiltrate then-Secretary of State Hillary Clinton’s private email account in 2011. The fake email messages posed as speeding ticket notifications and asked Clinton to click on an attachment that would have given the digital intruders access to her account, a so-called “phishing” attack.

While there’s no evidence the fraudulent emails were any more than the basic spam all Americans receive, the access to Clinton’s email would have fetched considerable money on the black market had the tactic had been successful.  
What’s harder to work out is how much the Kremlin directs these outside groups, “without formally putting them on pay,” Alperovitch said.
“There’s a very grey, fuzzy line,” Kellermann agreed.
But according to Kellermann, the fuzzy line has grown more distinct as Russia clashes with the US and international community over its actions in Ukraine and Syria. He argued that Russian cyber criminals have tightened cooperation with Moscow, fueled by patriotic fervor.
Criminal hackers “that used to hunt banks eight hours a day are now operating two hours a day turning their guns on NATO and government targets,” Kellermann said.
These groups, he added, are “willingly operating as cyber militias.” Other cyber experts cautioned that they have not noticed a demonstrable change in links between the Kremlin and cyber underworld. “It’s very opaque, it’s very hard to tell,” Alperovitch said. “It’s always been pretty close.”  Wrolstad added, “In crisis situations the cyber criminals may feel pressure to help the government.”
But what the cyber community agrees on is that rising tensions between the Kremlin and the White House have coincided with a demonstrable rise in Russian cyberattacks against the US and its allies.
A slate of international sanctions slapped on the Russian economy over its military actions in Ukraine are closely linked with this increase, they concurred.
“The volume of attacks from Russia has escalated dramatically in the last year,” said Alperovitch. The hacks have peppered a variety of national security targets, including government agencies, think tanks and companies in the security community, as well as some financial and energy firms, he added.
Kellermann said he has seen cyber criminals rushing to join these efforts over the last two months, as Russia prepared to launch controversial airstrikes in civil war-torn Syria.

Russian President Vladimir Putin claims the strikes are meant to take out Islamic State in Iraq and Syria (ISIS) forces. But US officials believe Russia is simply going after the moderate rebels trying to oust Syrian President Bashar Al-Assad, who President Obama has called on to step aside.

Other cyber specialists said they hadn’t noticed a perceptible rise. “It’s kind of hard for us to distinguish, given we’re already at a high level,” said Nick Rossmann, a senior program manager of threat intelligence at FireEye.
National security-focused lawmakers agreed, telling The Hill this week they hadn’t received briefings on the matter. But the volume of cyberattacks is already so high, it could be hard to discern, they cautioned.
“It’s a constant threat so I’m not sure I would necessarily refer to it as an uptick,” said Senate Intelligence Committee Chairman Richard Burr. “But [Russia] continues to attack US systems literally daily.”
Given the strife in Syria, it would make sense for Moscow to want more intelligence on US military plans overseas, said Schiff, the California Democrat.
“It wouldn’t surprise me if there were a greater focus on Russian intelligence gathering in the United States of our intentions, our response,” Schiff said.
“They’re choosing a collision course with the United States in a number of arenas,” he added. “As they do so, I’m sure they prioritize the United States as a target of their intelligence gathering.
The Hill: http://bit.ly/1NAdTjt

 

« Robots Replace White Collar Jobs as Well
What’s The Value Of Your Data? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Assure Technical

Assure Technical

Assure Technical offers a holistic approach to Technical Security. Our expertise and services span across the Physical, Cyber and Counter Surveillance domains.

DMH Stallard

DMH Stallard

DMH Stallard is a mid-market law firm. Areas of expertise include cyber security and cyber crime.

Norwegian Information Security laboratory (NISlab)

Norwegian Information Security laboratory (NISlab)

NISlab conducts international competitive research in information and cyber security and operates study programs in this area.

4iQ

4iQ

4iQ fuses surface, social, deep and dark web sources to research and assess risks to people, infrastructure, intellectual property and reputation.

Secude

Secude

SECUDE is an established global security solutions provider offering innovative data protection for SAP users.

SecureMe2

SecureMe2

SecureMe2 ‘s mission is to make organizations more responsive to digital threats by deploying smart technology in a highly accessible way.

Digital Management (DMI)

Digital Management (DMI)

DMI is a provider of mobile enterprise, business intelligence and cybersecurity services.

Asset Guardian Solutions (AGSL)

Asset Guardian Solutions (AGSL)

Asset Guardian are dedicated to protecting the integrity of process control systems software that is used to control operations and production processes.

ACSG Corp

ACSG Corp

ACSG Corp is a Critical Infrastructure Protection Company with a multi-disciplinary focus on building analytics software for various industry sectors.

SecAlliance

SecAlliance

SecAlliance is a cyber threat intelligence product and services company.

Cyber1

Cyber1

CYBER1 is a leader in cyber security advisory and solutions. We are uniquely placed to help customers achieve cyber resilience and thus, safeguard reputation and value.

Dutch Research Council (NWO)

Dutch Research Council (NWO)

The Dutch Research Council (NWO) is one of the most important science-funding bodies in the Netherlands and ensures quality and innovation in science.

VP Techno Labs

VP Techno Labs

VP Techno Labs is an award-winning cybersecurity firm focusing only cybersecurity to develop cutting edge solutions for emerging business.

Emerge Digital

Emerge Digital

Emerge Digital is a technology and digital innovation business and Managed Services Provider providing solutions to SMEs.

Turngate

Turngate

Turngate simplify security investigations so you can see employee activities and entitlements in your enterprise in seconds.

Thero6

Thero6

Thero6 develop dynamic financial analysis algorithms that help prevent coin collapses and theft of cryptocurrency funds by identifying the transaction absolutely throughout the chain.