Hello everyone. Today I'm going to talk about Russian cyber threats in the pandemic era,
how actually Russia has seized upon the global COVID-19 pandemic as an opportunity
to launch its multi-faceted, multi-directional information warfare strategy against its
prospective enemies, how they used their APT groups, criminal groups, to attack healthcare
organization, research institutes, and hospitals in the United States and in European countries.
So before I talk about the hacking and actual disruption, I would like to give you a kind of
an overview how Russia sees information warfare strategy, which kind of agencies are in charge,
and actually what is their doctrine of information warfare, how actually they're
using APT groups and criminal syndicates to achieve their mission. Let me just give you
a kind of an overview how Russian information warfare doctrine works. It is kind of an integrated
system of system that works together. Everything is one under one umbrella, whether it is an
intelligence, counterintelligence, masking something, attacking computer net enemies,
computer networks, and software application. So now, kind of a few years ago, 2018,
artificial intelligence elements was added to its information warfare doctrine. It actually
contains two elements, using artificial intelligence technology in military field
and in non-military field. For example, using AI technology to advance their military capabilities
and using AI technology to advance their capability in the medical field, biotechnology
field, manufacturing, and energy field. So they actually see artificial intelligence as an emerging
tool to secure their strategic interests inside the country and outside the country. Some historical
background, how actually information warfare doctrine was formed. Just I'm going to give you
a short overview. The doctrinal and strategic thinking actually still is rooted in the teaching
of the Russian, of the Marshal of the Soviet Union, Nikolai Ogarko, in what he referred to
as the military technical revolution. A brief restatement of his thesis is that computers with
accuracy and miniaturization were about to transform the modern battlefield, and that's Americans are
ahead in this respect, and we really have to do something about it because we're falling behind.
So another also event affected the formation of the Russian information warfare doctrine
and its subset of cyber warfare. They declared the first and second Gulf War as a war on
military technical revolution. But then fast forward, there was the Alsin's year, and in this
year's theories actually developed theories rather than building machines, writing softwares,
and running operations. And fast forward, there were a couple of other events, but a couple of
years ago, Chief of the General Staff, current Chief of the General Staff, Valery Gerasimov,
published an article in one of the military newspapers that actually was dubbed as the
Gerasimov Doctrine in the Western press, but actually he's saying that in a matter of months,
a perfectly thriving state can be turned into a web of chaos. So they see information warfare
and its subset of cyber warfare to achieve their objective in a various direction, whether it's a
political direction, or in the military direction, or in any other field. So let me just give you
a couple of kind of example, which are major players in this respect, which organizations
are having major, having upper hands actually, in information warfare, and in subset of cyber
warfare. I'm going to give you a small historical overview about this. Actually in 2003,
when since Putin came to power in a couple of years, he actually disbanded the FOPC, Federal
Agency for Government Communication and Information. This agency was in charge of
the military intelligence code cracking, cryptographic security, technical intelligence,
counterintelligence. And once it was disbanded, so some of its functions went to those organizations,
Federal Protective Service, FSO, Federal Security Service, FSB, MVDK, there is a Ministry of
Internal Affairs of Russia, SVR, Foreign Intelligence, and GRU, Russian Military
Intelligence. What is also very important here is that a large portion of the FOPC that was
left after the organization was renamed the Special Communication and Information Services,
was folded into the FSB. So all of those organizations have their part in information
warfare doctrine. What is also very important here is that the leading role in this respect
has a Russian military GRU, and the Russian Federal Security Service, FSB. So here is a kind
of a, you know, structured Jerry's research, how actually Jerry's research institutes and units
are participating in an information warfare, cyber warfare efforts. Let me just give you
kind of an overview about those central research institutes and units.
So Defense Ministry's 45th Center, Central Research Institute, it's a military unit
54726. Those units actually are in charge of the fighting, finding intelligence about the
military potentials of the foreign countries. Another unit here is the MOD Centers, Ministry
of Defense Center for Special Studies. Those centers, they are hiring students from engineering
schools, they are in charge of analyzing, exploiting, finding vulnerabilities in the
computer system. By the way, what is also very important is Evgeny Serebryakov, who was actually
was expelled from Netherlands in 2018. He, because he was trying to hack into the OPCW,
OPCW is Organization for Prohibition of Chemical Weapons. It's a UN chemical
watchdog organization. They were about to craft a report about the poisoning substance that was used
against double agent Sergey Kripal and her daughter Yulia, as well as we were about to
craft a report on the chemical substance that was used in Duomo, Syria.
So we actually wanted to find out what this report was about before its release. Another also
major player is MOD's Division, 12th B Division that is in charge of the cyber operation and
psychological operation. Let me just talk a little bit about 18 Central Research Institute and its
unit, 11135. Those folks are in charge of the signals intelligence. They are also in charge
of development of wireless devices, SCADA system, or electromagnetic protection system.
And what is also very important, that's 85 Central Research Institute, it's unit 26165,
main center for special technology, and it's unit 7445. Those two units are the major,
biggest repository of hacker talents. And those units together, all of them together,
actually formed APT28. This is the most persistent threat group. There is also
known as a fancy beer and has also other names. And they are using, of course, the hackers or
forces for their hacking activities. I'm going to talk a little bit later about the GUNID
and the Technopolis era, what kind of laboratories they have, including the
biotech labs and what kind of projects actually they're implementing.
So another also kind of the development that's happened in the Russian military
is that in 2017, they officially announced about the formation of the military scientific units,
also called information warfare troops. And what is also important, that's the
Ministry of Defense of Russia officially made a statement about the formation of this unit.
And he made openly or said that those units not only will be in charge of the securing command
and control and communication of the Russian military, or building, developing software for
the National Defense Control Center, there is the high supreme body that's responsible for
Defense Ministry's supervision and management, but those guys also will be in charge of the
psychological operation. That's once again, illustrates how actually Russia sees this
information warfare doctrine, the concept of the security, a concept of the compartmentalization
and the idea of the cyber as a separate domain, I mean, doesn't exist in the Russian concept.
What is also very important, that's so new warriors of this military scientific units,
about 1,000 personnel are incorporated those units. So they are the engineers,
they are cryptographers, they are signalers, they are linguists, they are doctors, they are scientists.
So let me just move a little bit and I'll just talk about the Technopolis era.
Technopolis era was opened in 2018. And according to the official sources, they want to make it
fully operational by the end of 2020. Era stands as a little Russian armies. And now they are
planning actually, to move these military scientific units, the 12th of those units that
was created in 2018 on the permanent basis at Technopolis era. It is also believed that
those military scientific units are the arms of the GRU Russian military, Russian military
intelligence. So eight major directions that they are working, information telecommunication,
supercomputers, information in the cyber security, technical visions, energy technology,
nanotechnologies, nanomaterials. But what is also very important, they're putting a lot of
efforts, financial resources, and human resources into the field of bioengineering, biosynthetic,
biosensor technologies. What is also one of the major mission of the Technopolis era is actually
finding information about other countries, what other countries actually countries are doing
in this respect in this field in this direction. So another, let me just talk a little bit about
the kind of who is coordinating the Technopolis era, I mean, officially is coordinated by GUNID.
This is the General Directorate for Research and Development and Technological Support of
Advanced Technologies. They are cooperating with defense-related enterprises and over
200 scientific organizations, universities, Russian Academy of Science have agreement with
the Technopolis era. Some of those and many actually not some quite, you know, over 40,
45 scientific organization and defense-related enterprises, they have permanent representation
at the Technopolis era. Let me just talk about a little bit about the labs. They have 18 labs
there and they're working actually about, and I'm going to talk about the projects in tech,
in terms of the field of biotech. They are working in a 3D bioprinting,
lab-growing leading tissues and bone tissues. They are working on the machine learning
technologies in their healthcare for the diagnosing and treatment of illness.
Telesurgeries, working on the medical robotics and multimedia image communication
in silico clinical trials and drug testing is one of their major direction using
computer models and simulation to develop and assess drugs and
devices. What is also very important that they are putting a lot of effort on the portable
biological reconnaissance device. This is, they're working a lot of efforts about biosensor device
designed to detect pathogens of dangerous infections, diseases, and viruses. And one
of the major direction of the Technopolis era is the biological intelligence. They are developing
devices, biosensor devices, and they are also putting a lot of efforts about biological
intelligence. Actually, they are concerned about the research activities conducted by foreign
research institutions because they kind of feel that a problem needs on appropriate reconnaissance
in this respect, according to the statement of various government officials in Russia.
So, the kind of, you know, the hallmark stealing the intellectual properties
from, that was the signature of the Chinese APD groups, now we'll see that's what this will be
incorporated by the Russian APD groups. And we see already some science, actually,
in this respect. So, kind of interesting information. It's kind of a breaking news.
Just recently, a few days ago, the Russian Ministry of Defense actually made a statement,
where it's also, you know, very important to underline here is that together with the Gamaley
Scientific Research Institute of Epidemiology and Microbiology, they said that they successfully
completed the trial of the COVID-19 vaccine. And, by the way, the First Minister of the...
Deputy Minister of the Defense made a statement about this, that vaccine is actually ready and
ready for distribution. Interesting information. Let me just talk a little bit about the
about the FSB's role in this respect in the field of the information warfare and its subset of the
cyber warfare. There are a lot of scientific and technical centers here in the units, but I'm
going to, you know, talk about two major units that are in charge of the cyber operation. So,
one is the unit of 7-1-1-3-3-0 and 7-6-4-8-2-9. They are under 2nd Directorate and 16th Directorate.
So, those two centers are in charge, these units are in charge of the cyber. They are,
they have a very high cyber intelligence capabilities, and they're in charge of
offensive information operation outside of Russia. So, and inside of Russia. So, unit
of 18th Information Center, also in charge of the SORM system. Let me just give you kind of a
overview about the SORM system. SORM is a System of Operating Investigative Measures,
the kind of a surveillance system that's now all the ISPs are required legally to install the
system. This is a very sophisticated system that captures all the digital and mobile communication
and captures online communication, full recording of conversation, and as well as the content of
email, text, and the communication. So, for online communication, for example, it taps to
the network of the internet service providers through a rerouting devices called black boxes
and high-speed communication lines. And by the way, it has a real-time monitoring capabilities.
So, here is a couple of examples of what kind of the projects they are implementing,
on which I'm going to talk on my next slides. They're also actually in charge of the hacker
resolve forces. Imagine having resolve forces that you don't pay anything, you don't train,
they train themselves, they pay themselves, and they do business for the intelligence services
in Russia. And of course, they form IPD-29 group, also hacking group, nation-sponsored group.
There is... has also different names, Kozytuk and Miniduk, et cetera, et cetera.
Let me just talk about this project that's the Siloviki, the people of power,
Russian intelligence services that are in charge. For example, the contracting organizations
that were outsourced by the security services in Russia, were hacked a couple of years ago,
and the last year as well. And all those projects, actually, they revealed on the net.
One is an Otillus project that was about to collect information on social media about users.
Another is an Otillus S, that was about the de-anonymizing toward traffic using rogue
servers. By the way, a couple of years ago, I mean, one or two years ago, 25 of those kind
of rogue servers was identified, and 18 of which actually were located in Russia.
They are also using the so-called scientific institute think tanks for their project.
One of the think tank, a pretty well-known think tank in Russia is called Quantis FSB
think tank, and they also were in charge of developing software to detect protest mode
among the population. Just a year ago, there was another leak that they were, that was
hackers exposed, that's FSB IoT botnet project called Fronton. And so, leak document actually
showed that the procurement order actually was placed by the FSB unit 64829. So,
and let me just give you kind of a quick overview about the growing complexity of outsourcing and
why Russia used very sophisticated outsourcing strategy. Because it's confound attribution,
and it's also very cost effective for them. And so, let me just see, give you the whole
scenario how it works. The idea actually comes from the government. And so, then the government
actually is in charge from the beginning of the whole commanding control process. Then the project
manager is assigned, and project management does the compartmentalization process. So, tasks are
broken into pieces. And so, then people in the middle, they are also outsourcing hackers from
other countries, and subcontracting those hackers from, you know, Ukraine, from the United States,
from China, and from other countries. So, people here, third parties, they actually don't know
from there the original order actually comes. Then money changes hands, and this is how the
whole operation does. So, if you want to just find out who is behind this or that project,
it's very, very hard to just solve the attribution problem actually in this respect.
So, what we saw during this pandemic time, the Kremlin information warfare was used with full
its capacity. They use the cyber elements, they use their disinformation elements, and
they use all the components of the information warfare. So, they spread the malicious content,
malicious information, they used the conventional media outlets, they used their scientists,
they used trolls, they used the channels, non-conventional channels, for example, to
spread this information, not only in English and in Russian, but in various languages.
And by the way, when I just did research about this, the views and shares of those information,
it was into hundreds of thousands and into millions. But it's nothing new. So, this kind
of spreading false narratives, I mean, it's all tactics, this Russian military, and not only
Russian military, FSB and general intelligence organizations were using in the past. For
example, in the 1950s, the Soviet military intelligence created this rogue fake reports
that the US used biological weapons in Korea, supposedly dropping bombs filled with insects and
rats infected with cholera and plague. As well as, for example, in the later 1980s,
Soviet spies spread false narratives that AIDS epidemic started from an experiment
at a secret military biological lab in the US. They're also spreading the false narratives about
scientific institutions and labs in other countries. Supposedly, they are creating
biological weapons or something like this. So, in March and April, there was a couple of
reports published in this respect, how Russians were using APT groups, cyber criminal syndicates
to hack into the research facilities, hospitals, and what kind of strategies,
methodologies and TTPs were they're using. Now, just recently was published UK's National
Cyber Security Advisory Stats. They openly said that APT29 group that is associated with
FSB, Russian Federal Security Service, that APT29 is attempting to steal information on
coronavirus research, targeting pharmaceutical companies, healthcare, academic research
centers. So, all aspects, actually, of information warfare elements was used. As I mentioned,
they used the conventional media, anonymous outlets, the cyber components, they tried to...
they created a fake coronavirus tracking web, fake coronavirus application,
ransomware targeting the healthcare system, on which I'm going to talk in detail in my
next slides, targeting the VPN system, remote working tools and softwares.
So, here is actually a couple of examples. Now, what kind of fake bogus emails they are crafting,
mimicking, that's the legit organizations such as the World Health Organization, CDC,
and other government agencies, and the government agencies as well. For example,
cyber criminals in UK also use the SMS phishing strategy. Here is a screen.
They're sending to the UK resident that UK government has issued a payment of over 400
pounds to a resident, and you have to just click to this link. And once you click to this link,
it actually asks you the national registration number, as well as other information,
banking information. The fake Android application also was created, was removed from the Google
Play. So, what actually, I'm going to talk about the fake life map that resembles Johns Hopkins
University tracking coronavirus infographic map. I'm going to talk about this in more detail
in my next slides. So, what we also saw during this period, that's over the 1.2 million newly
registered domains were created, and over 85,000 domains were classified as risky or malicious.
Okay, here is the one of the criminal group called Sarin RPB, as well as Ravel. This group
has a very heavy presence on XSS forum. This group launches, actually,
competition for developing exploits for zero days, writing crypto algorithms, and other kind
of a task that they post on this website, and they pay money. For example, the one of the competition
was about $15,000. This, what is also very important, that they are also in,
someone in February, we're already discussing the methods to deliver malware, where an email
attachment then later was embedded into the COVID-19 Johns Hopkins infographic map. They
also were selling the variants of malwares that later was embedded into the fake map.
And for example, if you just opened it, it downloaded malicious code into your system.
It collected information from the infected computer and send this information to the
command and control server. By the way, this group is a human-operated ransomware group.
What actually does it mean? The attack doesn't happen in an automated fashion, but instead,
they are compromising internet-facing devices in order to establish presence in a vulnerable
system, and later then execute attacks, steal information, and encrypt information on the
victim's data. They were exploiting vulnerabilities in remote desktop protocols,
vulnerabilities in the operating soundpatch operating system, misconfigured servers,
as well as the electronic health record software. What is also important is for their operation,
they use the Mimikatz. Mimikatz is a leading exploitation tool that actually dumps the
passports from memory. This organization, this criminal organization actually also
attacks one of the biotech companies that is based in California.
What is also very important here is that they are not only interested in stealing
intellectual properties from the biotech companies in the United States or in European countries,
but also they were trying to gain some financial... they are launching cyberattacks for this
financial gain, pure financial gains. For example, they attacked a New York law firm,
and this is one of the prominent, very well-known law firm that has a very high level clientele,
and asked for a ransom. So, I already said that Russian
DeepWebForum, DocWebForum, HackerForum were very busy during this time period. A lot of
discussions were going on on those forums, even selling the variants of malwares, discussing the
methodologies about how to embed malicious code into the email, and some other... and the COVID-19
issue was very highly discussed, and all of these TTPs and methodologies on those forums. As I
mentioned, that's already in one of those forums, we were offering malware for sale that later was
inserted into email attachment, resembling the fake COVID-19 map. So, those DarkWebForum are
also... there are a lot of other, you know, DarkForum and HackerForum, actually, that are
on the Ru domains and the Su domains. If you don't know what is a Su domain, it's an old Soviet Union
domain, it actually has over 120,000 registered domains there. So, yeah, a lot of interesting
information could have been... you could... one can gather from those forums, and it gives you
kind of a good understanding of what they are up to, what they are planning, what kind of strategies
they are discussing
for future attacks.
So, another also group that was very active during this period was a HADES group.
This group is associated with the Russian military...
Russian military GRU with APT28 group, also called Defense CBSN, or Voodoo Beer Telebot,
and it has also some other names as well. So, those... they were using the phishing email
campaign, mimicking World Health Organization and the
Ministry of Health of Ukraine. They were sending... here is a, you know, example what kind of
emails they were sending to the organizations
in Ukraine, and not only in Ukraine, where most of this group was active in European countries,
in particular, heavily active in Ukraine. And once you, you know, open this file, it's
downloaded malicious macro code to perform the remote control.
Another also group that was very active during this time was a Gamma Radon. This is the FSB group.
This... they also targeted the organization, you know, they targeted scientific research centers,
hospitals, all over the Western countries. This group is associated with FSB 16th and
18th Centers as the under second and 16th Directorate of FSB, active since 2013,
attacking Ukraine since 2014. So once you actually open the document, it started a
template injection technique, so for the... for loading the document templates from the internet.
And once the document was downloaded, it executed that malicious macro code,
code which executed the VBS... VBS scripts. So here is actually
a... IP addresses are from the Russian hosting companies. Those IP addresses that's... this group
is used for network destination or template injection and network destination for VBS script.
So another also organization that was a cyber criminal group that was very active during this
time, but that was group Russian ransomware group called MACE. This group used a variety
of techniques by exploiting known vulnerabilities that was not... haven't been patched, remote
desktop connection with a weak password. They used malicious emails or the links.
They attacked not only the
research institutes, scientific centers, but as well as they also attacked, for example,
IT service providers company that does provide this kind of services for the healthcare industries
and manufacturing. And in March, they attacked the Hammersmith
Medicines Research Center in UK. So this center was before involved with an Ebola solution and
working with COVID-19 vaccine. So what is also very important about this ransomware group that
this group is as not kind of typical data encrypting ransomware. So it doesn't infect
and encrypt computers in every computer that is in its path, but also it is extracting
information and data to the attacker servers. So let me just talk a little bit about the
RealWeek. This is another Russian hacking group. This hacking group also attacked hospitals
and in Europe and the United States, for example, they attacked the second largest hospital in
Czech Republic in Brno. They, before the pandemic, they actually attacked the hospitals in Alabama
and they asked for the big ransom to decrypt them and unlock medical data. This ransomware is
typically, you know, they actually already get into the compromise system. For example,
they used, in this respect, the Immortal and TrickBot. The Immortal is a model that
originally actually was created for the banking trojan designed to steal information. And once
the system was infected, then their payload was dropped into the system and executed. And
it's actually an encryption process actually started and they were asking the ransom
for, to decrypt the data back. So for attack factors, they are trying to find vulnerabilities
into the system, remote desktop protocol and poorly secured RDP ports. They use the phishing
email, sending a malicious bugless email to trick legit organizations to download these emails
in open and download documents from this organization, tricking actually
legitimate organizations. So this is actually what I wanted to talk, how actually Russians use
their information warfare strategy. It's elements of cyber warfare during this pandemic
time. Of course, I just would like to talk to you a little bit about the mitigation strategy. And we
also talk a lot of countermeasures, our community, how actually what kind of steps should be taken
in order to secure system, to diminish risk, to decrease risk in this respect. Of course,
important factor is that to assess the supply chain. That's a supply chain contamination is
a big problem in this respect. Unpatched system was exploited by those hackers. Of course, it's
very important having them to implement a multi-factor authentication methods,
as well as train the staff in this respect. But what is also very important here, and in most
cases, nobody talks about putting the threat intelligence into the mitigation strategy.
For example, before the pandemic, all of those Russian forums were discussed,
all of those methodologies and selling the malwares on those forums. I think that's
observing what's going on, on a dark web, deep web, Russian hacking forums. It must be
included in a mitigation strategy, because it gives you a pretty good understanding what we
are up to and what we are planning in the future. So, thank you very much. I hope you'll find this
presentation very interesting, and I'm looking forward to a Q&A section. Thank you.