4 ms·
> APT28 had consistently compiled Russian language settings into their malware. The second was that malware compile times from 2007 to 2014 corresponded to norm
by avenoir 10y ago
> APT28 had consistently compiled Russian language
settings into their malware. The second was that
malware compile times from 2007 to 2014
corresponded to normal business hours in the UTC
+ 4 time zone, which includes major Russian cities
such as Moscow and St. Petersburg.
You'd think that a state-sponsored attack would be a little less careless. This seems like a rookie give-away and makes me wonder if this is made to look like Russia instead of being Russia. When I think of a state-sponsored attack, I automatically envision something in the realm of Stuxnet in terms of quality and the level of sophistication.
- mcphage 10y agoWhat you're saying is, it looks like Russia, so it wasn't Russia. But if it didn't look like Russia, then maybe it would have been Russia.
- avenoir 10y agoPerhaps I shouldn't have made such a wild claim. I was just taken aback at the lack of competence due to lots of giveaways hidden in plain sight. Hard to believe that a state-sponsored cyber espionage actor doesn't realize that the first thing investigators would do is disassemble the executable once it's discovered. I guess everything's possible. @bjourne does make a good point in his reply.
- hourislate 10y agoDid you ever consider the Russians didn't care if they were caught or intentionally left clues to let the American Administration understand that they were responsible?
- bjourne 10y agoSo we have: a) Not enough evidence that it was Russia! b) To much evidence, it can't have been Russia! :) Remember how Edward Snowden, a low-level contractor, was able to run away with all the NSA:s big secrets? Government enterprises are characterized by cluelessness, political in-fighting and not sophistication.
- _a_ 10y ago-Russia's GOV work hrs are 0800thru1800 (not 900-1700)- -Lunch 1300-1500 never be4 n00n- -Last DST happened in 2010-