12 ms·

Six GRU Officers Charged in Connection with Worldwide Deployment of Malware

212 points by FDSGSG 6y ago

Isamu 6y ago
Interesting details: > These GRU hackers and their co-conspirators engaged in computer intrusions and attacks intended to support Russian government efforts to undermine, retaliate against, or otherwise destabilize: (1) Ukraine; (2) Georgia; (3) elections in France; (4) efforts to hold Russia accountable for its use of a weapons-grade nerve agent, Novichok, on foreign soil; and (5) the 2018 PyeongChang Winter Olympic Games after Russian athletes were banned from participating under their nation’s flag, as a consequence of Russian government-sponsored doping effort.
- MauranKilom 6y ago
  Is this clear from the evidence or are these the allegations against them?
  - AaronFriel 6y ago
    That's a tricky thing with indictments like this. For now, these are the allegations against them. Evidence would be introduced at trial and the prosecutors would be loathe to introduce any evidence that exposes "sources and methods" of intelligence. And the defendants will likely never set foot in a place where they could be extradited to stand trial. So, sort of a paper tiger. Does the US Government (as represented by these prosecutors) have a good faith belief these individuals committed these crimes? Probably, though you might believe otherwise. I would say my trust is very high in that statement, despite everything else going on in politics right now. The government doesn't make indictments like this lightly, and the grand jury saw at least enough evidence to establish probable cause. At the same time, there is a saying about ham sandwiches and indictments. Will we ever see the underlying evidence? I doubt we will. Should we trust the US Government's representations in this case? Again, I would - but you may have priors to suggest you shouldn't.
  - phjesusthatguy3 6y ago
    This is a press release from the department of justice. There are two attachments at the end.
  - reaperducer 6y ago
    Is this clear from the evidence or are these the allegations against them? The evidence is presented at the trial, not in the initial press release announcing there has been an indictment. One would expect that there is clear evidence, or there wouldn't be an indictment. You can't win a court case without evidence.
  - ciarannolan 6y ago
    It's a long PDF [0], but these indictments are usually very detailed. [0] https://www.justice.gov/opa/press-release/file/1328521/download https://www.justice.gov/opa/press-release/file/1328521/downl...
dboreham 6y ago
> The department is also grateful to Google, including its Threat Analysis Group (TAG); Cisco, including its Talos Intelligence Group; Facebook; and Twitter, for the assistance they provided in this investigation.
- spacemanmatt 6y ago
  I am also grateful. I don't know if it would make any sense to go into this analysis without input from security teams at some of the most attacked sites/hardware vendors.
kasperni 6y ago
Can someone explain how individuals are identified when we are talking about state sponsored hackers?
- sam_lowry_ 6y ago
  By detractors? By cyberattacks? Good old espionage?
- povik 6y ago
  I have wondered about the same.
- wyldfire 6y ago
  HUMINT probably.
- defen 6y ago
  Sometimes you catch them on camera https://apnews.com/article/ef3b036949174a9b98d785129a93428b https://apnews.com/article/ef3b036949174a9b98d785129a93428b
- somurzakov 6y ago
  they probably have a database of the entire GRU hackers squad (Unit 74455) and cross-matched the actions with people's background (people have resumes, social networks, educational background, etc.). also google location services might have some data on them too
- ciarannolan 6y ago
  In the past they have texted specific GRU agents on their personal phones: https://www.wired.com/story/cyber-command-ira-strike-sends-signal/ https://www.wired.com/story/cyber-command-ira-strike-sends-s... > As The New York Times reported last October, Cyber Command operators sent direct messages to individual Russian staffers that they had identified as involved in election interference, and were tracking their activity. The Post reports that the IRA was troubled enough by those messages that they launched an internal investigation to identify potential leakers. I have a feeling that the US and allied countries are pretty deep into the Russians with this stuff.
pjc50 6y ago
Keeping this to post under all those comments saying there was nothing to "Russiagate".
- DoofusOfDeath 6y ago
  > Keeping this to post under all those comments saying there was nothing to "Russiagate". Perhaps I haven't had enough coffee yet, but I'm having trouble parsing your comment. Would you be willing to say it differently?
  - sam_lowry_ 6y ago
    The OP is replying under this post so they are able to later find it via the list of own comments.
  - deleted 6y ago
    [deleted]
  - MauranKilom 6y ago
    Not original author, but I'd rephrase it like this: "I will keep this [stored/saved/bookmarked] so that I can post it as counterargument under any comment claiming that 'Russiagate' didn't actually happen." As to the efficacy of this counterargument, see the sibling comments of yours.
- monocasa 6y ago
  A press release for indictments for people you're never going to arrest or have a trial for is nothing more than propaganda. If they actually cared about catching these people, they'd keep the indictments secret so that they might go to a country that has an extradition treaty with the US.
  - yters 6y ago
    I am even more confused by this comment. How is this propaganda?
ineedasername 6y ago
I'm torn when it comes to the utility of making public indictments of this sort when the truth is there will never be any arrest or trial. Making them public lets Russia know we're aware of their actions, which in turn may drive them to greater efforts to make these actions harder to detect and therefore harder to defend against. I also wonder if making these public, detrimental and unnecessary, is just a cynical ploy before an election to give the appearance that this administration has been tough on Russia, when actual toughness on Russia would mean not just indictments, but also sanctions and other tangible consequences. On the other hand, absent legal accountability for these individuals and Russia itself, making these indictments public allows the rest of the world to see & know what Russia is up to. That might facilitate action through the softer power of diplomacy, and perhaps also put other countries on notice that they must take greater care in protecting their critical systems as well. And if it is the correct choice to do so, then any political benefit, cynically motivated or not, is an ancillary factor. I suppose it may be a tough balance to strike. I think I come down on the side of making these issues public knowledge. Just as I similarly believe bad actions on the part of the US should be available for public scrutiny whenever it does not jeopardize the lives and safety of those who fight for our country.
- dx87 6y ago
  It could also just be done as a thinly veiled threat to discourage people from working there. Even if nobody is arrested, the statement is basically saying "it doesn't matter where you are, or how secretive your work is, we can find you". I can imagine spouses and family would suggest they start looking for a different job after seeing the announcment.
  - SCHiM 6y ago
    Indeed. And as GP said. If you force your adversary to take more precautions you're driving up the cost, increase the time it takes for them to perform operations, makes them need more experienced/educated personnel, more procedures to catch mistakes, etc. etc. That's not a bad thing for Russia's adversaries.
  - cameldrv 6y ago
anonu 6y ago
Going through the indictment with a quick read: it seems most of the attacks began as spearfishing. Which goes to show: the human link is still the weakest one.
ancantus 6y ago
There's a fantastic book about this group published recently titled "Sandworm" by Andy Greenberg. https://www.goodreads.com/en/book/show/41436213-sandworm https://www.goodreads.com/en/book/show/41436213-sandworm
Stierlitz 6y ago
Do you really have to give space to this Neocon cyber BS on a respectable tech forum. Cyber BS by people who seem to be desperate to re-start the cold-war. Fortunatly, the Russians won't come out to play. Neither will the Chinese, Iran or North Korea.

212 points by FDSGSG 6y ago

Interesting details: > These GRU hackers and their co-conspirators engaged in computer intrusions and attacks intended to support Russian government efforts to undermine, retaliate against, or otherwise destabilize: (1) Ukraine; (2) Georgia; (3) elections in France; (4) efforts to hold Russia accountable for its use of a weapons-grade nerve agent, Novichok, on foreign soil; and (5) the 2018 PyeongChang Winter Olympic Games after Russian athletes were banned from participating under their nation’s flag, as a consequence of Russian government-sponsored doping effort.

MauranKilom 6y ago
Is this clear from the evidence or are these the allegations against them?
- AaronFriel 6y ago
  That's a tricky thing with indictments like this. For now, these are the allegations against them. Evidence would be introduced at trial and the prosecutors would be loathe to introduce any evidence that exposes "sources and methods" of intelligence. And the defendants will likely never set foot in a place where they could be extradited to stand trial. So, sort of a paper tiger. Does the US Government (as represented by these prosecutors) have a good faith belief these individuals committed these crimes? Probably, though you might believe otherwise. I would say my trust is very high in that statement, despite everything else going on in politics right now. The government doesn't make indictments like this lightly, and the grand jury saw at least enough evidence to establish probable cause. At the same time, there is a saying about ham sandwiches and indictments. Will we ever see the underlying evidence? I doubt we will. Should we trust the US Government's representations in this case? Again, I would - but you may have priors to suggest you shouldn't.
- phjesusthatguy3 6y ago
  This is a press release from the department of justice. There are two attachments at the end.
- reaperducer 6y ago
  Is this clear from the evidence or are these the allegations against them? The evidence is presented at the trial, not in the initial press release announcing there has been an indictment. One would expect that there is clear evidence, or there wouldn't be an indictment. You can't win a court case without evidence.
- ciarannolan 6y ago
  It's a long PDF [0], but these indictments are usually very detailed. [0] https://www.justice.gov/opa/press-release/file/1328521/download https://www.justice.gov/opa/press-release/file/1328521/downl...

dboreham 6y ago

> The department is also grateful to Google, including its Threat Analysis Group (TAG); Cisco, including its Talos Intelligence Group; Facebook; and Twitter, for the assistance they provided in this investigation.

spacemanmatt 6y ago
I am also grateful. I don't know if it would make any sense to go into this analysis without input from security teams at some of the most attacked sites/hardware vendors.

kasperni 6y ago

Can someone explain how individuals are identified when we are talking about state sponsored hackers?

sam_lowry_ 6y ago
By detractors? By cyberattacks? Good old espionage?
povik 6y ago
I have wondered about the same.
wyldfire 6y ago
HUMINT probably.
defen 6y ago
Sometimes you catch them on camera https://apnews.com/article/ef3b036949174a9b98d785129a93428b https://apnews.com/article/ef3b036949174a9b98d785129a93428b
somurzakov 6y ago
they probably have a database of the entire GRU hackers squad (Unit 74455) and cross-matched the actions with people's background (people have resumes, social networks, educational background, etc.). also google location services might have some data on them too
ciarannolan 6y ago
In the past they have texted specific GRU agents on their personal phones: https://www.wired.com/story/cyber-command-ira-strike-sends-signal/ https://www.wired.com/story/cyber-command-ira-strike-sends-s... > As The New York Times reported last October, Cyber Command operators sent direct messages to individual Russian staffers that they had identified as involved in election interference, and were tracking their activity. The Post reports that the IRA was troubled enough by those messages that they launched an internal investigation to identify potential leakers. I have a feeling that the US and allied countries are pretty deep into the Russians with this stuff.

pjc50 6y ago

Keeping this to post under all those comments saying there was nothing to "Russiagate".

DoofusOfDeath 6y ago
> Keeping this to post under all those comments saying there was nothing to "Russiagate". Perhaps I haven't had enough coffee yet, but I'm having trouble parsing your comment. Would you be willing to say it differently?
- sam_lowry_ 6y ago
  The OP is replying under this post so they are able to later find it via the list of own comments.
- deleted 6y ago
  [deleted]
- MauranKilom 6y ago
  Not original author, but I'd rephrase it like this: "I will keep this [stored/saved/bookmarked] so that I can post it as counterargument under any comment claiming that 'Russiagate' didn't actually happen." As to the efficacy of this counterargument, see the sibling comments of yours.
monocasa 6y ago
A press release for indictments for people you're never going to arrest or have a trial for is nothing more than propaganda. If they actually cared about catching these people, they'd keep the indictments secret so that they might go to a country that has an extradition treaty with the US.
- yters 6y ago
  I am even more confused by this comment. How is this propaganda?

ineedasername 6y ago

I'm torn when it comes to the utility of making public indictments of this sort when the truth is there will never be any arrest or trial. Making them public lets Russia know we're aware of their actions, which in turn may drive them to greater efforts to make these actions harder to detect and therefore harder to defend against. I also wonder if making these public, detrimental and unnecessary, is just a cynical ploy before an election to give the appearance that this administration has been tough on Russia, when actual toughness on Russia would mean not just indictments, but also sanctions and other tangible consequences. On the other hand, absent legal accountability for these individuals and Russia itself, making these indictments public allows the rest of the world to see & know what Russia is up to. That might facilitate action through the softer power of diplomacy, and perhaps also put other countries on notice that they must take greater care in protecting their critical systems as well. And if it is the correct choice to do so, then any political benefit, cynically motivated or not, is an ancillary factor. I suppose it may be a tough balance to strike. I think I come down on the side of making these issues public knowledge. Just as I similarly believe bad actions on the part of the US should be available for public scrutiny whenever it does not jeopardize the lives and safety of those who fight for our country.

dx87 6y ago
It could also just be done as a thinly veiled threat to discourage people from working there. Even if nobody is arrested, the statement is basically saying "it doesn't matter where you are, or how secretive your work is, we can find you". I can imagine spouses and family would suggest they start looking for a different job after seeing the announcment.
- SCHiM 6y ago
  Indeed. And as GP said. If you force your adversary to take more precautions you're driving up the cost, increase the time it takes for them to perform operations, makes them need more experienced/educated personnel, more procedures to catch mistakes, etc. etc. That's not a bad thing for Russia's adversaries.
- cameldrv 6y ago

anonu 6y ago

Going through the indictment with a quick read: it seems most of the attacks began as spearfishing. Which goes to show: the human link is still the weakest one.

ancantus 6y ago

There's a fantastic book about this group published recently titled "Sandworm" by Andy Greenberg. https://www.goodreads.com/en/book/show/41436213-sandworm https://www.goodreads.com/en/book/show/41436213-sandworm

Stierlitz 6y ago

Do you really have to give space to this Neocon cyber BS on a respectable tech forum. Cyber BS by people who seem to be desperate to re-start the cold-war. Fortunatly, the Russians won't come out to play. Neither will the Chinese, Iran or North Korea.