The Plot to Hack America

The White House attack came as a result of a similar breach at the State Department just weeks before. In that case a staffer clicked on a fake link in an email referring to “administrative matters.”⁵⁷ The resulting data gained at the State Department allowed attackers to map out an approach to White House attack vectors. The White House breach resulted in unclassified but perhaps sensitive information being compromised, including emails of President Barack Obama’s schedule.⁵⁸

The CYBER BEARS also conducted spear-phishing campaign on the U.S. Joint Chiefs, aimed at the U.S. military’s joint staff. The entry malware was disguised as coworker emails. The resulting breach shut the system down for ten days, during which time four thousand staffers were offline.

OPERATION WATERSNAKE

An example of the extent of the FSB and GRU covert cyber collection and exploitation was the exposure of what was most likely a Russian State Security & Navy Intelligence covert operation to monitor, exploit and hack targets within the central United States from Russian merchant ships equipped with advanced hacking hardware and tools. The US Coast guard boarded the merchant ship SS Chem Hydra and in it they found wireless intercept equipment associated with Russian hacking teams. Apparently the vessel had personnel on board who were tasked to collect intelligence on wireless networks and attempt hackings on regional computer networks in the heartland of America.⁵⁹

The Criminal Bears, Militia Bears and Others

Berzerk Bear, VooDoo Bear, Boulder Bear: CrowdStrike identified a group that has been active since 2004 as “Berzerk Bear” and tied the group to Russian Intelligence Services. The aim of this group is information theft,⁶⁰ and it has shown a flexibility to write tools appropriate to its mission. Berzerk Bear was active during the 2008 Russo-Georgian conflict, acting against Georgian websites. However, without extensive reports detailing the attacks, it is hard to tie these names to a larger matrix of attacks that are chronicled by malware tracking firms.

CyberBerkut: The group known as CyberBerkut is different than the APT threats from the Russians. These Pro-Russians from Ukraine have been launching their anti-Ukrainian DDoS attacks since 2014. In addition to DDos attacks, CyberBerkut employs data exfiltration and disinformation to attack its target.⁶¹ Although the group’s attacks have largely been aimed at discrediting the Ukrainian government, it has also been noted that CyberBerkut only aims its attacks at members of NATO. They have a website and have been quasi-public in a manner resembling Anonymous. They have even engaged in conspiracy theories related to the murder of James Foley by posting a staged video meant to resemble the famous video with Jihadi John and Foley.

Putin’s Professional Troll Farm

Several internet hoaxes spread on social media and caused panic in around the country in the fall and winter of 2014. The first came after an explosion at a Louisiana chemical plant in September, then later an Ebola outbreak, and a police shooting of an unarmed black woman in Atlanta in December. None of these events, however, actually happened.⁶² But this was not immediately clear in any of the cases. During the chemical plant hoax, for example, posts inundated social media, residents received frantic text messages, fake CNN screenshots went viral, and clone news sites appeared.⁶³ In each instance, reporter Adrian Chen discovered, a Russian group known as The Internet Research Agency concocted the elaborate hoaxes. Online, these pro-Russia, anti-everyone paid staffers are known as the “Trolls from Olgino.”⁶⁴

Chen traveled to the Russian city of St. Petersburg and reported extensively on the so-called “troll farms” for a June 2015 article titled “The Agency” in The New York Times magazine. He wrote that the agency had become known for “employing hundreds of Russians to post pro-Kremlin propaganda online under fake identities, including on Twitter, in order to create the illusion of a massive army of supporters.”⁶⁵