DNC Hackers Linked to Russian Activity Against Ukraine Two Years Ago

A Crowdstrike Illustration of the FANCY BEAR group believed to be linked to the Russian military intelligence service.

CROWDSTRIKE

AA Font size + Print

A Crowdstrike Illustration of the FANCY BEAR group believed to be linked to the Russian military intelligence service.

The same malware a Russian group used to attacked the DNC was targeting Ukrainian soldiers, says cybersecurity group.

In the same way that a masterpiece bears the distinct signature of its maker, so does a masterpiece of malware. Consider the case of FANCY BEAR, one of the two groups that broke into the Democratic National Committee’s, or DNC, networks and which the intelligence community and cybersecurity pros believe to be connected to the Russian military intelligence service, or GRU. Crowdstrike, the company that found hackers on the DNC network, on Thursday published a report showing that FANCY BEAR used the same malware as part of combat operations in Eastern Ukraine in 2014, which enabled the Russian troops to better target Ukrainian artillery positions. It’s one of the strongest pieces of evidence to emerge to show the connection between the Russian military and the concerted effort to influence the 2016 presidential election through the publication of stolen emails.

The malware in question is called X-Agent. Cybersecurity group TrendMicro originally discovered it in 2015 and connected it to a broad espionage operation from the Russian government aimed at political and military targets in Ukraine and elsewhere in Europe.

It’s a piece of malware well known to the Putin-backed group that hacked the DNC, also known as FANCY BEAR. As Crowdstrike’s Dimitri Alperovitch describes in his June blog post on the DNC hack, the environment was sick with  “X-Agent malware with capabilities to do remote command execution, file transmission and keylogging.”

Here’s what’s new, according to Crowdstrike. In 2013, a Ukrainian soldier named Yaroslav Sherstuk, with the 55th Artillery brigade developed a mobile phone application to help aim its long guns. The Android app was intended “to more rapidly process targeting data for the Soviet-era D-30 Howitzer employed by Ukrainian artillery forces.”

It was a math app for real time combat. Ukrainian soldiers using Soviet-era Howitzers had to  figure out the elevation of the target and the curvature of the earth, etc., using pen and paper, which took too much time. Sherstuk’s app did the same job quickly and easily: plug in the coordinates of the targets and the app would tell you settings that you needed to set for the Howitzer. Targeting time went from minutes to 15 seconds.

When fighting began in Ukraine, the app spread among users on VK (the Russian-language Facebook knock off) and the like, eventually reaching more than 9,000 downloads.

The Russian military realized that they could simply infect the app with X-Agent and the malware would spread as quickly as the app. “On 21 December 2014 the malicious variant of the Android application was first observed in limited public distribution on a Russian language, Ukrainian military forum. A late 2014 public release would place the development timeframe for this implant sometime between late-April 2013 and early December 2014,” Crowdstrike writes in their report.

The pro-Russian fighters could find Ukrainian soldiers who were using the app to plan howitzer fires because the Ukrainians had given away their position through the app. The app asks the user for “course location” rather than GPS location, which would give an adversary a very general understanding of where an enemy was. The Russians could then send small drones to pinpoint the artillery soldier and those around him. As a result, Russian artillery launched more than 120 attacks on Ukrainians in 2014 between the July 9 and Sept. 5. 

As open source investigative group Bellingcat makes clear in this post: “In the days and weeks that followed, the units at the border were subjected to dozens of additional artillery attacks. By late July 2014, the massive bombardment reversed Ukrainian gains and contributed to the encirclement of portions of the Ukrainian armed forces. A separatist offensive across eastern Ukraine began simultaneously with the artillery attacks, leading to the separatists capturing much of the Russian-Ukrainian border along with vast areas of the Donetsk and Lugansk oblasts. “The pressure of sustained artillery attacks through early August led Ukrainian armed forces to lose control of hundreds of kilometers of border territory.” By some estimates, they lost more than 80 percent of their D-30 Howitzers, well beyond what they lost for other artillery pieces. The spread of infected apps may have played a role in better drone targeting but no hard proof it certainly did.

Bottom line: The presence of the same bit of malware on the phones of Ukrainian soldiers just before they were fired on in 2014 – and then in the DNC servers just before embarrassing emails were published to Wikileaks in 2016  — is more than a coincidence. X Agent is not the sort of thing you find on GitHub. “We have only seen it used by FANCY BEAR. The source code for it has never been found on any public or underground forum,” Alperovitch told Defense One.

What this shows is that the same Putin-backed actors that targeted the DNC were targeting soldiers in Ukraine in 2014. And it is unlikely that a 400 pound U.S. hacker (or for that matter, the Chinese) were helping Russian forces target Ukrainian Howitzers in the Donbass in 2014.

Close [ x ] More from DefenseOne
 
 

Thank you for subscribing to newsletters from DefenseOne.com.
We think these reports might interest you:

  • Ongoing Efforts in Veterans Health Care Modernization

    This report discusses the current state of veterans health care

    Download
  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

    Download
  • Top 5 Findings: Security of Internet of Things To Be Mission-Critical

    As federal agencies increasingly leverage these capabilities, government security stakeholders now must manage and secure a growing number of devices, including those being used remotely at the “edge” of networks in a variety of locations. With such security concerns in mind, Government Business Council undertook an indepth research study of federal government leaders in January 2017. Here are five of the key takeaways below which, taken together, paint a portrait of a government that is increasingly cognizant and concerned for the future security of IoT.

    Download
  • Coordinating Incident Response on Posts, Camps and Stations

    Effective incident response on posts, camps, and stations is an increasingly complex challenge. An effective response calls for seamless conversations between multiple stakeholders on the base and beyond its borders with civilian law enforcement and emergency services personnel. This whitepaper discusses what a modern dispatch solution looks like -- one that brings together diverse channels and media, simplifies the dispatch environment and addresses technical integration challenges to ensure next generation safety and response on Department of Defense posts, camps and stations.

    Download
  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

    Download

When you download a report, your information may be shared with the underwriters of that document.