DNC Hackers Linked to Russian Activity Against Ukraine Two Years Ago

A Crowdstrike Illustration of the FANCY BEAR group believed to be linked to the Russian military intelligence service.


AA Font size + Print

A Crowdstrike Illustration of the FANCY BEAR group believed to be linked to the Russian military intelligence service.

The same malware a Russian group used to attacked the DNC was targeting Ukrainian soldiers, says cybersecurity group.

In the same way that a masterpiece bears the distinct signature of its maker, so does a masterpiece of malware. Consider the case of FANCY BEAR, one of the two groups that broke into the Democratic National Committee’s, or DNC, networks and which the intelligence community and cybersecurity pros believe to be connected to the Russian military intelligence service, or GRU. Crowdstrike, the company that found hackers on the DNC network, on Thursday published a report showing that FANCY BEAR used the same malware as part of combat operations in Eastern Ukraine in 2014, which enabled the Russian troops to better target Ukrainian artillery positions. It’s one of the strongest pieces of evidence to emerge to show the connection between the Russian military and the concerted effort to influence the 2016 presidential election through the publication of stolen emails.

The malware in question is called X-Agent. Cybersecurity group TrendMicro originally discovered it in 2015 and connected it to a broad espionage operation from the Russian government aimed at political and military targets in Ukraine and elsewhere in Europe.

It’s a piece of malware well known to the Putin-backed group that hacked the DNC, also known as FANCY BEAR. As Crowdstrike’s Dimitri Alperovitch describes in his June blog post on the DNC hack, the environment was sick with  “X-Agent malware with capabilities to do remote command execution, file transmission and keylogging.”

Here’s what’s new, according to Crowdstrike. In 2013, a Ukrainian soldier named Yaroslav Sherstuk, with the 55th Artillery brigade developed a mobile phone application to help aim its long guns. The Android app was intended “to more rapidly process targeting data for the Soviet-era D-30 Howitzer employed by Ukrainian artillery forces.”

It was a math app for real time combat. Ukrainian soldiers using Soviet-era Howitzers had to  figure out the elevation of the target and the curvature of the earth, etc., using pen and paper, which took too much time. Sherstuk’s app did the same job quickly and easily: plug in the coordinates of the targets and the app would tell you settings that you needed to set for the Howitzer. Targeting time went from minutes to 15 seconds.

When fighting began in Ukraine, the app spread among users on VK (the Russian-language Facebook knock off) and the like, eventually reaching more than 9,000 downloads.

The Russian military realized that they could simply infect the app with X-Agent and the malware would spread as quickly as the app. “On 21 December 2014 the malicious variant of the Android application was first observed in limited public distribution on a Russian language, Ukrainian military forum. A late 2014 public release would place the development timeframe for this implant sometime between late-April 2013 and early December 2014,” Crowdstrike writes in their report.

The pro-Russian fighters could find Ukrainian soldiers who were using the app to plan howitzer fires because the Ukrainians had given away their position through the app. The app asks the user for “course location” rather than GPS location, which would give an adversary a very general understanding of where an enemy was. The Russians could then send small drones to pinpoint the artillery soldier and those around him. As a result, Russian artillery launched more than 120 attacks on Ukrainians in 2014 between the July 9 and Sept. 5. 

As open source investigative group Bellingcat makes clear in this post: “In the days and weeks that followed, the units at the border were subjected to dozens of additional artillery attacks. By late July 2014, the massive bombardment reversed Ukrainian gains and contributed to the encirclement of portions of the Ukrainian armed forces. A separatist offensive across eastern Ukraine began simultaneously with the artillery attacks, leading to the separatists capturing much of the Russian-Ukrainian border along with vast areas of the Donetsk and Lugansk oblasts. “The pressure of sustained artillery attacks through early August led Ukrainian armed forces to lose control of hundreds of kilometers of border territory.” By some estimates, they lost more than 80 percent of their D-30 Howitzers, well beyond what they lost for other artillery pieces. The spread of infected apps may have played a role in better drone targeting but no hard proof it certainly did.

Bottom line: The presence of the same bit of malware on the phones of Ukrainian soldiers just before they were fired on in 2014 – and then in the DNC servers just before embarrassing emails were published to Wikileaks in 2016  — is more than a coincidence. X Agent is not the sort of thing you find on GitHub. “We have only seen it used by FANCY BEAR. The source code for it has never been found on any public or underground forum,” Alperovitch told Defense One.

What this shows is that the same Putin-backed actors that targeted the DNC were targeting soldiers in Ukraine in 2014. And it is unlikely that a 400 pound U.S. hacker (or for that matter, the Chinese) were helping Russian forces target Ukrainian Howitzers in the Donbass in 2014.

Close [ x ] More from DefenseOne

Thank you for subscribing to newsletters from DefenseOne.com.
We think these reports might interest you:

  • Software-Defined Networking

    So many demands are being placed on federal information technology networks, which must handle vast amounts of data, accommodate voice and video, and cope with a multitude of highly connected devices while keeping government information secure from cyber threats. This issue brief discusses the state of SDN in the federal government and the path forward.

  • Military Readiness: Ensuring Readiness with Analytic Insight

    To determine military readiness, decision makers in defense organizations must develop an understanding of complex inter-relationships among readiness variables. For example, how will an anticipated change in a readiness input really impact readiness at the unit level and, equally important, how will it impact readiness outside of the unit? Learn how to form a more sophisticated and accurate understanding of readiness and make decisions in a timely and cost-effective manner.

  • Cyber Risk Report: Cybercrime Trends from 2016

    In our first half 2016 cyber trends report, SurfWatch Labs threat intelligence analysts noted one key theme – the interconnected nature of cybercrime – and the second half of the year saw organizations continuing to struggle with that reality. The number of potential cyber threats, the pool of already compromised information, and the ease of finding increasingly sophisticated cybercriminal tools continued to snowball throughout the year.

  • A New Security Architecture for Federal Networks

    Federal government networks are under constant attack, and the number of those attacks is increasing. This issue brief discusses today's threats and a new model for the future.

  • Information Operations: Retaking the High Ground

    Today's threats are fluent in rapidly evolving areas of the Internet, especially social media. Learn how military organizations can secure an advantage in this developing arena.


When you download a report, your information may be shared with the underwriters of that document.