5 ms·

Has there been any evidence presented to support the attribution to Russia?

wyldfire 6y ago
Not public AFAIK. But multiple news agencies cite US officials who make the claim it was Cozy Bear / APT29 [1]. Microsoft claims [2], "We believe this is nation-state activity at significant scale ... Because of the sophistication of the techniques and operational security capabilities of the actor, we want to encourage greater scrutiny by the broader community..." [1] https://en.wikipedia.org/wiki/Cozy_Bear https://en.wikipedia.org/wiki/Cozy_Bear [2] https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/ https://blogs.microsoft.com/on-the-issues/2020/12/13/custome...
devin 6y ago
I don't think intelligence agencies are generally keen on revealing their methods, but I understand why you're asking.
jjk166 6y ago
Reuters was the first to claim the attack was attributed to russia based on "3 sources close to the investigation" but presented no evidence. The Washington Post claimed it was specifically APT29/CozyBear, also based on "3 anonymous sources familiar with the hack" with no supporting information. Neither FireEye nor the US government have officially attributed the attack to any state actor, nonetheless russia, though it would be unusual to make an attribution this quickly anyways. FireEye makes no note of any tools used in the hack that have been previously associated with either APT29 or Russia in general. Their countermeasures [0] seem to suggest all injected code was either in english or encrypted, but it would be pretty dumb to leave unencrypted russian (or any other language) text in your hack of a US program. The security group Intel 471 apparently [1] found a russian-language actor trying to sell access to the solarwind network in April 2020, but it is unclear if they actually had that access, if that access was connected with this hack, or if this individual was anything more than a middleman. I just googled the name, and there is a facebook page for someone with no friends or activity who is signed up for a couple of ukrainian groups (a support group for the mayor of a town, a public transit department, etc) so the facebook page is clearly a bot but there may be no association. That's the closest thing I could find to evidence. [0] https://github.com/fireeye/sunburst_countermeasures https://github.com/fireeye/sunburst_countermeasures [1] https://twitter.com/Intel471Inc/status/1339233255741120513 https://twitter.com/Intel471Inc/status/1339233255741120513
fdhfdjkfhdkj 6y ago
Time for some Colon Cancer for Putin

Not public AFAIK. But multiple news agencies cite US officials who make the claim it was Cozy Bear / APT29 [1]. Microsoft claims [2], "We believe this is nation-state activity at significant scale ... Because of the sophistication of the techniques and operational security capabilities of the actor, we want to encourage greater scrutiny by the broader community..." [1] https://en.wikipedia.org/wiki/Cozy_Bear https://en.wikipedia.org/wiki/Cozy_Bear [2] https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-cyberattacks/ https://blogs.microsoft.com/on-the-issues/2020/12/13/custome...

devin 6y ago

I don't think intelligence agencies are generally keen on revealing their methods, but I understand why you're asking.

jjk166 6y ago

Reuters was the first to claim the attack was attributed to russia based on "3 sources close to the investigation" but presented no evidence. The Washington Post claimed it was specifically APT29/CozyBear, also based on "3 anonymous sources familiar with the hack" with no supporting information. Neither FireEye nor the US government have officially attributed the attack to any state actor, nonetheless russia, though it would be unusual to make an attribution this quickly anyways. FireEye makes no note of any tools used in the hack that have been previously associated with either APT29 or Russia in general. Their countermeasures [0] seem to suggest all injected code was either in english or encrypted, but it would be pretty dumb to leave unencrypted russian (or any other language) text in your hack of a US program. The security group Intel 471 apparently [1] found a russian-language actor trying to sell access to the solarwind network in April 2020, but it is unclear if they actually had that access, if that access was connected with this hack, or if this individual was anything more than a middleman. I just googled the name, and there is a facebook page for someone with no friends or activity who is signed up for a couple of ukrainian groups (a support group for the mayor of a town, a public transit department, etc) so the facebook page is clearly a bot but there may be no association. That's the closest thing I could find to evidence. [0] https://github.com/fireeye/sunburst_countermeasures https://github.com/fireeye/sunburst_countermeasures [1] https://twitter.com/Intel471Inc/status/1339233255741120513 https://twitter.com/Intel471Inc/status/1339233255741120513

fdhfdjkfhdkj 6y ago

Time for some Colon Cancer for Putin