WEBVTT 00:00.000 --> 00:00.940 Hello everyone. 00:00.940 --> 00:17.460 Today I'm going to talk about Russian cyber threats in the pandemic era, how actually Russia has seized upon the global COVID-19 pandemic as an opportunity to launch its multi-faceted, multi-directional information warfare strategy against its prospective enemies, 00:17.460 --> 00:34.140 how they used their APT groups, criminal groups, to attack healthcare organization, research institutes, and hospitals in the United States and in European countries. 00:34.140 --> 01:06.400 So before I talk about the hacking and actual disruption, I would like to give you a kind of an overview how Russia sees information warfare strategy, which kind of agencies are in charge, and actually what is their doctrine of information warfare, how actually they're using APT groups and criminal syndicates to achieve their mission. 01:06.400 --> 01:12.480 Let me just give you a kind of an overview how Russian information warfare doctrine works. 01:12.480 --> 01:16.200 It is kind of an integrated system of system that works together. 01:16.200 --> 01:27.900 Everything is one under one umbrella, whether it is an intelligence, counterintelligence, masking something, attacking computer net enemies, computer networks, and software application. 01:27.900 --> 01:39.620 So now, kind of a few years ago, 2018, artificial intelligence elements was added to its information warfare doctrine. 01:39.620 --> 01:50.220 It actually contains two elements, using artificial intelligence technology in military field and in non-military field. 01:50.220 --> 02:07.780 For example, using AI technology to advance their military capabilities and using AI technology to advance their capability in the medical field, biotechnology field, manufacturing, and energy field. 02:07.780 --> 02:17.980 So they actually see artificial intelligence as an emerging tool to secure their strategic interests inside the country and outside the country. 02:17.980 --> 02:23.340 Some historical background, how actually information warfare doctrine was formed. 02:23.500 --> 02:26.380 Just I'm going to give you a short overview. 02:26.380 --> 02:40.040 The doctrinal and strategic thinking actually still is rooted in the teaching of the Russian, of the Marshal of the Soviet Union, Nikolai Ogarko, in what he referred to as the military technical revolution. 02:40.040 --> 02:55.760 A brief restatement of his thesis is that computers with accuracy and miniaturization were about to transform the modern battlefield, and that's Americans are ahead in this respect, and we really have to do something about it because we're falling behind. 02:55.760 --> 03:04.400 So another also event affected the formation of the Russian information warfare doctrine and its subset of cyber warfare. 03:04.400 --> 03:11.440 They declared the first and second Gulf War as a war on military technical revolution. 03:11.620 --> 03:23.280 But then fast forward, there was the Alsin's year, and in this year's theories actually developed theories rather than building machines, writing softwares, and running operations. 03:23.700 --> 03:45.980 And fast forward, there were a couple of other events, but a couple of years ago, Chief of the General Staff, current Chief of the General Staff, Valery Gerasimov, published an article in one of the military newspapers that actually was dubbed as the Gerasimov Doctrine in the Western press, 03:45.980 --> 03:53.800 but actually he's saying that in a matter of months, a perfectly thriving state can be turned into a web of chaos. 03:54.480 --> 04:13.860 So they see information warfare and its subset of cyber warfare to achieve their objective in a various direction, whether it's a political direction, or in the military direction, or in any other field. 04:13.860 --> 04:37.500 So let me just give you a couple of kind of example, which are major players in this respect, which organizations are having major, having upper hands actually, in information warfare, and in subset of cyber warfare. 04:37.500 --> 04:40.940 I'm going to give you a small historical overview about this. 04:40.940 --> 04:56.440 Actually in 2003, when since Putin came to power in a couple of years, he actually disbanded the FOPC, Federal Agency for Government Communication and Information. 04:56.440 --> 05:05.500 This agency was in charge of the military intelligence code cracking, cryptographic security, technical intelligence, counterintelligence. 05:05.500 --> 05:25.400 And once it was disbanded, so some of its functions went to those organizations, Federal Protective Service, FSO, Federal Security Service, FSB, MVDK, there is a Ministry of Internal Affairs of Russia, SVR, Foreign Intelligence, and GRU, Russian Military Intelligence. 05:25.400 --> 05:38.080 What is also very important here is that a large portion of the FOPC that was left after the organization was renamed the Special Communication and Information Services, was folded into the FSB. 05:38.080 --> 05:42.940 So all of those organizations have their part in information warfare doctrine. 05:42.940 --> 05:53.360 What is also very important here is that the leading role in this respect has a Russian military GRU, and the Russian Federal Security Service, FSB. 05:53.360 --> 06:09.160 So here is a kind of a, you know, structured Jerry's research, how actually Jerry's research institutes and units are participating in an information warfare, cyber warfare efforts. 06:09.160 --> 06:18.900 Let me just give you kind of an overview about those central research institutes and units. 06:18.900 --> 06:27.520 So Defense Ministry's 45th Center, Central Research Institute, it's a military unit 54726. 06:27.740 --> 06:37.700 Those units actually are in charge of the fighting, finding intelligence about the military potentials of the foreign countries. 06:37.700 --> 06:46.300 Another unit here is the MOD Centers, Ministry of Defense Center for Special Studies. 06:46.300 --> 07:02.400 Those centers, they are hiring students from engineering schools, they are in charge of analyzing, exploiting, finding vulnerabilities in the computer system. 07:02.400 --> 07:10.680 By the way, what is also very important is Evgeny Serebryakov, who was actually was expelled from Netherlands in 2018. 07:11.120 --> 07:19.240 He, because he was trying to hack into the OPCW, OPCW is Organization for Prohibition of Chemical Weapons. 07:19.240 --> 07:22.300 It's a UN chemical watchdog organization. 07:22.300 --> 07:43.680 They were about to craft a report about the poisoning substance that was used against double agent Sergey Kripal and her daughter Yulia, as well as we were about to craft a report on the chemical substance that was used in Duomo, Syria. 07:44.060 --> 07:49.820 So we actually wanted to find out what this report was about before its release. 07:49.820 --> 08:01.640 Another also major player is MOD's Division, 12th B Division that is in charge of the cyber operation and psychological operation. 08:01.820 --> 08:09.100 Let me just talk a little bit about 18 Central Research Institute and its unit, 11135. 08:09.100 --> 08:14.080 Those folks are in charge of the signals intelligence. 08:14.100 --> 08:22.360 They are also in charge of development of wireless devices, SCADA system, or electromagnetic protection system. 08:22.660 --> 08:35.060 And what is also very important, that's 85 Central Research Institute, it's unit 26165, main center for special technology, and it's unit 7445. 08:35.060 --> 08:42.880 Those two units are the major, biggest repository of hacker talents. 08:42.920 --> 08:48.540 And those units together, all of them together, actually formed APT28. 08:48.540 --> 08:50.940 This is the most persistent threat group. 08:50.940 --> 08:58.300 There is also known as a fancy beer and has also other names. 08:58.300 --> 09:05.020 And they are using, of course, the hackers or forces for their hacking activities. 09:05.020 --> 09:16.380 I'm going to talk a little bit later about the GUNID and the Technopolis era, what kind of laboratories they have, including the biotech labs and what kind of projects actually they're implementing. 09:17.600 --> 09:33.460 So another also kind of the development that's happened in the Russian military is that in 2017, they officially announced about the formation of the military scientific units, also called information warfare troops. 09:33.460 --> 09:45.940 And what is also important, that's the Ministry of Defense of Russia officially made a statement about the formation of this unit. 09:45.940 --> 10:10.040 And he made openly or said that those units not only will be in charge of the securing command and control and communication of the Russian military, or building, developing software for the National Defense Control Center, there is the high supreme body that's responsible for Defense Ministry's supervision and management, 10:10.040 --> 10:14.440 but those guys also will be in charge of the psychological operation. 10:14.440 --> 10:28.840 That's once again, illustrates how actually Russia sees this information warfare doctrine, the concept of the security, a concept of the compartmentalization and the idea of the cyber as a separate domain, I mean, doesn't exist in the Russian concept. 10:29.660 --> 10:39.360 What is also very important, that's so new warriors of this military scientific units, about 1,000 personnel are incorporated those units. 10:39.360 --> 10:46.920 So they are the engineers, they are cryptographers, they are signalers, they are linguists, they are doctors, they are scientists. 10:47.240 --> 10:55.380 So let me just move a little bit and I'll just talk about the Technopolis era. 10:55.380 --> 11:01.560 Technopolis era was opened in 2018. 11:01.560 --> 11:10.300 And according to the official sources, they want to make it fully operational by the end of 2020. 11:10.300 --> 11:13.160 Era stands as a little Russian armies. 11:13.160 --> 11:28.620 And now they are planning actually, to move these military scientific units, the 12th of those units that was created in 2018 on the permanent basis at Technopolis era. 11:28.620 --> 11:37.800 It is also believed that those military scientific units are the arms of the GRU Russian military, Russian military intelligence. 11:37.800 --> 11:50.580 So eight major directions that they are working, information telecommunication, supercomputers, information in the cyber security, technical visions, energy technology, nanotechnologies, nanomaterials. 11:50.580 --> 12:02.720 But what is also very important, they're putting a lot of efforts, financial resources, and human resources into the field of bioengineering, biosynthetic, biosensor technologies. 12:03.080 --> 12:19.440 What is also one of the major mission of the Technopolis era is actually finding information about other countries, what other countries actually countries are doing in this respect in this field in this direction. 12:21.160 --> 12:36.400 So another, let me just talk a little bit about the kind of who is coordinating the Technopolis era, I mean, officially is coordinated by GUNID. 12:36.400 --> 12:42.400 This is the General Directorate for Research and Development and Technological Support of Advanced Technologies. 12:42.400 --> 12:53.540 They are cooperating with defense-related enterprises and over 200 scientific organizations, universities, Russian Academy of Science have agreement with the Technopolis era. 12:53.540 --> 13:07.980 Some of those and many actually not some quite, you know, over 40, 45 scientific organization and defense-related enterprises, they have permanent representation at the Technopolis era. 13:08.060 --> 13:11.480 Let me just talk about a little bit about the labs. 13:11.480 --> 13:24.520 They have 18 labs there and they're working actually about, and I'm going to talk about the projects in tech, in terms of the field of biotech. 13:24.520 --> 13:32.300 They are working in a 3D bioprinting, lab-growing leading tissues and bone tissues. 13:32.300 --> 13:42.460 They are working on the machine learning technologies in their healthcare for the diagnosing and treatment of illness. 13:42.540 --> 14:03.440 Telesurgeries, working on the medical robotics and multimedia image communication in silico clinical trials and drug testing is one of their major direction using computer models and simulation to develop and assess drugs and devices. 14:03.560 --> 14:11.040 What is also very important that they are putting a lot of effort on the portable biological reconnaissance device. 14:11.040 --> 14:24.660 This is, they're working a lot of efforts about biosensor device designed to detect pathogens of dangerous infections, diseases, and viruses. 14:24.660 --> 14:29.840 And one of the major direction of the Technopolis era is the biological intelligence. 14:29.840 --> 14:44.680 They are developing devices, biosensor devices, and they are also putting a lot of efforts about biological intelligence. 14:44.680 --> 15:06.480 Actually, they are concerned about the research activities conducted by foreign research institutions because they kind of feel that a problem needs on appropriate reconnaissance in this respect, according to the statement of various government officials in Russia. 15:06.540 --> 15:28.460 So, the kind of, you know, the hallmark stealing the intellectual properties from, that was the signature of the Chinese APD groups, now we'll see that's what this will be incorporated by the Russian APD groups. 15:28.460 --> 15:32.060 And we see already some science, actually, in this respect. 15:32.060 --> 15:34.900 So, kind of interesting information. 15:34.900 --> 15:36.760 It's kind of a breaking news. 15:36.760 --> 16:01.540 Just recently, a few days ago, the Russian Ministry of Defense actually made a statement, where it's also, you know, very important to underline here is that together with the Gamaley Scientific Research Institute of Epidemiology and Microbiology, they said that they successfully completed the trial of the COVID-19 vaccine. 16:01.700 --> 16:04.380 And, by the way, the First Minister of the... 16:05.300 --> 16:14.740 Deputy Minister of the Defense made a statement about this, that vaccine is actually ready and ready for distribution. 16:15.520 --> 16:18.220 Interesting information. 16:18.220 --> 16:30.920 Let me just talk a little bit about the about the FSB's role in this respect in the field of the information warfare and its subset of the cyber warfare. 16:31.080 --> 16:39.740 There are a lot of scientific and technical centers here in the units, but I'm going to, you know, talk about two major units that are in charge of the cyber operation. 16:39.740 --> 16:49.060 So, one is the unit of 7-1-1-3-3-0 and 7-6-4-8-2-9. 16:49.060 --> 16:53.500 They are under 2nd Directorate and 16th Directorate. 16:53.580 --> 17:03.080 So, those two centers are in charge, these units are in charge of the cyber. 17:03.080 --> 17:11.960 They are, they have a very high cyber intelligence capabilities, and they're in charge of offensive information operation outside of Russia. 17:11.960 --> 17:14.420 So, and inside of Russia. 17:14.420 --> 17:23.180 So, unit of 18th Information Center, also in charge of the SORM system. 17:23.180 --> 17:26.840 Let me just give you kind of a overview about the SORM system. 17:26.840 --> 17:37.740 SORM is a System of Operating Investigative Measures, the kind of a surveillance system that's now all the ISPs are required legally to install the system. 17:37.740 --> 17:55.480 This is a very sophisticated system that captures all the digital and mobile communication and captures online communication, full recording of conversation, and as well as the content of email, text, and the communication. 17:55.620 --> 18:09.780 So, for online communication, for example, it taps to the network of the internet service providers through a rerouting devices called black boxes and high-speed communication lines. 18:09.920 --> 18:14.180 And by the way, it has a real-time monitoring capabilities. 18:14.620 --> 18:23.520 So, here is a couple of examples of what kind of the projects they are implementing, on which I'm going to talk on my next slides. 18:23.520 --> 18:26.980 They're also actually in charge of the hacker resolve forces. 18:27.360 --> 18:41.480 Imagine having resolve forces that you don't pay anything, you don't train, they train themselves, they pay themselves, and they do business for the intelligence services in Russia. 18:41.480 --> 18:50.440 And of course, they form IPD-29 group, also hacking group, nation-sponsored group. 18:50.440 --> 18:57.520 There is... has also different names, Kozytuk and Miniduk, et cetera, et cetera. 18:57.520 --> 19:11.240 Let me just talk about this project that's the Siloviki, the people of power, Russian intelligence services that are in charge. 19:11.240 --> 19:25.660 For example, the contracting organizations that were outsourced by the security services in Russia, were hacked a couple of years ago, and the last year as well. 19:25.660 --> 19:29.980 And all those projects, actually, they revealed on the net. 19:30.180 --> 19:37.520 One is an Otillus project that was about to collect information on social media about users. 19:37.520 --> 19:43.740 Another is an Otillus S, that was about the de-anonymizing toward traffic using rogue servers. 19:44.240 --> 19:56.700 By the way, a couple of years ago, I mean, one or two years ago, 25 of those kind of rogue servers was identified, and 18 of which actually were located in Russia. 19:57.460 --> 20:04.060 They are also using the so-called scientific institute think tanks for their project. 20:04.060 --> 20:24.220 One of the think tank, a pretty well-known think tank in Russia is called Quantis FSB think tank, and they also were in charge of developing software to detect protest mode among the population. 20:24.220 --> 20:36.980 Just a year ago, there was another leak that they were, that was hackers exposed, that's FSB IoT botnet project called Fronton. 20:36.980 --> 20:48.800 And so, leak document actually showed that the procurement order actually was placed by the FSB unit 64829. 20:49.020 --> 21:03.720 So, and let me just give you kind of a quick overview about the growing complexity of outsourcing and why Russia used very sophisticated outsourcing strategy. 21:03.720 --> 21:11.900 Because it's confound attribution, and it's also very cost effective for them. 21:11.900 --> 21:17.040 And so, let me just see, give you the whole scenario how it works. 21:17.040 --> 21:19.640 The idea actually comes from the government. 21:19.800 --> 21:30.480 And so, then the government actually is in charge from the beginning of the whole commanding control process. 21:30.480 --> 21:37.660 Then the project manager is assigned, and project management does the compartmentalization process. 21:37.960 --> 21:42.280 So, tasks are broken into pieces. 21:42.280 --> 21:59.800 And so, then people in the middle, they are also outsourcing hackers from other countries, and subcontracting those hackers from, you know, Ukraine, from the United States, from China, and from other countries. 21:59.800 --> 22:06.980 So, people here, third parties, they actually don't know from there the original order actually comes. 22:06.980 --> 22:12.960 Then money changes hands, and this is how the whole operation does. 22:12.960 --> 22:24.600 So, if you want to just find out who is behind this or that project, it's very, very hard to just solve the attribution problem actually in this respect. 22:25.560 --> 22:36.500 So, what we saw during this pandemic time, the Kremlin information warfare was used with full its capacity. 22:36.500 --> 22:47.180 They use the cyber elements, they use their disinformation elements, and they use all the components of the information warfare. 22:47.320 --> 23:10.240 So, they spread the malicious content, malicious information, they used the conventional media outlets, they used their scientists, they used trolls, they used the channels, non-conventional channels, for example, to spread this information, not only in English and in Russian, 23:10.240 --> 23:13.020 but in various languages. 23:13.760 --> 23:24.240 And by the way, when I just did research about this, the views and shares of those information, it was into hundreds of thousands and into millions. 23:24.320 --> 23:26.320 But it's nothing new. 23:26.440 --> 23:40.440 So, this kind of spreading false narratives, I mean, it's all tactics, this Russian military, and not only Russian military, FSB and general intelligence organizations were using in the past. 23:40.440 --> 24:02.540 For example, in the 1950s, the Soviet military intelligence created this rogue fake reports that the US used biological weapons in Korea, supposedly dropping bombs filled with insects and rats infected with cholera and plague. 24:02.620 --> 24:13.920 As well as, for example, in the later 1980s, Soviet spies spread false narratives that AIDS epidemic started from an experiment at a secret military biological lab in the US. 24:13.920 --> 24:25.440 They're also spreading the false narratives about scientific institutions and labs in other countries. 24:25.440 --> 24:32.780 Supposedly, they are creating biological weapons or something like this. 24:32.780 --> 25:00.520 So, in March and April, there was a couple of reports published in this respect, how Russians were using APT groups, cyber criminal syndicates to hack into the research facilities, hospitals, and what kind of strategies, methodologies and TTPs were they're using. 25:01.680 --> 25:07.420 Now, just recently was published UK's National Cyber Security Advisory Stats. 25:07.420 --> 25:31.460 They openly said that APT29 group that is associated with FSB, Russian Federal Security Service, that APT29 is attempting to steal information on coronavirus research, targeting pharmaceutical companies, healthcare, academic research centers. 25:31.860 --> 25:37.580 So, all aspects, actually, of information warfare elements was used. 25:37.580 --> 25:44.550 As I mentioned, they used the conventional media, anonymous outlets, the cyber components, they tried to... 25:45.520 --> 26:06.980 they created a fake coronavirus tracking web, fake coronavirus application, ransomware targeting the healthcare system, on which I'm going to talk in detail in my next slides, targeting the VPN system, remote working tools and softwares. 26:07.530 --> 26:10.480 So, here is actually a couple of examples. 26:10.980 --> 26:29.280 Now, what kind of fake bogus emails they are crafting, mimicking, that's the legit organizations such as the World Health Organization, CDC, and other government agencies, and the government agencies as well. 26:29.280 --> 26:34.580 For example, cyber criminals in UK also use the SMS phishing strategy. 26:34.580 --> 26:36.180 Here is a screen. 26:37.960 --> 26:49.580 They're sending to the UK resident that UK government has issued a payment of over 400 pounds to a resident, and you have to just click to this link. 26:49.580 --> 26:58.860 And once you click to this link, it actually asks you the national registration number, as well as other information, banking information. 26:59.280 --> 27:04.860 The fake Android application also was created, was removed from the Google Play. 27:04.860 --> 27:16.320 So, what actually, I'm going to talk about the fake life map that resembles Johns Hopkins University tracking coronavirus infographic map. 27:16.580 --> 27:21.880 I'm going to talk about this in more detail in my next slides. 27:21.880 --> 27:37.200 So, what we also saw during this period, that's over the 1.2 million newly registered domains were created, and over 85,000 domains were classified as risky or malicious. 27:37.200 --> 27:46.980 Okay, here is the one of the criminal group called Sarin RPB, as well as Ravel. 27:46.980 --> 27:48.900 This group has 27:52.240 --> 27:56.340 a very heavy presence on XSS forum. 27:57.280 --> 28:15.020 This group launches, actually, competition for developing exploits for zero days, writing crypto algorithms, and other kind of a task that they post on this website, and they pay money. 28:15.020 --> 28:20.060 For example, the one of the competition was about $15,000. 28:21.900 --> 28:41.280 This, what is also very important, that they are also in, someone in February, we're already discussing the methods to deliver malware, where an email attachment then later was embedded into the COVID-19 Johns Hopkins infographic map. 28:41.280 --> 28:51.200 They also were selling the variants of malwares that later was embedded into the fake map. 28:51.200 --> 28:57.880 And for example, if you just opened it, it downloaded malicious code into your system. 28:57.880 --> 29:08.780 It collected information from the infected computer and send this information to the command and control server. 29:08.780 --> 29:13.140 By the way, this group is a human-operated ransomware group. 29:13.140 --> 29:14.620 What actually does it mean? 29:14.620 --> 29:34.040 The attack doesn't happen in an automated fashion, but instead, they are compromising internet-facing devices in order to establish presence in a vulnerable system, and later then execute attacks, steal information, and encrypt information on the victim's data. 29:34.040 --> 29:50.300 They were exploiting vulnerabilities in remote desktop protocols, vulnerabilities in the operating soundpatch operating system, misconfigured servers, as well as the electronic health record software. 29:50.640 --> 29:53.800 What is also important is for their operation, they use the Mimikatz. 29:53.800 --> 30:00.400 Mimikatz is a leading exploitation tool that actually dumps the passports from memory. 30:00.400 --> 30:08.160 This organization, this criminal organization actually also attacks one of the biotech companies that is based in California. 30:09.340 --> 30:28.920 What is also very important here is that they are not only interested in stealing intellectual properties from the biotech companies in the United States or in European countries, but also they were trying to gain some financial... they are launching cyberattacks for this financial gain, 30:28.920 --> 30:30.580 pure financial gains. 30:30.580 --> 30:48.500 For example, they attacked a New York law firm, and this is one of the prominent, very well-known law firm that has a very high level clientele, and asked for a ransom. 30:48.500 --> 31:00.140 So, I already said that Russian DeepWebForum, DocWebForum, HackerForum were very busy during this time period. 31:00.140 --> 31:28.580 A lot of discussions were going on on those forums, even selling the variants of malwares, discussing the methodologies about how to embed malicious code into the email, and some other... and the COVID-19 issue was very highly discussed, and all of these TTPs and methodologies on those forums. 31:28.580 --> 31:43.100 As I mentioned, that's already in one of those forums, we were offering malware for sale that later was inserted into email attachment, resembling the fake COVID-19 map. 31:43.740 --> 31:48.020 So, those DarkWebForum are 31:51.900 --> 31:52.300 also... 31:52.300 --> 32:01.060 there are a lot of other, you know, DarkForum and HackerForum, actually, that are on the Ru domains and the Su domains. 32:01.060 --> 32:08.980 If you don't know what is a Su domain, it's an old Soviet Union domain, it actually has over 120,000 registered domains there. 32:08.980 --> 32:35.340 So, yeah, a lot of interesting information could have been... you could... one can gather from those forums, and it gives you kind of a good understanding of what they are up to, what they are planning, what kind of strategies they are discussing for future attacks. 32:36.740 --> 32:42.880 So, another also group that was very active during this period was a HADES group. 32:42.880 --> 32:47.540 This group is associated with the Russian military... 32:50.260 --> 33:00.640 Russian military GRU with APT28 group, also called Defense CBSN, or Voodoo Beer Telebot, and it has also some other names as well. 33:00.640 --> 33:11.480 So, those... they were using the phishing email campaign, mimicking World Health Organization and the Ministry of Health of Ukraine. 33:11.480 --> 33:34.200 They were sending... here is a, you know, example what kind of emails they were sending to the organizations in Ukraine, and not only in Ukraine, where most of this group was active in European countries, in particular, heavily active in Ukraine. 33:34.200 --> 33:42.340 And once you, you know, open this file, it's downloaded malicious macro code to perform the remote control. 33:43.260 --> 33:48.860 Another also group that was very active during this time was a Gamma Radon. 33:48.860 --> 33:50.920 This is the FSB group. 33:52.000 --> 34:07.300 This... they also targeted the organization, you know, they targeted scientific research centers, hospitals, all over the Western countries. 34:07.300 --> 34:23.200 This group is associated with FSB 16th and 18th Centers as the under second and 16th Directorate of FSB, active since 2013, attacking Ukraine since 2014. 34:23.860 --> 34:34.280 So once you actually open the document, it started a template injection technique, so for the... for loading the document templates from the internet. 34:34.280 --> 34:46.100 And once the document was downloaded, it executed that malicious macro code, code which executed the VBS... VBS scripts. 34:46.100 --> 34:54.340 So here is actually a... IP addresses are from the Russian hosting companies. 34:54.340 --> 35:04.620 Those IP addresses that's... this group is used for network destination or template injection and network destination for VBS script. 35:05.920 --> 35:17.820 So another also organization that was a cyber criminal group that was very active during this time, but that was group Russian ransomware group called MACE. 35:17.820 --> 35:30.940 This group used a variety of techniques by exploiting known vulnerabilities that was not... haven't been patched, remote desktop connection with a weak password. 35:30.940 --> 35:34.360 They used malicious emails or the links. 35:34.800 --> 35:59.160 They attacked not only the research institutes, scientific centers, but as well as they also attacked, for example, IT service providers company that does provide this kind of services for the healthcare industries and manufacturing. 35:59.600 --> 36:08.000 And in March, they attacked the Hammersmith Medicines Research Center in UK. 36:08.000 --> 36:15.620 So this center was before involved with an Ebola solution and working with COVID-19 vaccine. 36:15.620 --> 36:27.780 So what is also very important about this ransomware group that this group is as not kind of typical data encrypting ransomware. 36:27.780 --> 36:43.880 So it doesn't infect and encrypt computers in every computer that is in its path, but also it is extracting information and data to the attacker servers. 36:43.880 --> 36:49.160 So let me just talk a little bit about the RealWeek. 36:49.160 --> 36:51.500 This is another Russian hacking group. 36:51.620 --> 37:06.980 This hacking group also attacked hospitals and in Europe and the United States, for example, they attacked the second largest hospital in Czech Republic in Brno. 37:07.480 --> 37:20.940 They, before the pandemic, they actually attacked the hospitals in Alabama and they asked for the big ransom to decrypt them and unlock medical data. 37:20.940 --> 37:34.120 This ransomware is typically, you know, they actually already get into the compromise system. 37:34.120 --> 37:38.260 For example, they used, in this respect, the Immortal and TrickBot. 37:38.260 --> 37:45.080 The Immortal is a model that originally actually was created for the banking trojan designed to steal information. 37:45.080 --> 37:54.800 And once the system was infected, then their payload was dropped into the system and executed. 37:54.800 --> 38:06.320 And it's actually an encryption process actually started and they were asking the ransom for, to decrypt the data back. 38:06.320 --> 38:14.240 So for attack factors, they are trying to find vulnerabilities into the system, remote desktop protocol and poorly secured RDP ports. 38:14.240 --> 38:37.460 They use the phishing email, sending a malicious bugless email to trick legit organizations to download these emails in open and download documents from this organization, tricking actually legitimate organizations. 38:37.460 --> 38:49.860 So this is actually what I wanted to talk, how actually Russians use their information warfare strategy. 38:49.860 --> 38:52.940 It's elements of cyber warfare during this pandemic time. 38:52.940 --> 38:56.520 Of course, I just would like to talk to you a little bit about the mitigation strategy. 38:56.520 --> 39:10.360 And we also talk a lot of countermeasures, our community, how actually what kind of steps should be taken in order to secure system, to diminish risk, to decrease risk in this respect. 39:10.360 --> 39:14.100 Of course, important factor is that to assess the supply chain. 39:14.240 --> 39:19.080 That's a supply chain contamination is a big problem in this respect. 39:19.240 --> 39:23.820 Unpatched system was exploited by those hackers. 39:24.420 --> 39:35.500 Of course, it's very important having them to implement a multi-factor authentication methods, as well as train the staff in this respect. 39:35.500 --> 39:45.080 But what is also very important here, and in most cases, nobody talks about putting the threat intelligence into the mitigation strategy. 39:45.080 --> 39:55.780 For example, before the pandemic, all of those Russian forums were discussed, all of those methodologies and selling the malwares on those forums. 39:55.780 --> 40:01.540 I think that's observing what's going on, on a dark web, deep web, Russian hacking forums. 40:02.900 --> 40:10.500 It must be included in a mitigation strategy, because it gives you a pretty good understanding what we are up to and what we are planning in the future. 40:10.660 --> 40:13.100 So, thank you very much. 40:13.260 --> 40:22.700 I hope you'll find this presentation very interesting, and I'm looking forward to a Q&A section. 40:23.360 --> 40:24.160 Thank you.