Voorlopig even m'n laatste bijdrage op dit vlak (anders maak ik het eentonig), op de vraag wie nou eigenlijk voor al die verwarring, misvattingen en onduidelijkheid zorgt: maak kennis met
'the Vulkan files', een lek door een russische IT consultant die anti-oorlog is - geverifiëerd door 11 verschillende onderzoeksredacties over de hele wereld.
An employee of Russian IT Consultancy Company NTC Vulkan, disgusted by the war, released a trove of documents to the German newspaper ‘Süddeutsche Zeitung’ shortly after the invasion of Ukraine. A consortium of eleven news organizations including ‘Paper Trail Media’ (Germany) and ‘Der Spiegel’ (Germany), ‘Washington Post’ (United States), The Guardian (UK), Le Monde (France), collaborated to analyze the documents. There are 1,000 secret documents that include 5,299 pages full of project plans, instructions and internal emails from Vulkan from the years 2016 to 2021. Despite being in Russian and extremely technical in nature, they provide unique insight into the depths of Russian cyberwarfare plans. Five Western intelligence agencies confirmed the authenticity of the documents. These files are known collectively as ‘the Vulkan Files’ and provide the basis for the identification of Russia’s cyber units.
Hierin stond beschreven wat de russische strategie rondom cyber is:
Russian Cyber Order of Battle (ORBAT)
According to ‘The Washington Post’ “Moscow’s cyberwarriors are not a disparate collection of hackers launching ransomware for quick scores. Instead, they are part of a robust, state-sponsored effort using the full power of the Russian security state and private companies to identify critical targets and enemies’ vulnerabilities.” “The Russian government regards offensive cyber capabilities as part of a holistic effort to degrade its enemies. This includes the sowing of mistrust via social media, the gathering of kompromat (compromising material), and the ability to target crucial infrastructure. That list of enemies is a long one.” “Countries on the “unfriendly countries” list include New Zealand, Australia, EU states, the UK, US, Canada, Ukraine, Singapore, Japan and Taiwan” (and NATO).
De russische overheid doet een beroep op meerdere partijen om deze aanvallen uit te voeren. Onder de GRU vallen onder andere ‘Sandworm’, ‘Fancy Bear’, ‘GhostWriter’, ‘XakNet’, ‘Infoccentr’ en ‘Cyber Army of Russia_reborn’. Intern heeft de GRU ook nog uiteraard Unit 54777, die zich richt op psychologische oorlogsvoering en de media en materialen aandraagt aan de voorgenoemde teams.
Door de buitenlandse inlichtingendienst, SVR RF, worden ‘NOBELIUM’, 'The Dukes' en 'APT29' ingezet. Deze teams hebben, ondanks de andere opdrachtgever, verder dezelfde ROE als die van de GRU.
De federale inlichtendienst, FSB, bevat de interne '18th Center for Information Security' afdeling. Zij huren ‘BeserkBear’, ‘Gamaredon’, ‘Nodaria’ en 'Vovan & Lexus disinformation team' in. Ook houden ze bij welke teams er binnen rusland actief zijn om te voorkomen dat ze goedschiks of kwaadschiks tegen de belangen van rusland handelen.
Dan zijn er nog de commerciële partijen die deze overheidsinstellingen inhuren, hier is ook het een en ander over te vinden:
NTC Vulkan was founded in 2010 by Anton Markov and Alexander Irzhavsky, graduates of St Petersburg military academy and service in the Russian Army. NTC Vulkan, presents itself as a completely normal, IT consulting firm, a small company with software expertise. The company claims “Information security management” as one of its specialties.
Another company supporting Russian cyber operations is the “Internet Research Agency”. It is a private organization, funded by Kremlin-connected oligarch Yevgeniy Prighozin, which has supported Russian government disinformation and propaganda operations. Often referred to as a troll farm or troll factory, this group has focused on disinformation by impersonating domestic activists and people, primarily through various social media channels.
Ook zijn er partijen ontstaan uit gereorganiseerde 'legacy' hacker groepen:
Prior to the invasion, the Conti Ransomware Gang was known as one of the most prolific and successful ransomware organizations globally. It is a young group, first noticed in 2020. Based in Russia, it featured an almost corporate organization as well as its own encryption protocols and malware. Conti was the first ransomware group to declare its support for Russia. Conti appears to have reorganized into smaller teams. It is possible that Conti is working with the FSB and Vulkan, sub-dividing in order to attack more targets. Conti’s new organization is reported to have two types of groups: Fully autonomous groups which focus on stealing data, like Karakurt, BlackBasta, and BlackByte. The other groups are semi-autonomous, which acts as Conti-loyal affiliates within other collectives. This includes AlphV/BlackCat, Hive, HelloKitty/FiveHands, and AvosLocker.
En als laatst zijn er ook nog een vorm van 'reservisten' die zich kunnen aansluiten bij losvaste patriotische hackergroeperingen:
Recruiting of hackers to support Russia was started by the Cuba Ransomware Group and continued by ‘KillNet’. Recruited sub-groups include NoName 057(16), Zarya, Phoenix, Vera, FasoninnGung, Mirai, Jacky, DDoS Gung, Sakurajima, and Sparta. KillNet and its allied groups are best known for Distributed Denial of Service (DDoS) attacks against countries that actively support Ukraine. Russia offers a bounty to these groups if they can prove they disabled a ‘target’ web site.
Alles bij elkaar valt er dus enorm veel te detecteren vanuit de russische zijde van het internet, en al deze inspanningen worden middels het internet zo gecoördineerd dat ze in het westen op vertrouwde kanalen terecht komen.