3 ms·
It is more like: 1. Hackers drove a custom built tank that has Moscow factory markings. 2. Similar versions of the tank were used in other campaigns attribute
by EthanHeilman 10y ago
It is more like:
1. Hackers drove a custom built tank that has Moscow factory markings.
2. Similar versions of the tank were used in other campaigns attributed to Russian intelligence.
3. Crew in the tank has been associated with Russian intelligence operations going back ten years.
4. The tank left from a building known to be associated with Russian intelligence hacking campaign.
Thus, the hackers probably take orders from Russian intelligence.
- vladimirralev 10y agoYou should mention that the tank with the crew they have inside is publicly available to anybody in the malware archives of APT28/29. Anybody can plant it. Also both the powershell and the py2exe are completely reversible so you can take it, modify it and who's creation is that now? If there is kernel-level stuff then it would be a more solid case but not by much. On top of that, it's entirely possible other completely unrelated attack is responsible for the leaks, but the malware used cleaned up after itself, leaving only the less sophisticated trail behind. Clearly if 2 groups hacked them in the easiest way possible, it's in fact suspicious why haven't they been hacked by other groups. It's almost a certainty others came after it.
- EthanHeilman 10y ago>Also both the powershell and the py2exe are completely reversible so you can take it, modify it and who's creation is that now? What about X-Agent? Seems like it would be harder to modify but I haven't looked into it. >On top of that, it's entirely possible other completely unrelated attack is responsible for the leaks, but the malware used cleaned up after itself, leaving only the less sophisticated trail behind. I like this point but it could be brought up in nearly all attributions.
- AlexCoventry 10y agoGot a link to the archive?