Revision as of 02:07, 28 April 2009 editHodja Nasreddin (talk | contribs)Autopatrolled, Pending changes reviewers31,217 edits →"LiveJournal fighters"← Previous edit | Latest revision as of 11:49, 20 October 2024 edit undoCurryCity (talk | contribs)Extended confirmed users2,466 edits Added a background section | ||
(603 intermediate revisions by more than 100 users not shown) | |||
Line 1: | Line 1: | ||
{{Short description|Various types of cyberwarfare used by Russia against many nations}} | |||
{{Orphan|date=February 2009}} | |||
{{Use dmy dates|date=March 2021}} | |||
It has been claimed that '''Internet operations by Russian secret police services''' include a variety of "]" to influence the world events, including ], ], dissemination of ] over the internet, ], internet ] using ] technology, and ]. According to investigative journalist ] <ref name="Soldatov"> , a talk show by ] at the ], January 22, 2006; interview with ] and others </ref>, some of these activities are coordinated by the Russian ], which is currently a part of the ] but has been formerly a part of 16th ] department, but others are directed by the ]. This point is, however, disputable (see below). | |||
'''Cyberwarfare by Russia''' includes ], ], dissemination of ] and propaganda, ], internet ] using ] technology, ] and other ].<ref name="Kantchev Strobel 2021">{{cite web | last1=Kantchev | first1=Georgi | last2=Strobel | first2=Warren P. | title=How Russia's 'Info Warrior' Hackers Let Kremlin Play Geopolitics on the Cheap | website=] | date=2 January 2021 | url=https://www.wsj.com/articles/how-russias-info-warrior-hackers-let-kremlin-play-geopolitics-on-the-cheap-11609592401 | access-date=12 January 2021 | archive-date=8 January 2021 | archive-url=https://web.archive.org/web/20210108150801/https://www.wsj.com/articles/how-russias-info-warrior-hackers-let-kremlin-play-geopolitics-on-the-cheap-11609592401 | url-status=live }}</ref> According to investigative journalist ], some of these activities were coordinated by the Russian ], which was part of the ] and formerly a part of the 16th ] department.<ref name="Soldatov"> {{Webarchive|url=https://web.archive.org/web/20090822164949/http://echo.msk.ru/programs/albac/41311/ |date=22 August 2009 }}, a talk show by ] at the ], 22 January 2006; interview with ] and others</ref> | |||
An analysis by the ] in 2017 outlines Russia's view of "Information Countermeasures" or IPb (''informatsionnoye protivoborstvo'') as "strategically decisive and critically important to control its domestic populace and influence adversary states", dividing 'Information Countermeasures' into two categories of "Informational-Technical" and "Informational-Psychological" groups. The former encompasses network operations relating to defense, attack, and exploitation and the latter to "attempts to change people's behavior or beliefs in favor of Russian governmental objectives."<ref>{{Cite web |title=Military Power Publications |url=http://www.dia.mil/Military-Power-Publications/ |access-date=25 September 2017 |website=www.dia.mil |language=en-US |archive-date=26 September 2017 |archive-url=https://web.archive.org/web/20170926095625/http://www.dia.mil/Military-Power-Publications/ |url-status=live }}</ref> | |||
==Background== | |||
==Propaganda and disinformation== | |||
According to former senior ] officer ], who defected in the ] in 2000, he often sent his servicemen to branches of ] where they got access to the Internet without anyone knowing their identity. They placed ] and ] to various web sites and sent it in e-mails to US broadcasters <ref name="Comrade J">], "Comrade J: The Untold Secrets of Russia's Master Spy in America After the End of the Cold War", Penguin Books, 2007, ISBN 978-0-399-15439-3, pages 194-195</ref>. The articles or messages were not written by the intelligence officers, by prepared in advance by Russian experts, often with references to bogus sources<ref name="Comrade J"/>. The texts were mostly accurate but always contained a "kernel of disinformation". The purpose of these ] was to support ], to create good image of Russia, to promote ] and "to cause dissension and unrest inside the US"<ref name="Comrade J"/>. Tretyakov did not specified the targeted web sites, but made clear they selected the sites which are most convenient for distributing the specific disinformation. During his work in ] in the end of 1990s, one of the most frequent disinformation subjects was ]. | |||
{{Excerpt|Cyberwarfare}} | |||
==Online presence== | |||
According to Soldatov, one of the Russian teams, who called themselves ] officers, was actively involved in a disinformation campaign prior to ]<ref name="Soldatov"/>. | |||
US journalist ] described his interviews with former senior ] officer ], who defected to the ] in 2000: | |||
{{Blockquote|1=Sergei would send an officer to a branch of the ] where he could get access to the Internet without anyone knowing his identity. The officer would post the propaganda on various websites and send it in emails to US publications and broadcasters. Some propaganda would be disguised as educational or scientific reports. ... The studies had been generated at the ] by Russian experts. The reports would be 100% accurate <ref name="Comrade J">], "Comrade J: The Untold Secrets of Russia's Master Spy in America After the End of the Cold War", Penguin Books, 2007, {{ISBN|978-0-399-15439-3}}, pages 194-195</ref>}} | |||
Tretyakov did not specify the targeted web sites, but made clear they selected the sites which are most convenient for distributing the specific information. According to him, during his work in ] in the end of the 1990s, one of the most frequent subjects was the ].<ref name="Comrade J" /> | |||
According to a publication in Russian computer weekly '']'', "just because it became known that anonymous editors are editing articles in ] in the interests of UK and US intelligence and security services, it is also likely that Russian security services are involved in editing ], but this is not even interesting to prove it — because everyone knows that security bodies have a special place in the structure of our state"<ref> {{Webarchive|url=https://web.archive.org/web/20090414060926/http://www.computerra.ru/own/384132/ |date=14 April 2009 }} by Kivy Bird, ], 26 November 2008</ref> | |||
==Cyberattacks== | ==Cyberattacks== | ||
It has been claimed that Russian security services organized a number of ] as a part of their ] against other countries, such as the ] and the | |||
]. |
].<ref>{{Cite web |title=www.axisglobe.com |url=http://www.axisglobe.com/news.asp?news=14728 |url-status=dead |archive-url=https://web.archive.org/web/20160817010832/http://www.axisglobe.com/news.asp?news=14728 |archive-date=17 August 2016 |access-date=1 August 2016}}</ref><ref> {{webarchive|url=https://web.archive.org/web/20081203191412/http://www.scmagazineus.com/Cyberspace-and-the-changing-nature-of-warfare/article/115929/ |date=3 December 2008 }}. Strategists must be aware that part of every political and military conflict will take place on the internet, says Kenneth Geers.</ref> One identified young Russian hacker said that he was paid by ] to lead hacking attacks on ] computers. He was studying ] at the Department of the Defense of Information. His tuition was paid for by the FSB.<ref>Andrew Meier, ''Black Earth.'' ], 2003, {{ISBN|0-393-05178-1}}, pages 15-16.</ref> | ||
The Russian invasion of Ukraine in February 2022 saw renewed interest in information warfare, with the widespread dissemination of propaganda and misinformation on social media, by way of a large-scale Russian propaganda campaign on social media,<ref>{{Cite web |date=2023-03-12 |title=Social Media as a Propaganda Tool in the Russia-Ukraine Conflict |url=https://www.thecairoreview.com/essays/social-media-as-a-propaganda-tool-in-the-russia-ukraine-conflict/ |access-date=2024-02-01 |website=The Cairo Review of Global Affairs |language=en-US}}</ref> especially in countries that abstained from voting on the such as India, South Africa, and Pakistan. Bots played a disproportionate role in the dissemination of pro-Russian messages and amplified its proliferation in early-stage diffusion, especially on platforms like Twitter, where pro-Russian messages received ~251,000 retweets and thereby reached around 14.4 million users. Of these "spreaders", around 20.28% of the spreaders are classified as bots, most of which were created at the beginning of the invasion.<ref>{{Cite journal |last=Geissler |first=Dominique |last2=Bär |first2=Dominik |last3=Pröllochs |first3=Nicolas |last4=Feuerriegel |first4=Stefan |date=December 2023 |title=Russian propaganda on social media during the 2022 invasion of Ukraine |url=https://epjdatascience.springeropen.com/articles/10.1140/epjds/s13688-023-00414-5 |journal=EPJ Data Science |language=en |volume=12 |issue=1 |pages=1–20 |doi=10.1140/epjds/s13688-023-00414-5 |issn=2193-1127|arxiv=2211.04154 }}</ref> | |||
==Russian state security teams== | |||
Russian intelligence expert ] made the following points when asked by ] about "internet brigades"<ref> , a talk show by ] at the ], January 22, 2006; interview with ] and others </ref>: | |||
*Russian state security teams actively disrupt work of certain political ]; | |||
*One of the teams, who called themselves ] officers, was actively involved in a disinformation campaign prior to ]; | |||
*The teams are also involved in ] attacks, and they have probably attacked his own web site during the ]; | |||
*Some of the "internet brigades" are coordinated by the Russian ], which is currently a part of the ] and has been formerly a part of 16th ] department; | |||
*There are also such teams from the ]. | |||
===Estonia=== | |||
==Persecution of ] by the FSB== | |||
{{Main|2007 cyberattacks on Estonia}} | |||
When Russian president ] called on his nation's women to have more children, journalist Vladimir Rakhmankov published a satiric article on the Internet calling Putin "''the nation's ]''". Rakhmankov was found guilty and fined by the court.<ref>{{cite web|url=http://www.gdf.ru/digest/digest/digest298e.shtml#rus1|title=GLASNOST DEFENSE FOUNDATION'S DIGEST No. 298|date=]|accessdate=2007-05-11}}</ref><ref></ref><ref> </ref><ref> </ref> Journalist ] and director of ] Stanislav Dmitrievsky were convicted in ] for publishing articles on the internet. <ref> statement by ] </ref> <ref name="Novo"> - by Jamestown Foundation </ref> | |||
In April 2007, following a diplomatic row with Russia over ], Estonia was targeted by a series of cyberattacks on financial, media, and government websites which were taken down by an enormous volume of spam being transmitted by ] in what is called a ]. Online banking was made inaccessible, government employees were suddenly unable to communicate via e-mail, and media outlets could not distribute news. The attacks reportedly came from Russian ] addresses, online instructions were in Russian, and Estonian officials traced the systems controlling the cyberattacks back to Russia.<ref name="McGuinness 2017">{{Cite web |last=McGuinness |first=Damien |date=27 April 2017 |title=How a cyber attack transformed Estonia |url=https://www.bbc.com/news/39655415 |access-date=24 February 2018 |website=BBC News |archive-date=21 February 2018 |archive-url=https://web.archive.org/web/20180221104203/http://www.bbc.com/news/39655415 |url-status=live }}</ref><ref name="Foreign Policy 2017">{{Cite web |date=27 April 2017 |title=10 Years After the Landmark Attack on Estonia, Is the World Better Prepared for Cyber Threats? |url=https://foreignpolicy.com/2017/04/27/10-years-after-the-landmark-attack-on-estonia-is-the-world-better-prepared-for-cyber-threats/ |access-date=24 February 2018 |website=Foreign Policy |archive-date=24 February 2018 |archive-url=https://web.archive.org/web/20180224113515/https://foreignpolicy.com/2017/04/27/10-years-after-the-landmark-attack-on-estonia-is-the-world-better-prepared-for-cyber-threats/ |url-status=live }}</ref> However, some experts held doubts that the attacks were carried out by the Russian government itself.<ref name="SearchSecurity 2018">{{Cite web |date=23 February 2018 |title=Experts doubt Russian government launched DDoS attacks |url=http://searchsecurity.techtarget.com/news/1255548/Experts-doubt-Russian-government-launched-DDoS-attacks |access-date=24 February 2018 |website=SearchSecurity |archive-date=24 February 2018 |archive-url=https://web.archive.org/web/20180224114114/http://searchsecurity.techtarget.com/news/1255548/Experts-doubt-Russian-government-launched-DDoS-attacks |url-status=live }}</ref> A year after the attack ] founded the ] in ] as a direct consequence of the attacks.<ref name="Military Space News, Nuclear Weapons, Missile Defense 2008">{{Cite web |date=14 May 2008 |title=NATO launches cyber defence centre in Estonia |url=http://www.spacewar.com/reports/NATO_launches_cyber_defence_centre_in_Estonia_999.html |access-date=24 February 2018 |website=Military Space News, Nuclear Weapons, Missile Defense |archive-date=11 August 2014 |archive-url=https://web.archive.org/web/20140811121828/http://www.spacewar.com/reports/NATO_launches_cyber_defence_centre_in_Estonia_999.html |url-status=live }}</ref> | |||
In response to the ], Estonia has removed a Soviet-era tank monument near Narva.<ref>{{cite news |date=16 August 2022|title=Estonia Removes Soviet-era Monument, Citing Public Order |url=https://www.bloomberg.com/news/articles/2022-08-16/estonia-removes-soviet-monument-citing-public-order |agency=Associated Press|access-date=18 August 2022}}</ref> After its removal, Estonia was subject to "the most extensive cyberattack" since the 2007 cyberattacks.<ref>{{cite web |date=18 August 2022|title=Estonia hit by 'most extensive' cyberattack since 2007 amid tensions with Russia over Ukraine war |url=https://www.euronews.com/next/2022/08/18/estonia-hit-by-most-extensive-cyberattack-since-2007-amid-tensions-with-russia-over-ukrain|author1=Pascale Davies |access-date=18 August 2022}}</ref> | |||
==Disruption of political blogs== | |||
{{main|web brigades}} | |||
The appearance of Russian state security teams in ] was described in 2003 by ] Anna Polyanskaya <ref name=Pol1>, MAOF publishing group</ref> (a former assistant to assassinated ] politician ]<ref>{{ru icon}} , by Anna Polyanskaya</ref>), ] Andrey Krivov and political activist Ivan Lomako. They claimed the appearance of organized and fairly professional "brigades", composed of ideologically and methodologically identical personalities, who were working in practically every popular ] and pro-] Internet forums and Internet newspapers of RuNet.<ref name="Polyanskaya"> by Anna Polyanskaya, Andrei Krivov, and Ivan Lomko, Vestnik online, ], ] ()</ref>. | |||
=== |
===France=== | ||
{{Further|2017 Macron e-mail leaks}} | |||
According to Polyanskaya and her colleagues, the behavior of people from the Internet brigades has distinct features, some of which are the following:<ref name="Polyanskaya"/> | |||
In 2015, the ]-based French broadcasting service ] was attacked by hackers who used malicious software to attack and destroy the network's systems and take all twelve of its channels off the air. The attack was initially claimed by a group calling themselves the "Cyber Caliphate" however a more in-depth investigation by French authorities revealed the attack on the network had links to ], a ]-affiliated hacker group.<ref name="Corera 2016">{{Cite web |last=Corera |first=Gordon |date=10 October 2016 |title=How France's TV5 was almost destroyed |url=https://www.bbc.com/news/technology-37590375 |access-date=10 March 2018 |website=BBC News |archive-date=15 March 2018 |archive-url=https://web.archive.org/web/20180315014420/http://www.bbc.com/news/technology-37590375 |url-status=live }}</ref><ref name="BBC News 2015">{{Cite web |date=9 June 2015 |title='Russian hackers' behind TV attack |url=https://www.bbc.com/news/world-europe-33072034 |access-date=10 March 2018 |website=BBC News |archive-date=30 April 2018 |archive-url=https://web.archive.org/web/20180430090840/http://www.bbc.com/news/world-europe-33072034 |url-status=live }}</ref> In May 2017, on the eve of the French presidential election, more than 20,000 e-mails belonging to the campaign of ] were dumped on an anonymous file-sharing website, shortly after the campaign announced they had been hacked. Word of the leak spread rapidly through the Internet, facilitated by bots and spam accounts. An analysis by Flashpoint, an American cybersecurity firm, determined with "moderate confidence" that APT28 was the group behind the hacking and subsequent leak.<ref name="Cyberscoop 2017">{{Cite web |date=11 May 2017 |title=Researchers link Macron hack to APT28 with 'moderate confidence' |url=https://www.cyberscoop.com/researchers-link-macron-hack-to-apt28-with-moderate-confidence/ |access-date=10 March 2018 |website=Cyberscoop |archive-date=16 January 2018 |archive-url=https://web.archive.org/web/20180116135134/https://www.cyberscoop.com/researchers-link-macron-hack-to-apt28-with-moderate-confidence/ |url-status=live }}</ref> | |||
*Propaganda of the ], and constant attempts to present in a positive light the entire history of Russia and the ], minimizing the number of people who died in repressions. | |||
*Boundless loyalty to ] and his circle. | |||
*Respect and admiration for the ] and ]. The key word which "will force them to reveal their true colors is ]"; the brigade will cry out in a choir about "bloody repressions by democratic murderers" and "witch hunts" after mentioning this word. | |||
*Hatred of ] and ] organizations and activists, ]s and ]s, especially ], ], ], ], ], and ]. | |||
*] and anti-Westernism. | |||
*Accusation of ] against everyone who disagrees with them. | |||
*Tendency to accuse their opponents of being ] during arguments. | |||
*Round-the-clock presence on forums. At least one of the uniform members of the team can be found online at all times, always ready to repulse any “attack” by a ]. | |||
In February 2021 the ] said that "several French entities" were breached by ] between late 2017 and 2020 by hacking French software company Centreon to deploy malware. Similar to the ]. The ANSSI said the breach "mostly affected information technology providers, especially web hosting providers". Russia has denied being behind the cyberattack. Centreon said in a statement that it "has taken note of the information" but disputed that the breach was linked to a vulnerability in their commercial software.<ref>{{Cite web|last=Cimpanu|first=Catalin|title=France: Russian state hackers targeted Centreon servers in years-long campaign|url=https://www.zdnet.com/article/france-russian-state-hackers-targeted-centreon-servers-in-years-long-campaign/|access-date=18 February 2021|website=ZDNet|language=en|archive-date=17 February 2021|archive-url=https://web.archive.org/web/20210217103709/https://www.zdnet.com/article/france-russian-state-hackers-targeted-centreon-servers-in-years-long-campaign/|url-status=live}}</ref><ref>{{Cite web|date=16 February 2021|title=France uncovers cybersecurity breaches linked to Russian hackers|url=https://www.france24.com/en/france/20210216-france-uncovers-cybersecurity-breaches-linked-to-russian-hackers|access-date=18 February 2021|website=France 24|language=en|archive-date=17 February 2021|archive-url=https://web.archive.org/web/20210217224501/https://www.france24.com/en/france/20210216-france-uncovers-cybersecurity-breaches-linked-to-russian-hackers|url-status=live}}</ref><ref>{{Cite web|date=15 February 2021|title=France identifies Russia-linked hackers in large cyberattack|url=https://www.politico.eu/article/france-cyber-agency-russia-attack-security-anssi/|access-date=18 February 2021|website=POLITICO|language=en-US|archive-date=17 February 2021|archive-url=https://web.archive.org/web/20210217184046/https://www.politico.eu/article/france-cyber-agency-russia-attack-security-anssi/|url-status=live}}</ref> | |||
===Tactics=== | |||
*'''Individual work on opponents.''' "As soon as an opposition-minded liberal arrives on a forum, expressing a position that makes them a clear "ideological enemy”, he is immediately cornered and subjected to “]” by the unified web-brigade. Without provocation, the opponent is piled on with abuse or vicious “arguments” of the sort that the average person cannot adequately react to. As a result, the liberal either answers sharply, causing a scandal and getting himself labeled a “boor” by the rest of the brigade, or else he starts to make arguments against the obvious absurdities, to which his opponents pay no attention, but simply ridicule him and put forth other similar arguments."<ref name="Polyanskaya"/> | |||
*'''Accusations that opponents are working for “enemies”'''. The opponents are accused of taking money from ], the ], the ], ], the ], or the ] rebels. | |||
*'''Making personally offensive comments''', especially of sexual nature. | |||
*'''Remarkable ability to reveal personal information''' about their opponents and their quotes from old postings, sometimes more than a year old. | |||
*'''Teamwork'''. "They unwaveringly support each other in discussions, ask each other leading questions, put fine points on each other’s answers, and even pretend not to know each other. If an opponent starts to be hounded, this hounding invariably becomes a team effort, involving all of the three to twenty nicknames that invariably are present on any political forum 24 hours a day."<ref name="Polyanskaya"/> | |||
*'''Appealing to the Administration'''. The members of teams often "write mass collective complaints about their opponents to the editors, site administrators, or the electronic “complaints book”, demanding that one or another posting or whole discussion thread they don’t like be removed, or calling for the banning of individuals they find problematic."<ref name="Polyanskaya"/> | |||
*'''Destruction of inconvenient forums'''. For example, on the site of the ], all critics of ] and the FSB "were suddenly and without any explanation banned from all discussions, despite their having broken none of the site’s rules of conduct. All the postings of this group of readers, going back a year and a half, were erased by the site administrator."<ref name="Polyanskaya"/> | |||
===Georgia=== | |||
==Russian agents in Polish web sites== | |||
{{further|Cyberattacks during the 2008 South Ossetia war}} | |||
According to claims of unnamed "Polish experts on Russian affairs", reported by the Polish newspaper ] in 2005, at least a dozen active Russian agents work in Poland, also investigating the Polish Internet. The source also claims that the agents scrutinize Polish websites (like those supporting ]ian opposition), and also perform such actions, as—for instance—contributing to Internet forums on large portals (like Gazeta.pl, Onet.pl, WP.pl). Labeled as Polish Internet users, they incite anti-Semitic or anti-Ukrainian discussions or disavow articles published on the web, according to the source.<ref name="Tygodnik"> , ], 13/2005</ref> | |||
On 20 July 2008, the website of the Georgian president, ], was rendered inoperable for twenty-four hours by a series of ]. Shortly after, the website of the ] and the parliament were attacked by hackers who plastered images of Mikheil Saakashvili and former Nazi leader ]. During the war, many Georgian government servers were attacked and brought down, reportedly hindering communication and the dissemination of crucial information. According to technical experts, this is the first recorded instance in history of cyberattacks coinciding with an armed conflict.<ref name="Hart 2008">{{Cite news |last=Hart |first=Kim |date=14 August 2008 |title=Longtime Battle Lines Are Recast In Russia and Georgia's Cyberwar |url=https://www.washingtonpost.com/wp-dyn/content/article/2008/08/13/AR2008081303623.html |access-date=12 March 2018 |newspaper=The Washington Post |archive-date=13 March 2018 |archive-url=https://web.archive.org/web/20180313031306/http://www.washingtonpost.com/wp-dyn/content/article/2008/08/13/AR2008081303623.html |url-status=live }}</ref><ref name="Markoff 2008">{{Cite web |last=Markoff |first=John |date=13 August 2008 |title=Before the Gunfire, Cyberattacks |url=https://www.nytimes.com/2008/08/13/technology/13cyber.html |access-date=12 March 2018 |website=The New York Times |archive-date=30 March 2019 |archive-url=https://web.archive.org/web/20190330172829/https://www.nytimes.com/2008/08/13/technology/13cyber.html |url-status=live }}</ref> | |||
An independent US-based research institute report stated the attacks had "little or no direct involvement from the Russian government or military". According to the institute's conclusions, some several attacks originated from the PCs of multiple users located in Russia, ] and ]. These users were willingly participating in cyberwarfare, being supporters of Russia during the ], while some other attacks also used botnets.<ref>{{Cite web |last=Siobhan Gorman |date=18 August 2009 |title=Hackers Stole IDs for Attacks |url=https://www.wsj.com/articles/SB125046431841935299#articleTabs%3Darticle |website=WSJ |access-date=3 August 2017 |archive-date=10 August 2017 |archive-url=https://web.archive.org/web/20170810131343/https://www.wsj.com/articles/SB125046431841935299#articleTabs%3Darticle |url-status=live }}</ref><ref>{{Cite web |title=Georgian cyber attacks launched by Russian crime gangs |website=] |url=https://www.theregister.co.uk/2009/08/18/georgian_cyber_attacks/ |access-date=10 August 2017 |archive-date=10 August 2017 |archive-url=https://web.archive.org/web/20170810141905/https://www.theregister.co.uk/2009/08/18/georgian_cyber_attacks/ |url-status=live }}</ref> | |||
=="LiveJournal fighters"== | |||
A member of ] Roman Sadykhov reported about "] fighters", directed and paid from the Kremlin and instructions given to them by ], a close aide of ] <ref>{{ru icon}} , grani.ru, ], ]</ref> Surkov allegedly called Livejournal "a very important sector of work" <ref name="Surkov">, '']'', ], ]</ref> and said that people's brains must be "]" . He instructed "LiveJournal fighters" that | |||
===Germany=== | |||
:"We are losing in the Internet in that respect. It is always easier to break down things than to do something positive. What you are doing are jokes and minor infractions. Not only methods, but also goals must be radical. We must blow this romantics out of them . It is important not only to protect the authorities - this is understood, but we need to attract young people who can work creatively in the Internet. This is an important communication place of young people. Make them interested in conversations with you."<ref name="Surkov"/> | |||
In 2015, a high-ranking security official stated that it was "highly plausible" that a ] of files from the ], later published by ], was conducted by Russian hackers.<ref>{{Cite web |title=Russia behind hack on German parliament, paper reports |url=http://www.dw.com/en/russia-behind-hack-on-german-parliament-paper-reports/a-36729079 |access-date=30 January 2017 |publisher=Deutsche Welle |language=en |archive-date=2 February 2017 |archive-url=https://web.archive.org/web/20170202100702/http://www.dw.com/en/russia-behind-hack-on-german-parliament-paper-reports/a-36729079 |url-status=live }}</ref><ref>{{Cite news |last1=Wehner |first1=Markus |last2=Lohse |first2=Eckart |date=11 December 2016 |title=Wikileaks: Sicherheitskreise: Russland hackte geheime Bundestagsakten |work=Faz.net |publisher=Frankfurter Allgemeine Zeitung |url=https://www.faz.net/aktuell/politik/inland/wikileaks-sicherheitskreise-russland-hackte-geheime-bundestagsakten-14568558.html |access-date=30 January 2017 |archive-date=5 February 2017 |archive-url=https://web.archive.org/web/20170205063612/http://www.faz.net/aktuell/politik/inland/wikileaks-sicherheitskreise-russland-hackte-geheime-bundestagsakten-14568558.html |url-status=live }}</ref> In late 2016, ], president of the ] warned of data breaches and misinformation-campaigns steered by Russia.<ref>{{Cite news |title=Vor Bundestagswahl: BND warnt vor russischen Hackerangriffen |newspaper=Der Spiegel |date=29 November 2016 |url=http://www.spiegel.de/politik/deutschland/bundestagswahl-2017-bnd-chef-kahl-warnt-russischen-hackerangriffen-a-1123506.html |access-date=30 January 2017 |publisher=SPIEGEL ONLINE |archive-date=1 February 2017 |archive-url=https://web.archive.org/web/20170201133557/http://www.spiegel.de/politik/deutschland/bundestagswahl-2017-bnd-chef-kahl-warnt-russischen-hackerangriffen-a-1123506.html |url-status=live }}</ref> According to Kahl, there are insights that cyberattacks occur with no other purpose than to create political uncertainty.<ref>{{Cite web |date=1 November 2016 |title=Was bedeuten die neuen Cyberangriffe für die Bundestagswahl? |url=http://www.sueddeutsche.de/politik/leserdiskussion-was-bedeuten-die-neuen-cyberangriffe-fuer-die-bundestagswahl-1.3271551 |access-date=30 January 2017 |language=de |archive-date=2 February 2017 |archive-url=https://web.archive.org/web/20170202065136/http://www.sueddeutsche.de/politik/leserdiskussion-was-bedeuten-die-neuen-cyberangriffe-fuer-die-bundestagswahl-1.3271551 |url-status=live }}</ref><ref>{{Cite web |title=BND-Präsident warnt vor Cyberangriffen aus Russland |date=29 November 2016 |url=http://www.sueddeutsche.de/politik/bundestagswahl-bnd-praesident-warnt-vor-cyberangriffen-aus-russland-1.3270995 |access-date=30 January 2017 |archive-date=2 February 2017 |archive-url=https://web.archive.org/web/20170202064924/http://www.sueddeutsche.de/politik/bundestagswahl-bnd-praesident-warnt-vor-cyberangriffen-aus-russland-1.3270995 |url-status=live }}</ref> '']'' reported in February 2017 that a year-long probe by German intelligence "found no concrete proof of disinformation campaigns targeting the government".<ref>{{Cite web |last=King |first=Esther |date=7 February 2017 |title=German intelligence finds no evidence of Russian meddling |url=http://www.politico.eu/article/german-intelligence-finds-no-evidence-of-russian-meddling/ |access-date=21 October 2017 |website=] |archive-date=21 October 2017 |archive-url=https://web.archive.org/web/20171021163804/http://www.politico.eu/article/german-intelligence-finds-no-evidence-of-russian-meddling/ |url-status=live }}</ref> By 2020 however German investigators had collected enough evidence to identify one suspect.<ref>{{Cite web |title=German authorities charge Russian hacker for 2015 Bundestag hack {{pipe}} ZDNet |url=https://www.zdnet.com/article/german-authorities-charge-russian-hacker-for-2015-bundestag-hack/ |website=] |access-date=28 June 2020 |archive-date=29 July 2020 |archive-url=https://web.archive.org/web/20200729004228/https://www.zdnet.com/google-amp/article/german-authorities-charge-russian-hacker-for-2015-bundestag-hack/ |url-status=live }}</ref> | |||
], head of the country's ], noted "growing evidence of attempts to influence the federal election" in September 2017 and "increasingly aggressive cyber espionage" against political entities in Germany.<ref>{{Cite web |title=BfV: Russia is trying to destabilise Germany |url=http://www.aljazeera.com/news/2016/12/bfv-russia-destabilise-germany-161208141856179.html |access-date=30 January 2017 |publisher=AlJazeera |archive-date=30 January 2017 |archive-url=https://web.archive.org/web/20170130033802/http://www.aljazeera.com/news/2016/12/bfv-russia-destabilise-germany-161208141856179.html |url-status=live }}</ref> '']'' reported on 21 September 2017, three days before the ], that there was little to suggest any Russian interference in the election.<ref>{{Cite web |last=Schwirtz |first=Michael |date=21 September 2017 |title=German Election Mystery: Why No Russian Meddling? |url=https://www.nytimes.com/2017/09/21/world/europe/german-election-russia.html |access-date=21 October 2017 |website=] |archive-date=21 October 2017 |archive-url=https://web.archive.org/web/20171021112210/https://www.nytimes.com/2017/09/21/world/europe/german-election-russia.html |url-status=live }}</ref> In 2021 the European Commission has accused Russia of trying to interfere in European democratic processes just days before the parliamentary election on September 26 in Germany.<ref>{{Cite web|author=Vasco Cotovio|title=Russia accused of 'Ghostwriter' cyberattacks ahead of German election|url=https://www.cnn.com/2021/09/24/europe/russia-accused-ghostwriter-cyberattacks-german-election-intl/index.html|access-date=2021-09-25|website=CNN|date=24 September 2021}}</ref> | |||
==Comments by Russian government officials== | |||
Alexander Yusupovskiy, head of the analytical department of the ] (Russian Parliament) published in 2003 an article "Conspiracy theory" in ] with criticism of theory of web brigades. <ref name="Usup"> , by Alexander Yusupovskiy, Russian Journal, ], ]</ref> | |||
===Kyrgyzstan=== | |||
His points included: | |||
Beginning in mid-January 2009, Kyrgyzstan's two main ]s came under a large-scale DDoS attack, shutting down websites and e-mail within the country, effectively taking the nation offline. The attacks came at a time when the country's president, ], was being pressured by both domestic actors and Russia to close a U.S. air base in Kyrgyzstan.<ref name="Bradbury 2009">{{Cite web |last=Bradbury |first=Danny |date=5 February 2009 |title=Danny Bradbury investigates the cyberattack on Kyrgyzstan |url=https://www.theguardian.com/technology/2009/feb/05/kyrgyzstan-cyberattack-internet-access |access-date=12 March 2018 |website=The Guardian |archive-date=13 March 2018 |archive-url=https://web.archive.org/web/20180313092624/https://www.theguardian.com/technology/2009/feb/05/kyrgyzstan-cyberattack-internet-access |url-status=live }}</ref> '']'' reported the attacks had been carried out by a Russian "cyber-militia".<ref name="Rhoads 2009">{{Cite web |last=Rhoads |first=Christopher |date=28 January 2009 |title=Kyrgyzstan Knocked Offline |url=https://www.wsj.com/articles/SB123310906904622741 |access-date=12 March 2018 |website=WSJ |archive-date=13 March 2018 |archive-url=https://web.archive.org/web/20180313153611/https://www.wsj.com/articles/SB123310906904622741 |url-status=live }}</ref> | |||
*Authors exclude from their interpretation of events all other hypotheses, such as internet activity of a group of some "skinheads", ]s or simply unliberal students; or hackers able to get IP addresses of their opponents. | |||
*According to Yusupovskiy, authors treat "independence of public opinion" in spirit of irreconcilable antagonism with "positive image of Russia".<ref name="Usup"/> | |||
*Although Yusupovskiy himself has a list of claims against Russian security services and their presense in virtual world (as "according to statements of media every security service is busy in the Internet tracking terrorism, extremism, narcotic traffic, human trafficking and child pornography"), his claims are of different nature than those of Polyanskaya. | |||
*Yusupovskiy himself didn't take Web brigades theory seriously, "naively" considering that officeers of GRU or FSB have more topical problems than "comparing virtual penises" with liberals and emigrants. His own experience at forums also did not give him a reason proving the theory.<ref name="Usup"/> | |||
===Poland=== | |||
==In popular culture== | |||
A three-year pro-Russian disinformation campaign on ] with an audience of 4.5 million Poles was discovered in early 2019 by ] and ]. The campaign published fake news and supported three Polish politicians and their websites: ], former leader of the ultra-nationalist and neo-fascist ] and, {{as of|2019|lc=yes}}, Secretary of State in the Polish Ministry of Digitisation; ]; and ], an active member of the ] during the communist epoch and a prime minister of Poland during the post-communist epoch. Facebook responded to the analysis by removing some of the web pages.<ref name="Poland_RU_FB_disinformation_2016_2019" /> | |||
The alleged ] activities on the Internet have been described in the short story "Anastasya" by Russian writer ], who was interested in the moral aspects of their work.<ref name="Svirsky>" ] </ref> He wrote: | |||
{{Quotation|"It seems that offending, betraying, or even "murdering" people in the virtual space is easy. This is like killing an enemy in a video game: one does not see a disfigured body or the eyes of the person who is dying right in front of you. However, the human soul lives by its own basic laws that force it to pay the price for the virtual crime in his real life".<ref name="Bagryansky"> {{ru icon}} </ref>}} | |||
=== Romania === | |||
{{main|2022 cyberattacks on Romania}} | |||
Between late April and early May 2022, in the midst of the ], multiple Romanian government, military, bank and mass media websites were taken down after a series of DDoS attacks, behind which was a pro-] hacking group, ]. The hacking group described the cyberattacks to be a response to a statement made by then-], ] that ] would provide ] with military equipment.<ref>{{Cite web |title=UPDATE Atacul cibernetic care a vizat site-uri guvernamentale, printre care al Executivului și al Armatei, revendicat de hackeri ruși |url=https://www.digi24.ro/stiri/actualitate/site-uri-guvernamentale-printre-care-cel-al-executivului-si-al-armatei-atacate-cibernetic-carbunaru-nu-sunt-date-sensibile-afectate-1921999 |access-date=2022-05-08 |website=www.digi24.ro |date=29 April 2022 |language=ro}}</ref><ref>{{Cite web |title=Site-urile marilor aeroporturi din România nu funcționează. Hackerii ruși de la Killnet revendică atacul |url=https://www.digi24.ro/stiri/economie/transporturi/site-urile-marilor-aeroporturi-din-romania-nu-functioneaza-hackerii-rusi-de-la-killnet-revendica-atacul-1924549 |access-date=2022-05-08 |website=www.digi24.ro |date=2 May 2022 |language=ro}}</ref><ref>{{Cite web |title=Ce spune Marcel Ciolacu, preşedintele Camerei Deputaţilor, despre motivele invocate de hackerii Killnet: E o greşeală acolo |url=https://www.zf.ro/zf-24/ce-spune-marcel-ciolacu-presedintele-camerei-deputatilor-despre-20782673 |access-date=2022-05-08 |website=ZF.ro |language=ro}}</ref> | |||
=== South Korea === | |||
According to two ] intelligence officials that talked to '']'', and also the findings of cybersecurity analyst Michael Matonis, ] is likely behind the cyber attacks against the ] in ].<ref name=":0">{{Cite magazine |title=Inside Olympic Destroyer, the Most Deceptive Hack in History |language=en-us |magazine=Wired |url=https://www.wired.com/story/untold-story-2018-olympics-destroyer-cyberattack/ |access-date=26 August 2020 |issn=1059-1028 |archive-date=18 September 2020 |archive-url=https://web.archive.org/web/20200918075445/https://www.wired.com/story/untold-story-2018-olympics-destroyer-cyberattack/ |url-status=live }}</ref> The worm responsible for these cyber attacks is known as "Olympic Destroyer". | |||
The worm targeted all Olympic IT infrastructure, and succeeded in taking down WiFi, feeds to jumbotrons, ticketing systems, and other Olympic systems. It was timed to go off at the start of the opening ceremonies. It was unique in that the hackers attempted to use many false signatures to blame other countries such as ] and ].<ref name=":0" /> | |||
===Ukraine=== | |||
{{main|Russo-Ukrainian cyberwarfare}} | |||
In March 2014, a Russian cyber weapon called Snake or "Ouroboros" was reported to have created havoc on Ukrainian government systems.<ref>{{Cite web |last=The Christian Science Monitor |date=12 March 2014 |title=Russia's cyber weapons hit Ukraine: How to declare war without declaring war |url=http://www.csmonitor.com/Commentary/Global-Viewpoint/2014/0312/Russia-s-cyber-weapons-hit-Ukraine-How-to-declare-war-without-declaring-war |website=The Christian Science Monitor |access-date=14 March 2014 |archive-date=14 March 2014 |archive-url=https://web.archive.org/web/20140314090914/http://www.csmonitor.com/Commentary/Global-Viewpoint/2014/0312/Russia-s-cyber-weapons-hit-Ukraine-How-to-declare-war-without-declaring-war |url-status=live }}</ref> The Snake tool kit began spreading into Ukrainian computer systems in 2010. It performed Computer Network Exploitation (CNE), as well as highly sophisticated Computer Network Attacks (CNA).<ref>{{Cite book |last=Mazanec |first=Brain M. |title=The Evolution of Cyber War |publisher=University of Nebraska Press |year=2015 |isbn=9781612347639 |location=USA |pages=221–222}}</ref> | |||
From 2014 to 2016, according to ], the Russian APT ] used Android ] to target the Ukrainian Army's ]. They distributed an infected version of an ] ] whose original purpose was to control targeting data for the ] artillery. The app, used by Ukrainian officers, was loaded with the ] spyware and posted online on military forums. CrowdStrike claims the attack was successful, with more than 80% of Ukrainian D-30 Howitzers destroyed, the highest percentage loss of any artillery pieces in the army (a percentage that had never been previously reported and would mean the loss of nearly the entire arsenal of the biggest artillery piece of the ].<ref> {{Webarchive|url=https://web.archive.org/web/20170107101109/https://www.yahoo.com/news/ukraines-military-denies-russian-hack-attack-143419289.html |date=7 January 2017 }}, ] (6 January 2017)</ref>).<ref name="CrowdStrike">{{Cite web |date=22 December 2016 |title=Danger Close: Fancy Bear Tracking of Ukrainian Field Artillery Units |url=https://www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/ |publisher=CrowdStrike |access-date=2 January 2017 |archive-date=1 January 2017 |archive-url=https://web.archive.org/web/20170101144435/https://www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/ |url-status=live }}</ref> According to the ], this number is incorrect and that losses in artillery weapons "were way below those reported" and that these losses "have nothing to do with the stated cause".<ref> {{Webarchive|url=https://web.archive.org/web/20170107095756/http://en.interfax.com.ua/news/general/395186.html |date=7 January 2017 }}, ] (6 January 2017)</ref> | |||
The U.S. government concluded after a study that a ] which left more than 200,000 people temporarily without power. The Russian hacking group Sandworm or the Russian government were possibly behind the malware attack on the Ukrainian power grid as well as a mining company and a large railway operator in December 2015.<ref>{{Cite web |date=4 January 2016 |title=Malware Found Inside Downed Ukrainian Grid Management Points to Cyberattack |url=http://motherboard.vice.com/read/malware-found-inside-downed-ukrainian-power-plant-points-to-cyberattack |website=Motherboard |access-date=6 January 2016 |archive-date=7 January 2016 |archive-url=https://web.archive.org/web/20160107133407/http://motherboard.vice.com/read/malware-found-inside-downed-ukrainian-power-plant-points-to-cyberattack |url-status=live }}</ref><ref>{{Cite web |title=SANS Industrial Control Systems Security Blog - Potential Sample of Malware from the Ukrainian Cyber Attack Uncovered - SANS Institute |url=https://ics.sans.org/blog/2016/01/01/potential-sample-of-malware-from-the-ukrainian-cyber-attack-uncovered |access-date=1 August 2016 |archive-date=31 July 2016 |archive-url=https://web.archive.org/web/20160731200244/http://ics.sans.org/blog/2016/01/01/potential-sample-of-malware-from-the-ukrainian-cyber-attack-uncovered |url-status=live }}</ref><ref>{{Cite web |year=2016 |title=First known hacker-caused power outage signals troubling escalation |url=https://arstechnica.com/security/2016/01/first-known-hacker-caused-power-outage-signals-troubling-escalation/ |website=Ars Technica |access-date=14 June 2017 |archive-date=16 June 2017 |archive-url=https://web.archive.org/web/20170616195550/https://arstechnica.com/security/2016/01/first-known-hacker-caused-power-outage-signals-troubling-escalation/ |url-status=live }}</ref><ref>{{Cite web |title=Ukraine power grid attacks continue but BlackEnergy malware ruled out |url=http://www.v3.co.uk/v3-uk/news/2440469/ukraine-investigating-suspected-russian-cyber-attack-on-power-grid |access-date=6 January 2016 |archive-date=6 January 2016 |archive-url=https://web.archive.org/web/20160106060404/http://www.v3.co.uk/v3-uk/news/2440469/ukraine-investigating-suspected-russian-cyber-attack-on-power-grid |url-status=live }}</ref><ref>{{Cite news |date=25 February 2016 |title=U.S. government concludes cyber attack caused Ukraine power outage |work=Reuters |url=https://www.reuters.com/article/us-ukraine-cybersecurity-idUSKCN0VY30K |access-date=1 August 2016 |archive-date=21 April 2016 |archive-url=https://web.archive.org/web/20160421051828/http://www.reuters.com/article/us-ukraine-cybersecurity-idUSKCN0VY30K |url-status=live }}</ref><ref>{{Cite web |title=BlackEnergy malware activity spiked in runup to Ukraine power grid takedown |url=https://www.theregister.co.uk/2016/03/04/ukraine_blackenergy_confirmation/ |access-date=26 December 2016 |publisher=The Register |archive-date=27 December 2016 |archive-url=https://web.archive.org/web/20161227055727/http://www.theregister.co.uk/2016/03/04/ukraine_blackenergy_confirmation/ |url-status=live }}</ref> A similar attack occurred in December 2016.<ref>{{Cite news |url=https://www.reuters.com/article/us-ukraine-cyber-attack-energy/ukraines-power-outage-was-a-cyber-attack-ukrenergo-idUSKBN1521BA |title=Ukraine's power outage was a cyber attack: Ukrenergo |newspaper=Reuters |date=18 January 2017 |access-date=25 February 2021 |archive-date=26 February 2021 |archive-url=https://web.archive.org/web/20210226170708/https://www.reuters.com/article/us-ukraine-cyber-attack-energy/ukraines-power-outage-was-a-cyber-attack-ukrenergo-idUSKBN1521BA |url-status=live }}</ref> | |||
In February 2021 Ukraine accused Russia of attacking the System of Electronic Interaction of Executive Bodies a web portal used by the Ukrainian government to circulate documents by uploaded documents that contained ] which if downloaded and enabled would lead to the computer to secretly download ] that would allow hackers to take over a computer.<ref>{{Cite web |url=https://www.zdnet.com/article/ukraine-reports-cyber-attack-on-government-document-management-system/ |title=Ukraine reports cyber-attack on government document management system |website=] |access-date=25 February 2021 |archive-date=25 February 2021 |archive-url=https://web.archive.org/web/20210225180459/https://www.zdnet.com/article/ukraine-reports-cyber-attack-on-government-document-management-system/ |url-status=live }}</ref><ref>{{Cite web |url=https://arstechnica.com/information-technology/2021/02/ukraine-says-russia-hacked-its-document-portal-and-planted-malicious-files/ |title=Ukraine says Russia hacked its document portal and planted malicious files |date=24 February 2021 |access-date=25 February 2021 |archive-date=25 February 2021 |archive-url=https://web.archive.org/web/20210225193612/https://arstechnica.com/information-technology/2021/02/ukraine-says-russia-hacked-its-document-portal-and-planted-malicious-files/ |url-status=live }}</ref> | |||
In January 2022, a ] took down the website of the Ministry of Foreign Affairs and other government agencies.<ref>{{cite news |last1=Harding |first1=Luke |title=Ukraine hit by 'massive' cyber-attack on government websites |url=https://www.theguardian.com/world/2022/jan/14/ukraine-massive-cyber-attack-government-websites-suspected-russian-hackers |access-date=14 January 2022 |work=The Guardian}}</ref> Although an investigation has not been conclusive the cyber attacks coincide with the ]. | |||
In February 2022, before and after Russian troops entered eastern Ukraine amid an environment of escalating tensions between Ukraine and Russia, several major Ukrainian governmental and business websites were taken down by a series of cyberattacks. U.S. officials attributed the attacks to Russian attackers, although the Russian government denied involvement.<ref>{{cite web |url=https://www.cnbc.com/2022/02/23/cyberattack-hits-ukrainian-banks-and-government-websites.html|title=Cyberattack hits Ukrainian banks and government websites|date=2022-02-23 |publisher=CBNC |author=Lauren Feiner |access-date=2022-02-23 |archive-url=https://archive.today/20220223214418/https://www.cnbc.com/2022/02/23/cyberattack-hits-ukrainian-banks-and-government-websites.html|archive-date=2022-02-23}}</ref> | |||
====2014 Ukrainian presidential election==== | |||
Pro-Russian hackers launched a series of cyberattacks over several days to disrupt the May 2014 ], releasing hacked emails, attempting to alter vote tallies, and delaying the final result with ]s.<ref name="Wanton Destruction">{{Cite web |last=Clayton |first=Mark |date=17 June 2014 |title=Ukraine election narrowly avoided 'wanton destruction' from hackers |url=https://www.csmonitor.com/World/Passcode/2014/0617/Ukraine-election-narrowly-avoided-wanton-destruction-from-hackers |access-date=16 August 2017 |website=] |archive-date=13 October 2020 |archive-url=https://web.archive.org/web/20201013043238/https://www.csmonitor.com/World/Passcode/2014/0617/Ukraine-election-narrowly-avoided-wanton-destruction-from-hackers |url-status=live }}</ref><ref name="Obama Warned">{{Cite web |last=Watkins |first=Ali |date=14 August 2017 |title=Obama team was warned in 2014 about Russian interference |url=http://www.politico.com/story/2017/08/14/obama-russia-election-interference-241547 |access-date=16 August 2017 |website=] |archive-date=6 October 2020 |archive-url=https://web.archive.org/web/20201006071815/https://www.politico.com/story/2017/08/14/obama-russia-election-interference-241547 |url-status=live }}</ref> Malware that would have displayed a graphic declaring far-right candidate ] the electoral winner was removed from Ukraine's ] less than an hour before polls closed. Despite this, ] "reported that Mr. Yarosh had won and broadcast the fake graphic, citing the election commission's website, even though it had never appeared there."<ref name="Wanton Destruction" /><ref name="Malware Expert">{{Cite web |last1=Kramer |first1=Andrew E. |last2=Higgins |first2=Andrew |date=16 August 2017 |title=In Ukraine, a Malware Expert Who Could Blow the Whistle on Russian Hacking |url=https://www.nytimes.com/2017/08/16/world/europe/russia-ukraine-malware-hacking-witness.html |access-date=16 August 2017 |website=] |archive-date=25 October 2020 |archive-url=https://web.archive.org/web/20201025114643/https://www.nytimes.com/2017/08/16/world/europe/russia-ukraine-malware-hacking-witness.html |url-status=live }}</ref> According to ]: "These faked results were geared for a specific audience in order to feed the Russian narrative that has claimed from the start that ultra-nationalists and ] were behind the ]."<ref name="Wanton Destruction" /> | |||
===United Kingdom "Brexit" referendum=== | |||
{{Main article|Russian interference in the 2016 Brexit referendum}} | |||
In the run up to the ] on the United Kingdom exiting the ] ("]"), Prime Minister ] suggested that Russia "might be happy" with a positive Brexit vote, while the Remain campaign accused the ] of secretly backing a positive Brexit vote.<ref>S Rosenberg, 'EU referendum: What does Russia gain from Brexit?' (26 June 2016) {{Webarchive|url=https://web.archive.org/web/20180624085539/https://www.bbc.co.uk/news/world-europe-36629146 |date=24 June 2018 }}</ref> In December 2016, ] claimed in Parliament that Russia had interfered in the Brexit referendum campaign.<ref>''Highly probable' that Russia interfered in Brexit referendum, Labour MP says' (13 December 2016) {{Webarchive|url=https://web.archive.org/web/20161213201335/http://www.independent.co.uk/news/uk/politics/russian-interference-brexit-highly-probable-referendum-hacking-putin-a7472706.html |date=13 December 2016 }}''</ref> In February 2017, Bradshaw called on the British intelligence service, ], then under ] as Foreign Secretary, to reveal the information it had on Russian interference.<ref>J Kanter and A Bienkov, 'Labour MPs think the government is hiding info about Russia interfering with Brexit' (23 February 2016) </ref> In April 2017, the ] ] issued a report stating, in regard to the June 2016 collapse of the government's voter registration website less than two hours prior to the originally scheduled registration deadline (which was then extended), that "the crash had indications of being a DDOS 'attack.'" The report also stated that there was "no direct evidence" supporting "these allegations about foreign interference". A ] spokeswoman responded to the report: "We have been very clear about the cause of the website outage in June 2016. It was due to a spike in users just before the registration deadline. There is no evidence to suggest malign intervention."<ref>{{Cite web |last=Syal |first=Rajeev |date=12 April 2017 |title=Brexit: foreign states may have interfered in vote, report says |url=https://www.theguardian.com/politics/2017/apr/12/foreign-states-may-have-interfered-in-brexit-vote-report-says |access-date=21 October 2017 |website=] |archive-date=1 October 2017 |archive-url=https://web.archive.org/web/20171001030832/https://www.theguardian.com/politics/2017/apr/12/foreign-states-may-have-interfered-in-brexit-vote-report-says |url-status=live }}</ref><ref>{{Cite web |last=Teffer |first=Peter |date=12 April 2017 |title=MPs and media create Brexit hacking scare |url=https://euobserver.com/uk-referendum/137581 |access-date=21 October 2017 |website=] |archive-date=21 October 2017 |archive-url=https://web.archive.org/web/20171021163627/https://euobserver.com/uk-referendum/137581 |url-status=live }}</ref> | |||
In June 2017, it was reported by '']'' that "Leave" campaigner ] was a "person of interest" in the United States ] into Russian interference in the United States 2016 Presidential election.<ref>' {{Webarchive|url=https://web.archive.org/web/20170602002544/https://www.theguardian.com/politics/2017/jun/01/nigel-farage-is-person-of-interest-in-fbi-investigation-into-trump-and-russia |date=2 June 2017 }}' (2 June 2017) Guardian</ref> In October 2017, Members of Parliament in the ] demanded that Facebook, Twitter, Google and other social media corporations, to disclose all adverts and details of payments by Russia in the Brexit campaign.<ref>'MPs order Facebook to hand over evidence of Russian election meddling' (24 October 2017) {{Webarchive|url=https://web.archive.org/web/20171216043301/http://www.telegraph.co.uk/technology/2017/10/24/mps-order-facebook-hand-evidence-russian-election-meddling/ |date=16 December 2017 }}</ref> | |||
In December 2023 the UK and its allies have accused Russia of a sustained cyber attacks dating back at least from 2015 until 2023. These attacks have included targeting parliamentarians from various political parties as well as universities, journalists and NGOs. The ''Star Blizzard'' group has been named as the group behind the attack is also thought to be subordinate to the Russian government.<ref>{{Cite web |title=UK and allies expose Russian intelligence services for cyber campaign of attempted political interference |url=https://www.ncsc.gov.uk/news/uk-and-allies-expose-cyber-campaign-attempted-political-interference |access-date=2023-12-07 |website=www.ncsc.gov.uk |language=en}}</ref> | |||
===United States=== | |||
{{see also|Russian interference in the 2016 United States elections|Russian interference in the 2018 United States elections|Russian interference in the 2020 United States elections|Russian interference in the 2024 United States elections}} | |||
] | |||
In 1999, ] was the US investigation of a 1996-1999 Russian cyberattack against NASA, the Pentagon, the US military, civilian academics and government agencies. The cyberattack was attributed to Russian-state-sponsored hackers.<ref>{{Cite web |last=Kaplan |first=Fred |title=How the United States Learned to Cyber Sleuth: The Untold Story |url=https://www.politico.com/magazine/story/2016/03/russia-cyber-war-fred-kaplan-book-213746 |access-date=2022-08-16 |website=POLITICO Magazine |date=20 March 2016 |language=en}}</ref><ref name=":1">{{Cite web |title=New Evidence Links a 20-Year-Old Hack on the US Government to a Modern Attack Group |url=https://www.vice.com/en/article/vvk83b/moonlight-maze-turla-link |access-date=2022-08-16 |website=www.vice.com |date=4 April 2017 |language=en}}</ref><ref>{{Cite news |last=Loeb |first=Vernon |date=2001-05-07 |title=NSA Adviser Says Cyber-Assaults On Pentagon Persist With Few Clues |language=en-US |newspaper=Washington Post |url=https://www.washingtonpost.com/archive/politics/2001/05/07/nsa-adviser-says-cyber-assaults-on-pentagon-persist-with-few-clues/cd04af8b-197c-4dce-95a1-f702542b0ff3/ |access-date=2022-08-16 |issn=0190-8286}}</ref> | |||
The ] was connected to Russian language threat actors.<ref>{{Cite news |last=III |first=William J. Lynn |date=2020-10-16 |title=Defending a New Domain |language=en-US |url=https://www.foreignaffairs.com/articles/united-states/2010-09-01/defending-new-domain |access-date=2022-08-16 |issn=0015-7120}}</ref> | |||
In April 2015, ] reported that "Russian hackers" had "penetrated sensitive parts of the White House" computers in "recent months". It was said that the FBI, the Secret Service, and other U.S. intelligence agencies categorized the attacks as "among the most sophisticated attacks ever launched against U.S. government systems."<ref>{{Cite news |last1=Evan Perez |last2=Shimon Prokupecz |author-link2=Shimon Prokupecz |date=8 April 2015 |title=How the U.S. thinks Russians hacked the White House |work=CNN |url=http://edition.cnn.com/2015/04/07/politics/how-russians-hacked-the-wh/index.html |access-date=17 December 2016 |quote=Russian hackers behind the damaging cyber intrusion of the State Department in recent months used that perch to penetrate sensitive parts of the White House computer system, according to U.S. officials briefed on the investigation. |archive-date=19 May 2019 |archive-url=https://web.archive.org/web/20190519030105/https://edition.cnn.com/2015/04/07/politics/how-russians-hacked-the-wh/index.html |url-status=live }}</ref> | |||
In 2015, CNN reported that Russian hackers, likely working for the Russian government, are suspected in the State Department hack. Federal law enforcement, intelligence and congressional officials briefed on the investigation say the hack of the State Department email system is the "worst ever" cyberattack intrusion against a federal agency.<ref>{{Cite web |last=Evan Perez and Shimon Prokupecz |title=Sources: State Dept Hack the 'worst ever' |url=http://www.cnn.com/2015/03/10/politics/state-department-hack-worst-ever/index.html |access-date=5 February 2017 |website=CNN |date=10 March 2015 |archive-date=1 February 2017 |archive-url=https://web.archive.org/web/20170201171531/http://www.cnn.com/2015/03/10/politics/state-department-hack-worst-ever/index.html |url-status=live }}</ref> | |||
In February 2016, senior ] advisor and top Russian cyber official Andrey Krutskikh told the Russian national security conference in Moscow that Russia was working on new strategies for the "information arena" that was equivalent to testing a ] and would "allow us to talk to the Americans as equals".<ref>{{Cite news |last=Ignatius |first=David |date=18 January 2017 |title=Russia's radical new strategy for information warfare |agency=The Washington Post |url=https://www.washingtonpost.com/blogs/post-partisan/wp/2017/01/18/russias-radical-new-strategy-for-information-warfare/ |access-date=22 March 2017 |archive-date=23 March 2017 |archive-url=https://web.archive.org/web/20170323054427/https://www.washingtonpost.com/blogs/post-partisan/wp/2017/01/18/russias-radical-new-strategy-for-information-warfare/ |url-status=live }}</ref> | |||
In 2016, the release of hacked emails belonging to the ], ], and ], among others, through ] and ] was said by private sector analysts<ref>{{Cite news |last1=Thielman |first1=Sam |last2=Ackerman |first2=Spencer |date=29 July 2016 |title=Cozy Bear and Fancy Bear: did Russians hack Democratic party and if so, why? |work=] |url=https://www.theguardian.com/technology/2016/jul/29/cozy-bear-fancy-bear-russia-hack-dnc |access-date=12 December 2016 |archive-date=15 December 2016 |archive-url=https://web.archive.org/web/20161215055333/https://www.theguardian.com/technology/2016/jul/29/cozy-bear-fancy-bear-russia-hack-dnc |url-status=live }}</ref> and US intelligence services<ref>{{Cite news |last1=Ackerman |first1=Spencer |last2=Thielman |first2=Sam |date=8 October 2016 |title=US officially accuses Russia of hacking DNC and interfering with election |url=https://www.theguardian.com/technology/2016/oct/07/us-russia-dnc-hack-interfering-presidential-election |access-date=12 December 2016 |archive-date=7 October 2016 |archive-url=https://web.archive.org/web/20161007222925/https://www.theguardian.com/technology/2016/oct/07/us-russia-dnc-hack-interfering-presidential-election |url-status=live }}</ref> to have been of Russian origin.<ref>{{Cite news |last=Corera |first=Gordon |date=22 December 2016 |title=Can US election hack be traced to Russia? |work=BBC |url=https://www.bbc.com/news/world-us-canada-38370630 |access-date=23 December 2016 |archive-date=22 December 2016 |archive-url=https://web.archive.org/web/20161222235416/http://www.bbc.com/news/world-us-canada-38370630 |url-status=live }}</ref><ref>{{Cite web |last=Gallagher |first=Sean |title=Did the Russians "hack" the election? A look at the established facts |url=https://arstechnica.com/security/2016/12/the-public-evidence-behind-claims-russia-hacked-for-trump/ |access-date=23 December 2016 |website=arstechnica |date=12 December 2016 |archive-date=1 January 2017 |archive-url=https://web.archive.org/web/20170101144432/http://arstechnica.com/security/2016/12/the-public-evidence-behind-claims-russia-hacked-for-trump/ |url-status=live }}</ref> Also, in December 2016, Republicans and Democrats on the ] called for "a special select committee to investigate Russian attempts to influence the presidential election".<ref>{{Cite news |last=Savage |first=David |date=18 December 2016 |title='How much and what damage?' Senators call for a special committee to investigate Russian hacking |work=Los Angeles Times |url=https://www.latimes.com/nation/politics/la-na-senate-russian-hacking-20161218-story.html |access-date=20 December 2016 |archive-date=19 December 2016 |archive-url=https://web.archive.org/web/20161219211156/http://www.latimes.com/nation/politics/la-na-senate-russian-hacking-20161218-story.html |url-status=live }}</ref><ref>{{Cite news |last=Nakashima |first=Ellen |date=22 December 2016 |title=Cybersecurity firm finds evidence that Russian military unit was behind DNC hack |newspaper=The Washington Post |url=https://www.washingtonpost.com/world/national-security/cybersecurity-firm-finds-a-link-between-dnc-hack-and-ukrainian-artillery/2016/12/21/47bf1f5a-c7e3-11e6-bf4b-2c064d32a4bf_story.html?postshare=9631482406341944&tid=ss_fb-bottom |access-date=22 December 2016 |archive-date=9 September 2017 |archive-url=https://web.archive.org/web/20170909233453/https://www.washingtonpost.com/world/national-security/cybersecurity-firm-finds-a-link-between-dnc-hack-and-ukrainian-artillery/2016/12/21/47bf1f5a-c7e3-11e6-bf4b-2c064d32a4bf_story.html?postshare=9631482406341944&tid=ss_fb-bottom |url-status=live }}</ref> | |||
In 2018, the United States ] released an alert warning that the Russian government was executing "a multi-stage intrusion campaign by Russian government cyber actors who targeted small commercial facilities' networks where they staged malware, conducted spear phishing, and gained remote access into energy sector networks." It further noted that "fter obtaining access, the Russian government cyber actors conducted network reconnaissance, moved laterally, and collected information pertaining to Industrial Control Systems."<ref>{{Cite web |title=Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors {{pipe}} CISA |url=https://us-cert.cisa.gov/ncas/alerts/TA18-074A |website=us-cert.cisa.gov |date=16 March 2018 |access-date=23 October 2020 |archive-date=21 October 2020 |archive-url=https://web.archive.org/web/20201021195945/https://us-cert.cisa.gov/ncas/alerts/TA18-074A |url-status=live }}</ref> The hacks targeted at least a dozen U.S. power plants, in addition to water processing, aviation, and government facilities.<ref>{{Cite news |last1=Dlouhy |first1=Jennifer |last2=Riley |first2=Michael |date=15 March 2018 |title=Russian Hackers Attacking U.S. Power Grid and Aviation, FBI Warns |work=] |url=https://www.bloomberg.com/news/articles/2018-03-15/russian-hackers-attacking-u-s-power-grid-aviation-fbi-warns |access-date=23 July 2018 |archive-date=23 July 2018 |archive-url=https://web.archive.org/web/20180723122541/https://www.bloomberg.com/news/articles/2018-03-15/russian-hackers-attacking-u-s-power-grid-aviation-fbi-warns |url-status=live }}</ref> | |||
In June 2019, the ''New York Times'' reported that hackers from the ] planted malware potentially capable of disrupting the ].<ref name="Wired">{{cite magazine |title=How Not To Prevent a Cyberwar With Russia |url=https://www.wired.com/story/russia-cyberwar-escalation-power-grid/ |magazine=] |date=18 June 2019 |access-date=4 January 2021 |archive-date=23 June 2019 |archive-url=https://web.archive.org/web/20190623130404/https://www.wired.com/story/russia-cyberwar-escalation-power-grid/ |url-status=live }}</ref> According to '']'' senior writer ], "The Kremlin warned that the intrusions could escalate into a cyberwar between the two countries."<ref name="Wired"/> | |||
Over several months in 2020, a group known as APT29 or ], working for Russia's ], breached a top cybersecurity firm and multiple U.S. government agencies including the Treasury, Commerce, and Energy departments and the National Nuclear Security Administration.<ref>{{Cite web|last=Bertrand|first=Natasha|date=17 December 2020|title=Nuclear weapons agency breached amid massive cyber onslaught|url=https://www.politico.com/news/2020/12/17/nuclear-agency-hacked-officials-inform-congress-447855|access-date=18 December 2020|website=POLITICO|language=en|archive-date=17 December 2020|archive-url=https://web.archive.org/web/20201217222530/https://www.politico.com/news/2020/12/17/nuclear-agency-hacked-officials-inform-congress-447855|url-status=live}}</ref> The hacks occurred through a network management system called SolarWinds Orion. The U.S. government had an emergency meeting on 12 December 2020, and the press reported the hack the next day. When Russia's Foreign Intelligence Service performs such hacks, it is typically "for traditional espionage purposes, stealing information that might help the Kremlin understand the plans and motives of politicians and policymakers," according to ''The Washington Post,'' and not for the purpose of leaking information to the public.<ref>{{Cite news |last=Nakashima |first=Ellen |date=13 December 2020 |title=Russian government spies are behind a broad hacking campaign that has breached U.S. agencies and a top cyber firm |newspaper=The Washington Post |url=https://www.washingtonpost.com/national-security/russian-government-spies-are-behind-a-broad-hacking-campaign-that-has-breached-us-agencies-and-a-top-cyber-firm/2020/12/13/d5a53b88-3d7d-11eb-9453-fc36ba051781_story.html |access-date=13 December 2020 |archive-date=13 December 2020 |archive-url=https://web.archive.org/web/20201213220635/https://www.washingtonpost.com/national-security/russian-government-spies-are-behind-a-broad-hacking-campaign-that-has-breached-us-agencies-and-a-top-cyber-firm/2020/12/13/d5a53b88-3d7d-11eb-9453-fc36ba051781_story.html |url-status=live }}</ref> | |||
{{further|2020 United States federal government data breach}} | |||
In February 2021 a report by Dragos stated that ] has been targeting US electric utilities, oil and gas, and other industrial firms since at least 2017 and were successful in breaching these firms a "handful" of times.<ref>{{Cite magazine|title=Hackers Tied to Russia's GRU Targeted the US Grid for Years|language=en-us|magazine=Wired|url=https://www.wired.com/story/russia-gru-hackers-us-grid/|access-date=2 March 2021|issn=1059-1028|archive-date=2 March 2021|archive-url=https://web.archive.org/web/20210302130846/https://www.wired.com/story/russia-gru-hackers-us-grid/|url-status=live}}</ref><ref>{{Cite web|last=Palmer|first=Danny|title=These four new hacking groups are targeting critical infrastructure, warns security company|url=https://www.zdnet.com/article/these-four-new-hacking-groups-are-targeting-critical-infrastructure-warns-security-company/|access-date=2 March 2021|website=ZDNet|language=en|archive-date=2 March 2021|archive-url=https://web.archive.org/web/20210302051018/https://www.zdnet.com/article/these-four-new-hacking-groups-are-targeting-critical-infrastructure-warns-security-company/|url-status=live}}</ref> | |||
In May 2021, the ] was perpetrated by Russian language hacking group ].<ref>{{Cite web |title=Colonial Pipeline hack explained: Everything you need to know |url=https://www.techtarget.com/whatis/feature/Colonial-Pipeline-hack-explained-Everything-you-need-to-know |access-date=2022-08-16 |language=en}}</ref><ref>{{Cite web |title=FBI Statement on Compromise of Colonial Pipeline Networks |url=https://www.fbi.gov/news/press-releases/press-releases/fbi-statement-on-compromise-of-colonial-pipeline-networks |access-date=2022-08-16 |website=Federal Bureau of Investigation |language=en-us}}</ref> It was the largest cyberattack on an energy infrastructure target in US history. Colonial Pipeline temporarily halted the operations of the pipeline due to the ransomware attack.<ref name="politico">{{cite news |last1=Gonzalez |first1=Gloria |last2=Lefebvre |first2=Ben |last3=Geller |first3=Eric |date=May 8, 2021 |title='Jugular' of the U.S. fuel pipeline system shuts down after cyberattack |work=] |url=https://www.politico.com/news/2021/05/08/colonial-pipeline-cyber-attack-485984 |url-status=live |archive-url=https://web.archive.org/web/20210509154120/https://www.politico.com/news/2021/05/08/colonial-pipeline-cyber-attack-485984 |archive-date=May 9, 2021 |quote=The infiltration of a major fuel pipeline is "the most significant, successful attack on energy infrastructure we know of".}}</ref> The Department of Justice recovered the bitcoin ransom from the hackers.<ref>{{Cite web |date=2021-06-23 |title=Recovery of Colonial Pipeline ransom funds highlights traceability of cryptocurrency, experts say |url=https://www.thomsonreuters.com/en-us/posts/investigation-fraud-and-risk/colonial-pipeline-ransom-funds/ |access-date=2022-08-16 |website=Thomson Reuters Institute |language=en-US}}</ref> | |||
Reveiled in 2023, British authorities believed that ''Star Blizzard'' engaged in a cyberespionage campaign beginning in at least 2015 against U.K. lawmakers over several years. In December 2023, U.S. authorities charged two Russian men, who are believed to be located in Russia and were associated with the "Callisto Group," which is associated with "Cold River" and "Dancing Salome" and are managed by the ] (CIB or TsIB FSB),{{efn|The ] (CIB or TsIB FSB) ({{langx|ru|Центр информационной безопасности ФСБ (18-й центр) (ЦИБ ФСБ)}}) is known in London as "Star Blizzard" and in Washington as the "Callisto Group" and is also associated with SEABORGIUM or COLDRIVER or Dancing Salome.<ref name=RFI08122023>{{cite news |url=https://www.rfi.fr/ru/%D0%B2-%D0%BC%D0%B8%D1%80%D0%B5/20231208-%D0%BB%D0%BE%D0%BD%D0%B4%D0%BE%D0%BD-%D0%B8-%D0%B2%D0%B0%D1%88%D0%B8%D0%BD%D0%B3%D1%82%D0%BE%D0%BD-%D0%BE%D0%B1%D0%B2%D0%B8%D0%BD%D0%B8%D0%BB%D0%B8-%D0%BC%D0%BE%D1%81%D0%BA%D0%B2%D1%83-%D0%B2-%D0%BF%D0%BE%D0%BF%D1%8B%D1%82%D0%BA%D0%B0%D1%85-%D0%BA%D0%B8%D0%B1%D0%B5%D1%80%D0%B2%D0%BC%D0%B5%D1%88%D0%B0%D1%82%D0%B5%D0%BB%D1%8C%D1%81%D1%82%D0%B2%D0%B0-%D0%B2-%D0%B1%D1%80%D0%B8%D1%82%D0%B0%D0%BD%D1%81%D0%BA%D1%83%D1%8E-%D0%BF%D0%BE%D0%BB%D0%B8%D1%82%D0%B8%D0%BA%D1%83 |title=Лондон и Вашингтон обвинили Москву в попытках кибервмешательства в британскую политику: В четверг, 7 декабря, Великобритания и США заявили, что раскрыли попытки российского кибервмешательства в британскую политику, в частности, во время выборов 2019 года. В Лондоне вызвали посла России в министерство иностранных дел, а министерство юстиции США предъявило обвинения двум гражданам РФ, один из которых работает на ФСБ |trans-title=London and Washington accuse Moscow of trying to cyber interfere in British politics: On Thursday, December 7, the UK and the US said they had uncovered attempts by Russian cyber interference in British politics, in particular during the 2019 elections. In London, the Russian ambassador was summoned to the Ministry of Foreign Affairs, and the US Department of Justice brought charges against two citizens of the Russian Federation, one of whom works for the FSB |language=ru |work=] (rfi.fr) |date=8 December 2023 |access-date=9 October 2024 |archive-url=https://archive.today/20241009194235/https://www.rfi.fr/ru/%D0%B2-%D0%BC%D0%B8%D1%80%D0%B5/20231208-%D0%BB%D0%BE%D0%BD%D0%B4%D0%BE%D0%BD-%D0%B8-%D0%B2%D0%B0%D1%88%D0%B8%D0%BD%D0%B3%D1%82%D0%BE%D0%BD-%D0%BE%D0%B1%D0%B2%D0%B8%D0%BD%D0%B8%D0%BB%D0%B8-%D0%BC%D0%BE%D1%81%D0%BA%D0%B2%D1%83-%D0%B2-%D0%BF%D0%BE%D0%BF%D1%8B%D1%82%D0%BA%D0%B0%D1%85-%D0%BA%D0%B8%D0%B1%D0%B5%D1%80%D0%B2%D0%BC%D0%B5%D1%88%D0%B0%D1%82%D0%B5%D0%BB%D1%8C%D1%81%D1%82%D0%B2%D0%B0-%D0%B2-%D0%B1%D1%80%D0%B8%D1%82%D0%B0%D0%BD%D1%81%D0%BA%D1%83%D1%8E-%D0%BF%D0%BE%D0%BB%D0%B8%D1%82%D0%B8%D0%BA%D1%83 |archive-date=9 October 2024}}</ref>}} in connection with ''Star Blizzard'''s previous actions, which included targeting individuals and groups throughout the United States, Europe and in other NATO countries, many of which were supporting Ukraine during the ] and allegedly attempting to provide foreign malign influence campaigns to influence the United Kingdom’s 2019 elections in support of Russian government interests. In December 2023, United States authorities charged Andrey Korinets,{{efn|Andrey Stanislavovich Korinets ({{langx|ru|Андрей Станиславович Коринец}}; born 1988 or 1989), also known as Alexey Doguzhev or Alexei Doguzhiev ({{langx|ru|Алексей Догужев}}), is an IT worker and bodybuilder who resides in ] and allegedly is a member of "Cold River" which is managed by the ] (CIB or TsIB FSB) ({{langx|ru|Центр информационной безопасности ФСБ (18-й центр) (ЦИБ ФСБ)}}).<ref name=Reuters06012023>{{cite news |last1=Pearson |first1=James |last2=Bing |first2=Christopher |url=https://www.reuters.com/world/europe/russian-hackers-targeted-us-nuclear-scientists-2023-01-06/ |title=Exclusive: Russian hackers targeted U.S. nuclear scientists |work=] |date=6 January 2023 |access-date=9 October 2024 |archive-url=https://archive.today/20230106150421/https://www.reuters.com/world/europe/russian-hackers-targeted-us-nuclear-scientists-2023-01-06/ |archive-date=6 January 2023}}</ref>}} and the alleged FSB officer Ruslan Peretyatko,{{efn|Ruslan Aleksandrovich Peretyatko ({{langx|ru|Руслан Александрович Перетятько}}) allegedly is an FSB officer.<ref name=Reuters07122023>{{cite news |last1=Pearson |first1=James |last2=Bing |first2=Christopher |last3=Satter |first3=Raphael |url=https://www.reuters.com/world/uk/britain-summons-russian-ambassador-over-fsb-cyberespionage-2023-12-07/ |title=Britain, US sanction Russian hackers over years-long FSB cyberespionage campaign |work=] |date=7 December 2023 |access-date=9 October 2024 |archive-url=https://archive.today/20231207213658/https://www.reuters.com/world/uk/britain-summons-russian-ambassador-over-fsb-cyberespionage-2023-12-07/ |archive-date=7 December 2023}}</ref>}} who both are members of the "Callisto Group" and were associated with spear-phishing schemes, with conspiracy to commit computer fraud: both individuals were sanctioned by the governments of the United Kingdom and the United States with the United States State Department offering a reward of up to $10 million for information leading to their whereabouts and arrest, as well as the arrest of their accomplices.<ref name=RFI08122023/><ref name=Reuters06012023/><ref name=Reuters07122023/><ref name=NCSCstarblizzard>{{cite web |url=https://media.defense.gov/2023/Dec/07/2003353251/-1/-1/0/ADVISORY-RUSSIAN-FSB-CYBER-ACTOR-STAR-BLIZZARD-CONTINUES-WORLDWIDE-SPEAR-SPHISHING-CAMPAIGNS.PDF |title=Russian FSB cyber actor Star Blizzard continues worldwide spear-phishing campaigns. |work=] |date=7 December 2023 |access-date=9 October 2024 |archive-url=https://web.archive.org/web/20241009185020/https://media.defense.gov/2023/Dec/07/2003353251/-1/-1/0/ADVISORY-RUSSIAN-FSB-CYBER-ACTOR-STAR-BLIZZARD-CONTINUES-WORLDWIDE-SPEAR-SPHISHING-CAMPAIGNS.PDF |archive-date=9 October 2024}}</ref><ref>{{cite news |last=Dilanian |first=Ken |url=https://www.nbcnews.com/politics/justice-department/2-russian-intel-officers-charged-hacking-us-british-government-agencie-rcna128569 |title=2 Russian intel officers charged with hacking into U.S. and British government agencies: The suspects are accused of trying to influence British politics, including an election in 2019. |work=] |date=7 December 2023 |access-date=9 October 2024 |archive-url=https://archive.today/20241008064152/https://www.nbcnews.com/politics/justice-department/2-russian-intel-officers-charged-hacking-us-british-government-agencie-rcna128569 |archive-date=8 October 2024}}</ref><ref>{{cite news |url=https://www.kommersant.ru/doc/6381950 |title=Великобритания ввела санкции в отношении двух россиян из-за кибератак: Посла РФ вызвали в британский МИД из-за «российского вмешательства» |trans-title=UK imposes sanctions on two Russians over cyber attacks: Russian Ambassador Summoned to UK Foreign Office Over 'Russian Interference' |language=ru |work=] |date=7 December 2023 |access-date=9 October 2024 |archive-url=https://archive.today/20241009190357/https://www.kommersant.ru/doc/6381950 |archive-date=9 October 2024}}</ref><ref>{{cite news |url=https://www.kommersant.ru/doc/6382169 |title=США ввели санкции против двух россиян за связь с хакерской группой Callisto |trans-title=US imposes sanctions on two Russians for links to Callisto hacker group |language=ru |work=] |date=8 December 2023 |access-date=9 October 2024 |archive-url=https://archive.today/20241009185846/https://www.kommersant.ru/doc/6382169 |archive-date=9 October 2024}}</ref> | |||
In 2024, two members of the Cyber Army Russia Reborn, Yuliya Vladimirovna Pankratova, also known as YUliYA, and Olegovich Degtyarenko were sanctioned, by the U.S. Department of the Treasury for hacking water facilities in both the US and Poland, as well as disrupt operations at a facility in France.<ref name=":2">{{Cite web |title=Russian Hacktivists Sanctioned for Attacks on US Critical Infrastructure |url=https://www.darkreading.com/ics-ot-security/russian-hacktivists-sanctioned-attacks-us-critical-infrastructure |access-date=2024-07-24 |website=www.darkreading.com |language=en}}</ref> Also, the group hacked "the industrial control systems (ICSes) that control water storage tanks in Texas".<ref name=":2" /> In early May 2024, Degtyarenko wrote training materials on how to compromise SCADA systems.<ref name=":2" /> | |||
In October 2024, the United States Justice Department and Microsoft seized more than a hundred internet domains some of which were associated with the ] supported hacker ''Star Blizzard'' or "Callisto Group," which is also known as "Cold River" and "Dancing Salome" and are managed by the ] (CIB or TsIB FSB) ({{langx|ru|Центр информационной безопасности ФСБ (18-й центр) (ЦИБ ФСБ)}}), and which were used as "criminal proxies" and used ] schemes to target Russians living in the United States, nongovernmental organizations (NGOs), think tanks, and journalists according to Microsoft and United States State Department, Department of Energy, and Department of Defense officials, United States defense contractors, and former employees of the United States intelligence community according to the FBI. In some cases, the hackers were successful in obtaining information relating to nuclear energy-related research, United States foreign affairs and United States defense. According to Microsft's Digital Crimes Unit from January 2023 to August 2024, ''Star Blizzard'' targeted more than 30 different groups and at least 82 Microsoft customers which is "a rate of approximately one attack per week." Both the NGO-Information Sharing and Analysis Center, which is a nonprofit tech organization, and Microsoft, which had been tracking ''Star Blizzard'' since 2017, provided support during the investigations of ''Star Blizzard''.<ref name=NCSCstarblizzard/><ref>{{cite news |last=Kan |first=Michael |url=https://www.pcmag.com/news/microsoft-us-seize-domains-used-by-russian-state-sponsored-hackers |title=Microsoft, US Seize Domains Used by Russian State-Sponsored Hackers: Russians used 'seemingly legitimate email accounts to trick victims into revealing account credentials,' the DOJ says. Targets included Defense and State Department officials. |work=] (pcmag.com) |date=3 October 2024 |access-date=9 October 2024 |archive-url=https://archive.today/20241008163008/https://www.pcmag.com/news/microsoft-us-seize-domains-used-by-russian-state-sponsored-hackers |archive-date=8 October 2024}}</ref><ref>{{cite web |url=https://storage.courtlistener.com/recap/gov.uscourts.cand.436552/gov.uscourts.cand.436552.7.0.pdf |title=Justice Department's court affidavit to seize property |work=] |date=16 September 2024 |access-date=9 October 2024 |archive-url=https://web.archive.org/web/20241004035542/https://storage.courtlistener.com/recap/gov.uscourts.cand.436552/gov.uscourts.cand.436552.7.0.pdf |archive-date=4 October 2024}}</ref><ref>{{cite news |last=KLEPPER |first=DAVID |url=https://apnews.com/article/russia-hacking-microsoft-star-blizzard-fb41bfccbbe7aaecd10a0a93905d4c8a |title=The US and Microsoft disrupt a Russian hacking group targeting American officials and nonprofits |work=] |date=3 October 2024 |access-date=9 October 2024 |archive-url=https://archive.today/20241009175821/https://apnews.com/article/russia-hacking-microsoft-star-blizzard-fb41bfccbbe7aaecd10a0a93905d4c8a |archive-date=9 October 2024}}</ref><ref>{{cite news |last=Sganga |first=Nicole |url=https://www.cbsnews.com/news/us-microsoft-russia-domains-seized/ |title=U.S. and Microsoft seize dozens of domains tied to Russian hacking group |work=] |date=3 October 2024 |access-date=9 October 2024 |archive-url=https://archive.today/20241009181510/https://www.cbsnews.com/news/us-microsoft-russia-domains-seized/ |archive-date=9 October 2024}}</ref><ref>{{cite news |last=Lyngaas |first=Sean |url=https://edition.cnn.com/2024/10/03/politics/justice-department-microsoft-disrupt-russian-hacking/ |title=Justice Department and Microsoft disrupt Russian hacking operations aimed at US officials and civil society |work=] |date=3 October 2024 |access-date=9 October 2024 |archive-url=https://archive.today/20241009182128/https://edition.cnn.com/2024/10/03/politics/justice-department-microsoft-disrupt-russian-hacking/ |archive-date=9 October 2024}}</ref><ref>{{cite news |last=Manson |first=Katrina |url=https://www.bloomberg.com/news/articles/2024-10-03/us-takes-down-websites-used-by-hackers-linked-to-fsb-doj-says |title=US Takes Down Websites Used by Hackers Linked to Russian Intelligence Agents |work=] |date=3 October 2024 |access-date=9 October 2024 |archive-url=https://archive.today/20241003162329/https://www.bloomberg.com/news/articles/2024-10-03/us-takes-down-websites-used-by-hackers-linked-to-fsb-doj-says |archive-date=3 October 2024}}</ref><ref name=UNIAN>{{cite news |last=Бовсуновская |first=Карина (Bovsunovskaya, Karina) |url=https://www.unian.net/world/hakerskaya-ataka-rf-na-pravitelstvennye-sayty-ssha-rossiyane-pytalis-pohitit-konfidencialnuyu-informaciyu-12777195.html |title=Российские хакеры пытались атаковать правительственные учреждения США |trans-title=Russian hackers tried to attack US government agencies |language=ru |work=] (unian.net) |date=4 October 2024 |access-date=9 October 2024 |archive-url=https://archive.today/20241009200026/https://www.unian.net/world/hakerskaya-ataka-rf-na-pravitelstvennye-sayty-ssha-rossiyane-pytalis-pohitit-konfidencialnuyu-informaciyu-12777195.html |archive-date=9 October 2024}}</ref><ref name=Reuters03102024>{{cite news |last1=Ljunggren |first1=David |last2=Sanders |first2=Chris |url=https://www.reuters.com/world/us/us-says-it-has-disrupted-russian-efforts-commit-computer-fraud-2024-10-03/ |title=US says it disrupted Russian efforts to hack government agencies |work=] |date=3 October 2024 |access-date=9 October 2024 |archive-url=https://archive.today/20241009200543/https://www.reuters.com/world/us/us-says-it-has-disrupted-russian-efforts-commit-computer-fraud-2024-10-03/ |archive-date=9 October 2024}}</ref>{{efn|During the ], many cyber attacks on Ukraine allegedly were conducted by ].<ref name=UNIAN/>}} | |||
===Venezuela=== | |||
After the news website ] published a report on extrajudicial killings by the ], on 25 May 2019, the Venezuelan chapter of the ''Instituto de Prensa y Sociedad'' (IPYS), pointed out that the website was out of service due to an uncached request attack, denouncing that it originated from Russia.<ref>{{Cite news |date=27 May 2019 |title=Runrunes es víctima de ataques cibernéticos tras reportaje sobre las FAES |language=es |agency=Tal Cual |url=https://talcualdigital.com/index.php/2019/05/27/runrunes-es-victima-de-ataques-ciberneticos-por-reportaje-sobre-las-faes/ |access-date=27 May 2019 |archive-date=27 May 2019 |archive-url=https://web.archive.org/web/20190527201838/https://talcualdigital.com/index.php/2019/05/27/runrunes-es-victima-de-ataques-ciberneticos-por-reportaje-sobre-las-faes/ |url-status=live }}</ref> | |||
==False alarms== | |||
On 30 December 2016, ], a Vermont utility company, announced that code associated with the Russian hacking operation dubbed Grizzly Steppe had been found in their computers. Officials from the Department of Homeland Security, FBI and the Office of the Director of National Intelligence warned executives of the financial, utility and transportation industries about the malware code.<ref>{{Cite news |last=Eilperen, Juliet & |first=Entous, Adam |date=30 December 2016 |title=Russian operation hacked a Vermont utility, showing risk to U.S. electrical grid security, officials say |newspaper=The Washington Post |url=https://www.washingtonpost.com/world/national-security/russian-hackers-penetrated-us-electricity-grid-through-a-utility-in-vermont/2016/12/30/8fc90cc4-ceec-11e6-b8a2-8c2a61b0436f_story.html?hpid=hp_hp-top-table-main_electrichack-810pm%3Ahomepage%2Fstory |access-date=31 December 2016 |archive-date=5 January 2017 |archive-url=https://web.archive.org/web/20170105191945/https://www.washingtonpost.com/world/national-security/russian-hackers-penetrated-us-electricity-grid-through-a-utility-in-vermont/2016/12/30/8fc90cc4-ceec-11e6-b8a2-8c2a61b0436f_story.html?hpid=hp_hp-top-table-main_electrichack-810pm%3Ahomepage%2Fstory |url-status=live }}</ref> The first report by ''The Washington Post'' left the impression that the grid had been penetrated, but the hacked computer was not attached to the grid. A later version attached this disclaimer to the top of its report correcting that impression: "Editor's Note: An earlier version of this story incorrectly said that Russian hackers had penetrated the U.S. electric grid. Authorities say there is no indication of that so far. The computer at Burlington Electric that was hacked was not attached to the grid."<ref>{{Cite news |last1=Eilperin |first1=Juliet |last2=Entous |first2=Adam |date=31 December 2016 |title=Russian operation hacked a Vermont utility, showing risk to U.S. electrical grid security, officials say |newspaper=] |url=https://www.washingtonpost.com/world/national-security/russian-hackers-penetrated-us-electricity-grid-through-a-utility-in-vermont/2016/12/30/8fc90cc4-ceec-11e6-b8a2-8c2a61b0436f_story.html |access-date=16 January 2018 |archive-date=7 January 2018 |archive-url=https://web.archive.org/web/20180107002929/https://www.washingtonpost.com/world/national-security/russian-hackers-penetrated-us-electricity-grid-through-a-utility-in-vermont/2016/12/30/8fc90cc4-ceec-11e6-b8a2-8c2a61b0436f_story.html |url-status=live }}</ref> | |||
==See also== | ==See also== | ||
*] | * ] | ||
* ] | |||
*] | |||
* ] | |||
* ] | |||
* ] | |||
*'']'' | |||
* ] | |||
* ] | |||
* ] and ] (aka trolls from Olgino) | |||
* ] | |||
* ] | |||
==Notes== | |||
{{notelist}} | |||
==References== | ==References== | ||
{{reflist |
{{reflist|refs= | ||
<ref name="Poland_RU_FB_disinformation_2016_2019">{{Cite news |last=Flis |first=Daniel |date=24 April 2019 |title=Disinformation network on Facebook supported by Polish Deputy Minister of Digitization |publisher=vsquare.org |url=https://vsquare.org/disinformation-network-on-facebook-supported-by-polish-deputy-minister-of-digitization/ |url-status=live |access-date=2 June 2019 |archive-url=https://web.archive.org/web/20190710080202/https://vsquare.org/disinformation-network-on-facebook-supported-by-polish-deputy-minister-of-digitization/ |archive-date=10 July 2019}}</ref> | |||
}} | |||
==Further reading== | |||
* Bowen, A.S. (4 January 2021) . ]. | |||
* Ackerman, S. and Thielman, S. (8 October 2016) . ]. | |||
* Halpern, Sue, "The Drums of Cyberwar" (review of ], ''Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers'', Doubleday, 2019, 348 pp.), '']'', vol. LXVI, no. 20 (19 December 2019), pp. 14, 16, 20. | |||
{{Russian interference in the 2016 United States elections}} | |||
{{Cyberwarfare by country}}{{Disinformation}} | |||
{{DEFAULTSORT:Cyberwarfare By Russian State}} | |||
] | |||
] | ] | ||
] | ] | ||
] | ] | ||
] | ] | ||
] | |||
] |
Latest revision as of 11:49, 20 October 2024
Various types of cyberwarfare used by Russia against many nationsCyberwarfare by Russia includes denial of service attacks, hacker attacks, dissemination of disinformation and propaganda, participation of state-sponsored teams in political blogs, internet surveillance using SORM technology, persecution of cyber-dissidents and other active measures. According to investigative journalist Andrei Soldatov, some of these activities were coordinated by the Russian signals intelligence, which was part of the FSB and formerly a part of the 16th KGB department. An analysis by the Defense Intelligence Agency in 2017 outlines Russia's view of "Information Countermeasures" or IPb (informatsionnoye protivoborstvo) as "strategically decisive and critically important to control its domestic populace and influence adversary states", dividing 'Information Countermeasures' into two categories of "Informational-Technical" and "Informational-Psychological" groups. The former encompasses network operations relating to defense, attack, and exploitation and the latter to "attempts to change people's behavior or beliefs in favor of Russian governmental objectives."
Background
This section is an excerpt from Cyberwarfare.Cyberwarfare is the use of cyber attacks against an enemy state, causing comparable harm to actual warfare and/or disrupting vital computer systems. Some intended outcomes could be espionage, sabotage, propaganda, manipulation or economic warfare.
There is significant debate among experts regarding the definition of cyberwarfare, and even if such a thing exists. One view is that the term is a misnomer since no cyber attacks to date could be described as a war. An alternative view is that it is a suitable label for cyber attacks which cause physical damage to people and objects in the real world.
Many countries, including the United States, United Kingdom, Russia, China, Israel, Iran, and North Korea, have active cyber capabilities for offensive and defensive operations. As states explore the use of cyber operations and combine capabilities, the likelihood of physical confrontation and violence playing out as a result of, or part of, a cyber operation is increased. However, meeting the scale and protracted nature of war is unlikely, thus ambiguity remains.
The first instance of kinetic military action used in response to a cyber-attack resulting in the loss of human life was observed on 5 May 2019, when the Israel Defense Forces targeted and destroyed a building associated with an ongoing cyber-attack.Online presence
US journalist Pete Earley described his interviews with former senior Russian intelligence officer Sergei Tretyakov, who defected to the United States in 2000:
Sergei would send an officer to a branch of the New York Public Library where he could get access to the Internet without anyone knowing his identity. The officer would post the propaganda on various websites and send it in emails to US publications and broadcasters. Some propaganda would be disguised as educational or scientific reports. ... The studies had been generated at the Center by Russian experts. The reports would be 100% accurate
Tretyakov did not specify the targeted web sites, but made clear they selected the sites which are most convenient for distributing the specific information. According to him, during his work in New York City in the end of the 1990s, one of the most frequent subjects was the War in Chechnya.
According to a publication in Russian computer weekly Computerra, "just because it became known that anonymous editors are editing articles in English Misplaced Pages in the interests of UK and US intelligence and security services, it is also likely that Russian security services are involved in editing Russian Misplaced Pages, but this is not even interesting to prove it — because everyone knows that security bodies have a special place in the structure of our state"
Cyberattacks
It has been claimed that Russian security services organized a number of denial of service attacks as a part of their cyber-warfare against other countries, such as the 2007 cyberattacks on Estonia and the 2008 cyberattacks on Russia, South Ossetia, Georgia, and Azerbaijan. One identified young Russian hacker said that he was paid by Russian state security services to lead hacking attacks on NATO computers. He was studying computer sciences at the Department of the Defense of Information. His tuition was paid for by the FSB.
The Russian invasion of Ukraine in February 2022 saw renewed interest in information warfare, with the widespread dissemination of propaganda and misinformation on social media, by way of a large-scale Russian propaganda campaign on social media, especially in countries that abstained from voting on the United Nations Resolution ES-11/1 such as India, South Africa, and Pakistan. Bots played a disproportionate role in the dissemination of pro-Russian messages and amplified its proliferation in early-stage diffusion, especially on platforms like Twitter, where pro-Russian messages received ~251,000 retweets and thereby reached around 14.4 million users. Of these "spreaders", around 20.28% of the spreaders are classified as bots, most of which were created at the beginning of the invasion.
Estonia
Main article: 2007 cyberattacks on EstoniaIn April 2007, following a diplomatic row with Russia over a Soviet war memorial, Estonia was targeted by a series of cyberattacks on financial, media, and government websites which were taken down by an enormous volume of spam being transmitted by botnets in what is called a distributed denial-of-service attack. Online banking was made inaccessible, government employees were suddenly unable to communicate via e-mail, and media outlets could not distribute news. The attacks reportedly came from Russian IP addresses, online instructions were in Russian, and Estonian officials traced the systems controlling the cyberattacks back to Russia. However, some experts held doubts that the attacks were carried out by the Russian government itself. A year after the attack NATO founded the Cooperative Cyber Defence Centre of Excellence in Tallinn as a direct consequence of the attacks.
In response to the 2022 Russian invasion of Ukraine, Estonia has removed a Soviet-era tank monument near Narva. After its removal, Estonia was subject to "the most extensive cyberattack" since the 2007 cyberattacks.
France
Further information: 2017 Macron e-mail leaksIn 2015, the Paris-based French broadcasting service TV5Monde was attacked by hackers who used malicious software to attack and destroy the network's systems and take all twelve of its channels off the air. The attack was initially claimed by a group calling themselves the "Cyber Caliphate" however a more in-depth investigation by French authorities revealed the attack on the network had links to APT28, a GRU-affiliated hacker group. In May 2017, on the eve of the French presidential election, more than 20,000 e-mails belonging to the campaign of Emmanuel Macron were dumped on an anonymous file-sharing website, shortly after the campaign announced they had been hacked. Word of the leak spread rapidly through the Internet, facilitated by bots and spam accounts. An analysis by Flashpoint, an American cybersecurity firm, determined with "moderate confidence" that APT28 was the group behind the hacking and subsequent leak.
In February 2021 the Agence nationale de la sécurité des systèmes d'information said that "several French entities" were breached by Sandworm between late 2017 and 2020 by hacking French software company Centreon to deploy malware. Similar to the 2020 United States federal government data breach. The ANSSI said the breach "mostly affected information technology providers, especially web hosting providers". Russia has denied being behind the cyberattack. Centreon said in a statement that it "has taken note of the information" but disputed that the breach was linked to a vulnerability in their commercial software.
Georgia
Further information: Cyberattacks during the 2008 South Ossetia warOn 20 July 2008, the website of the Georgian president, Mikheil Saakashvili, was rendered inoperable for twenty-four hours by a series of denial of service attacks. Shortly after, the website of the National Bank of Georgia and the parliament were attacked by hackers who plastered images of Mikheil Saakashvili and former Nazi leader Adolf Hitler. During the war, many Georgian government servers were attacked and brought down, reportedly hindering communication and the dissemination of crucial information. According to technical experts, this is the first recorded instance in history of cyberattacks coinciding with an armed conflict.
An independent US-based research institute US Cyber Consequences Unit report stated the attacks had "little or no direct involvement from the Russian government or military". According to the institute's conclusions, some several attacks originated from the PCs of multiple users located in Russia, Ukraine and Latvia. These users were willingly participating in cyberwarfare, being supporters of Russia during the 2008 South Ossetia war, while some other attacks also used botnets.
Germany
In 2015, a high-ranking security official stated that it was "highly plausible" that a cybertheft of files from the German Parliamentary Committee investigating the NSA spying scandal, later published by WikiLeaks, was conducted by Russian hackers. In late 2016, Bruno Kahl, president of the Bundesnachrichtendienst warned of data breaches and misinformation-campaigns steered by Russia. According to Kahl, there are insights that cyberattacks occur with no other purpose than to create political uncertainty. Süddeutsche Zeitung reported in February 2017 that a year-long probe by German intelligence "found no concrete proof of disinformation campaigns targeting the government". By 2020 however German investigators had collected enough evidence to identify one suspect.
Hans-Georg Maaßen, head of the country's Federal Office for the Protection of the Constitution, noted "growing evidence of attempts to influence the federal election" in September 2017 and "increasingly aggressive cyber espionage" against political entities in Germany. The New York Times reported on 21 September 2017, three days before the German federal election, that there was little to suggest any Russian interference in the election. In 2021 the European Commission has accused Russia of trying to interfere in European democratic processes just days before the parliamentary election on September 26 in Germany.
Kyrgyzstan
Beginning in mid-January 2009, Kyrgyzstan's two main ISPs came under a large-scale DDoS attack, shutting down websites and e-mail within the country, effectively taking the nation offline. The attacks came at a time when the country's president, Kurmanbek Bakiyev, was being pressured by both domestic actors and Russia to close a U.S. air base in Kyrgyzstan. The Wall Street Journal reported the attacks had been carried out by a Russian "cyber-militia".
Poland
A three-year pro-Russian disinformation campaign on Facebook with an audience of 4.5 million Poles was discovered in early 2019 by OKO.press and Avaaz. The campaign published fake news and supported three Polish politicians and their websites: Adam Andruszkiewicz, former leader of the ultra-nationalist and neo-fascist All-Polish Youth and, as of 2019, Secretary of State in the Polish Ministry of Digitisation; Janusz Korwin-Mikke; and Leszek Miller, an active member of the Polish United Workers' Party during the communist epoch and a prime minister of Poland during the post-communist epoch. Facebook responded to the analysis by removing some of the web pages.
Romania
Main article: 2022 cyberattacks on RomaniaBetween late April and early May 2022, in the midst of the 2022 Russian invasion of Ukraine, multiple Romanian government, military, bank and mass media websites were taken down after a series of DDoS attacks, behind which was a pro-Kremlin hacking group, Killnet. The hacking group described the cyberattacks to be a response to a statement made by then-Senate president, Florin Cîțu that Romania would provide Ukraine with military equipment.
South Korea
According to two United States intelligence officials that talked to The Washington Post, and also the findings of cybersecurity analyst Michael Matonis, Russia is likely behind the cyber attacks against the 2018 Winter Olympics in South Korea. The worm responsible for these cyber attacks is known as "Olympic Destroyer".
The worm targeted all Olympic IT infrastructure, and succeeded in taking down WiFi, feeds to jumbotrons, ticketing systems, and other Olympic systems. It was timed to go off at the start of the opening ceremonies. It was unique in that the hackers attempted to use many false signatures to blame other countries such as North Korea and China.
Ukraine
Main article: Russo-Ukrainian cyberwarfareIn March 2014, a Russian cyber weapon called Snake or "Ouroboros" was reported to have created havoc on Ukrainian government systems. The Snake tool kit began spreading into Ukrainian computer systems in 2010. It performed Computer Network Exploitation (CNE), as well as highly sophisticated Computer Network Attacks (CNA).
From 2014 to 2016, according to CrowdStrike, the Russian APT Fancy Bear used Android malware to target the Ukrainian Army's Rocket Forces and Artillery. They distributed an infected version of an Android app whose original purpose was to control targeting data for the D-30 Howitzer artillery. The app, used by Ukrainian officers, was loaded with the X-Agent spyware and posted online on military forums. CrowdStrike claims the attack was successful, with more than 80% of Ukrainian D-30 Howitzers destroyed, the highest percentage loss of any artillery pieces in the army (a percentage that had never been previously reported and would mean the loss of nearly the entire arsenal of the biggest artillery piece of the Ukrainian Armed Forces.). According to the Ukrainian army, this number is incorrect and that losses in artillery weapons "were way below those reported" and that these losses "have nothing to do with the stated cause".
The U.S. government concluded after a study that a cyber attack caused a power outage in Ukraine which left more than 200,000 people temporarily without power. The Russian hacking group Sandworm or the Russian government were possibly behind the malware attack on the Ukrainian power grid as well as a mining company and a large railway operator in December 2015. A similar attack occurred in December 2016.
In February 2021 Ukraine accused Russia of attacking the System of Electronic Interaction of Executive Bodies a web portal used by the Ukrainian government to circulate documents by uploaded documents that contained macroscripts which if downloaded and enabled would lead to the computer to secretly download malware that would allow hackers to take over a computer.
In January 2022, a cyberattack on Ukraine took down the website of the Ministry of Foreign Affairs and other government agencies. Although an investigation has not been conclusive the cyber attacks coincide with the Russo-Ukrainian crisis.
In February 2022, before and after Russian troops entered eastern Ukraine amid an environment of escalating tensions between Ukraine and Russia, several major Ukrainian governmental and business websites were taken down by a series of cyberattacks. U.S. officials attributed the attacks to Russian attackers, although the Russian government denied involvement.
2014 Ukrainian presidential election
Pro-Russian hackers launched a series of cyberattacks over several days to disrupt the May 2014 Ukrainian presidential election, releasing hacked emails, attempting to alter vote tallies, and delaying the final result with distributed denial-of-service (DDOS) attacks. Malware that would have displayed a graphic declaring far-right candidate Dmytro Yarosh the electoral winner was removed from Ukraine's Central Election Commission less than an hour before polls closed. Despite this, Channel One Russia "reported that Mr. Yarosh had won and broadcast the fake graphic, citing the election commission's website, even though it had never appeared there." According to Peter Ordeshook: "These faked results were geared for a specific audience in order to feed the Russian narrative that has claimed from the start that ultra-nationalists and Nazis were behind the revolution in Ukraine."
United Kingdom "Brexit" referendum
Main article: Russian interference in the 2016 Brexit referendumIn the run up to the 2016 referendum on the United Kingdom exiting the European Union ("Brexit"), Prime Minister David Cameron suggested that Russia "might be happy" with a positive Brexit vote, while the Remain campaign accused the Kremlin of secretly backing a positive Brexit vote. In December 2016, Ben Bradshaw MP claimed in Parliament that Russia had interfered in the Brexit referendum campaign. In February 2017, Bradshaw called on the British intelligence service, Government Communications Headquarters, then under Boris Johnson as Foreign Secretary, to reveal the information it had on Russian interference. In April 2017, the House of Commons Public Administration and Constitutional Affairs Select Committee issued a report stating, in regard to the June 2016 collapse of the government's voter registration website less than two hours prior to the originally scheduled registration deadline (which was then extended), that "the crash had indications of being a DDOS 'attack.'" The report also stated that there was "no direct evidence" supporting "these allegations about foreign interference". A Cabinet Office spokeswoman responded to the report: "We have been very clear about the cause of the website outage in June 2016. It was due to a spike in users just before the registration deadline. There is no evidence to suggest malign intervention."
In June 2017, it was reported by The Guardian that "Leave" campaigner Nigel Farage was a "person of interest" in the United States Federal Bureau of Investigation into Russian interference in the United States 2016 Presidential election. In October 2017, Members of Parliament in the Culture, Media and Sport Committee demanded that Facebook, Twitter, Google and other social media corporations, to disclose all adverts and details of payments by Russia in the Brexit campaign.
In December 2023 the UK and its allies have accused Russia of a sustained cyber attacks dating back at least from 2015 until 2023. These attacks have included targeting parliamentarians from various political parties as well as universities, journalists and NGOs. The Star Blizzard group has been named as the group behind the attack is also thought to be subordinate to the Russian government.
United States
See also: Russian interference in the 2016 United States elections, Russian interference in the 2018 United States elections, Russian interference in the 2020 United States elections, and Russian interference in the 2024 United States electionsIn 1999, Moonlight Maze was the US investigation of a 1996-1999 Russian cyberattack against NASA, the Pentagon, the US military, civilian academics and government agencies. The cyberattack was attributed to Russian-state-sponsored hackers.
The 2008 cyberattack on the United States was connected to Russian language threat actors.
In April 2015, CNN reported that "Russian hackers" had "penetrated sensitive parts of the White House" computers in "recent months". It was said that the FBI, the Secret Service, and other U.S. intelligence agencies categorized the attacks as "among the most sophisticated attacks ever launched against U.S. government systems."
In 2015, CNN reported that Russian hackers, likely working for the Russian government, are suspected in the State Department hack. Federal law enforcement, intelligence and congressional officials briefed on the investigation say the hack of the State Department email system is the "worst ever" cyberattack intrusion against a federal agency.
In February 2016, senior Kremlin advisor and top Russian cyber official Andrey Krutskikh told the Russian national security conference in Moscow that Russia was working on new strategies for the "information arena" that was equivalent to testing a nuclear bomb and would "allow us to talk to the Americans as equals".
In 2016, the release of hacked emails belonging to the Democratic National Committee, John Podesta, and Colin Powell, among others, through DCLeaks and WikiLeaks was said by private sector analysts and US intelligence services to have been of Russian origin. Also, in December 2016, Republicans and Democrats on the Senate Committee on Armed Services called for "a special select committee to investigate Russian attempts to influence the presidential election".
In 2018, the United States Computer Emergency Response Team released an alert warning that the Russian government was executing "a multi-stage intrusion campaign by Russian government cyber actors who targeted small commercial facilities' networks where they staged malware, conducted spear phishing, and gained remote access into energy sector networks." It further noted that "fter obtaining access, the Russian government cyber actors conducted network reconnaissance, moved laterally, and collected information pertaining to Industrial Control Systems." The hacks targeted at least a dozen U.S. power plants, in addition to water processing, aviation, and government facilities.
In June 2019, the New York Times reported that hackers from the United States Cyber Command planted malware potentially capable of disrupting the Russian electrical grid. According to Wired senior writer Andy Greenberg, "The Kremlin warned that the intrusions could escalate into a cyberwar between the two countries."
Over several months in 2020, a group known as APT29 or Cozy Bear, working for Russia's Foreign Intelligence Service, breached a top cybersecurity firm and multiple U.S. government agencies including the Treasury, Commerce, and Energy departments and the National Nuclear Security Administration. The hacks occurred through a network management system called SolarWinds Orion. The U.S. government had an emergency meeting on 12 December 2020, and the press reported the hack the next day. When Russia's Foreign Intelligence Service performs such hacks, it is typically "for traditional espionage purposes, stealing information that might help the Kremlin understand the plans and motives of politicians and policymakers," according to The Washington Post, and not for the purpose of leaking information to the public.
Further information: 2020 United States federal government data breachIn February 2021 a report by Dragos stated that Sandworm has been targeting US electric utilities, oil and gas, and other industrial firms since at least 2017 and were successful in breaching these firms a "handful" of times.
In May 2021, the Colonial Pipeline ransomware attack was perpetrated by Russian language hacking group DarkSide. It was the largest cyberattack on an energy infrastructure target in US history. Colonial Pipeline temporarily halted the operations of the pipeline due to the ransomware attack. The Department of Justice recovered the bitcoin ransom from the hackers.
Reveiled in 2023, British authorities believed that Star Blizzard engaged in a cyberespionage campaign beginning in at least 2015 against U.K. lawmakers over several years. In December 2023, U.S. authorities charged two Russian men, who are believed to be located in Russia and were associated with the "Callisto Group," which is associated with "Cold River" and "Dancing Salome" and are managed by the FSB Information Security Center (18th Center) (CIB or TsIB FSB), in connection with Star Blizzard's previous actions, which included targeting individuals and groups throughout the United States, Europe and in other NATO countries, many of which were supporting Ukraine during the Russo-Ukrainian War and allegedly attempting to provide foreign malign influence campaigns to influence the United Kingdom’s 2019 elections in support of Russian government interests. In December 2023, United States authorities charged Andrey Korinets, and the alleged FSB officer Ruslan Peretyatko, who both are members of the "Callisto Group" and were associated with spear-phishing schemes, with conspiracy to commit computer fraud: both individuals were sanctioned by the governments of the United Kingdom and the United States with the United States State Department offering a reward of up to $10 million for information leading to their whereabouts and arrest, as well as the arrest of their accomplices.
In 2024, two members of the Cyber Army Russia Reborn, Yuliya Vladimirovna Pankratova, also known as YUliYA, and Olegovich Degtyarenko were sanctioned, by the U.S. Department of the Treasury for hacking water facilities in both the US and Poland, as well as disrupt operations at a facility in France. Also, the group hacked "the industrial control systems (ICSes) that control water storage tanks in Texas". In early May 2024, Degtyarenko wrote training materials on how to compromise SCADA systems.
In October 2024, the United States Justice Department and Microsoft seized more than a hundred internet domains some of which were associated with the FSB supported hacker Star Blizzard or "Callisto Group," which is also known as "Cold River" and "Dancing Salome" and are managed by the FSB Information Security Center (18th Center) (CIB or TsIB FSB) (Russian: Центр информационной безопасности ФСБ (18-й центр) (ЦИБ ФСБ)), and which were used as "criminal proxies" and used spear-phishing schemes to target Russians living in the United States, nongovernmental organizations (NGOs), think tanks, and journalists according to Microsoft and United States State Department, Department of Energy, and Department of Defense officials, United States defense contractors, and former employees of the United States intelligence community according to the FBI. In some cases, the hackers were successful in obtaining information relating to nuclear energy-related research, United States foreign affairs and United States defense. According to Microsft's Digital Crimes Unit from January 2023 to August 2024, Star Blizzard targeted more than 30 different groups and at least 82 Microsoft customers which is "a rate of approximately one attack per week." Both the NGO-Information Sharing and Analysis Center, which is a nonprofit tech organization, and Microsoft, which had been tracking Star Blizzard since 2017, provided support during the investigations of Star Blizzard.
Venezuela
After the news website Runrun.es published a report on extrajudicial killings by the Bolivarian National Police, on 25 May 2019, the Venezuelan chapter of the Instituto de Prensa y Sociedad (IPYS), pointed out that the website was out of service due to an uncached request attack, denouncing that it originated from Russia.
False alarms
On 30 December 2016, Burlington Electric Department, a Vermont utility company, announced that code associated with the Russian hacking operation dubbed Grizzly Steppe had been found in their computers. Officials from the Department of Homeland Security, FBI and the Office of the Director of National Intelligence warned executives of the financial, utility and transportation industries about the malware code. The first report by The Washington Post left the impression that the grid had been penetrated, but the hacked computer was not attached to the grid. A later version attached this disclaimer to the top of its report correcting that impression: "Editor's Note: An earlier version of this story incorrectly said that Russian hackers had penetrated the U.S. electric grid. Authorities say there is no indication of that so far. The computer at Burlington Electric that was hacked was not attached to the grid."
See also
- Cyberwarfare by China
- Cyberwarfare in the United States
- DarkSide (hacking group)
- List of cyber warfare forces
- Military history of the Russian Federation
- Mueller Report
- Timeline of Russian interference in the 2016 United States elections
- Timeline of Russian interference in the 2016 United States elections (July 2016 – election day)
- Web brigades and Internet Research Agency (aka trolls from Olgino)
- Vaccine hesitancy
- Vulkan files leak
Notes
- The FSB Information Security Center (18th Center) (CIB or TsIB FSB) (Russian: Центр информационной безопасности ФСБ (18-й центр) (ЦИБ ФСБ)) is known in London as "Star Blizzard" and in Washington as the "Callisto Group" and is also associated with SEABORGIUM or COLDRIVER or Dancing Salome.
- Andrey Stanislavovich Korinets (Russian: Андрей Станиславович Коринец; born 1988 or 1989), also known as Alexey Doguzhev or Alexei Doguzhiev (Russian: Алексей Догужев), is an IT worker and bodybuilder who resides in Syktyvkar and allegedly is a member of "Cold River" which is managed by the FSB Information Security Center (18th Center) (CIB or TsIB FSB) (Russian: Центр информационной безопасности ФСБ (18-й центр) (ЦИБ ФСБ)).
- Ruslan Aleksandrovich Peretyatko (Russian: Руслан Александрович Перетятько) allegedly is an FSB officer.
- During the Russo-Ukrainian War, many cyber attacks on Ukraine allegedly were conducted by GRU Unit 29155.
References
- Kantchev, Georgi; Strobel, Warren P. (2 January 2021). "How Russia's 'Info Warrior' Hackers Let Kremlin Play Geopolitics on the Cheap". Wall Street Journal. Archived from the original on 8 January 2021. Retrieved 12 January 2021.
- State control over the internet Archived 22 August 2009 at the Wayback Machine, a talk show by Yevgenia Albats at the Echo of Moscow, 22 January 2006; interview with Andrei Soldatov and others
- "Military Power Publications". www.dia.mil. Archived from the original on 26 September 2017. Retrieved 25 September 2017.
- Singer, P. W.; Friedman, Allan (March 2014). Cybersecurity and cyberwar: what everyone needs to know. Oxford University Press. ISBN 978-0-19-991809-6. OCLC 802324804.
- "Cyberwar – does it exist?". NATO. 13 June 2019. Retrieved 10 May 2019.
- Smith, Troy E. (2013). "Cyber Warfare: A Misrepresentation of the True Cyber Threat". American Intelligence Journal. 31 (1): 82–85. ISSN 0883-072X. JSTOR 26202046.
- Lucas, George (2017). Ethics and Cyber Warfare: The Quest for Responsible Security in the Age of Digital Warfare. Oxford University Press. p. 6. ISBN 978-0-19-027652-2.
- "Advanced Persistent Threat Groups". FireEye. Retrieved 10 May 2019.
- "APT trends report Q1 2019". securelist.com. 30 April 2019. Retrieved 10 May 2019.
- "GCHQ". www.gchq.gov.uk. Retrieved 10 May 2019.
- "Who are the cyberwar superpowers?". World Economic Forum. 4 May 2016. Retrieved 24 June 2021.
- Green, James A., ed. (7 November 2016). Cyber warfare: a multidisciplinary analysis. London: Routledge. ISBN 978-0-415-78707-9. OCLC 980939904.
- Newman, Lily Hay (6 May 2019). "What Israel's Strike on Hamas Hackers Means For Cyberwar". Wired. ISSN 1059-1028. Retrieved 10 May 2019.
- Liptak, Andrew (5 May 2019). "Israel launched an airstrike in response to a Hamas cyberattack". The Verge. Retrieved 10 May 2019.
- ^ Pete Earley, "Comrade J: The Untold Secrets of Russia's Master Spy in America After the End of the Cold War", Penguin Books, 2007, ISBN 978-0-399-15439-3, pages 194-195
- Is there only one truth? Archived 14 April 2009 at the Wayback Machine by Kivy Bird, Computerra, 26 November 2008
- "www.axisglobe.com". Archived from the original on 17 August 2016. Retrieved 1 August 2016.
- Cyberspace and the changing nature of warfare Archived 3 December 2008 at the Wayback Machine. Strategists must be aware that part of every political and military conflict will take place on the internet, says Kenneth Geers.
- Andrew Meier, Black Earth. W. W. Norton & Company, 2003, ISBN 0-393-05178-1, pages 15-16.
- "Social Media as a Propaganda Tool in the Russia-Ukraine Conflict". The Cairo Review of Global Affairs. 12 March 2023. Retrieved 1 February 2024.
- Geissler, Dominique; Bär, Dominik; Pröllochs, Nicolas; Feuerriegel, Stefan (December 2023). "Russian propaganda on social media during the 2022 invasion of Ukraine". EPJ Data Science. 12 (1): 1–20. arXiv:2211.04154. doi:10.1140/epjds/s13688-023-00414-5. ISSN 2193-1127.
- McGuinness, Damien (27 April 2017). "How a cyber attack transformed Estonia". BBC News. Archived from the original on 21 February 2018. Retrieved 24 February 2018.
- "10 Years After the Landmark Attack on Estonia, Is the World Better Prepared for Cyber Threats?". Foreign Policy. 27 April 2017. Archived from the original on 24 February 2018. Retrieved 24 February 2018.
- "Experts doubt Russian government launched DDoS attacks". SearchSecurity. 23 February 2018. Archived from the original on 24 February 2018. Retrieved 24 February 2018.
- "NATO launches cyber defence centre in Estonia". Military Space News, Nuclear Weapons, Missile Defense. 14 May 2008. Archived from the original on 11 August 2014. Retrieved 24 February 2018.
- "Estonia Removes Soviet-era Monument, Citing Public Order". Associated Press. 16 August 2022. Retrieved 18 August 2022.
- Pascale Davies (18 August 2022). "Estonia hit by 'most extensive' cyberattack since 2007 amid tensions with Russia over Ukraine war". Retrieved 18 August 2022.
- Corera, Gordon (10 October 2016). "How France's TV5 was almost destroyed". BBC News. Archived from the original on 15 March 2018. Retrieved 10 March 2018.
- "'Russian hackers' behind TV attack". BBC News. 9 June 2015. Archived from the original on 30 April 2018. Retrieved 10 March 2018.
- "Researchers link Macron hack to APT28 with 'moderate confidence'". Cyberscoop. 11 May 2017. Archived from the original on 16 January 2018. Retrieved 10 March 2018.
- Cimpanu, Catalin. "France: Russian state hackers targeted Centreon servers in years-long campaign". ZDNet. Archived from the original on 17 February 2021. Retrieved 18 February 2021.
- "France uncovers cybersecurity breaches linked to Russian hackers". France 24. 16 February 2021. Archived from the original on 17 February 2021. Retrieved 18 February 2021.
- "France identifies Russia-linked hackers in large cyberattack". POLITICO. 15 February 2021. Archived from the original on 17 February 2021. Retrieved 18 February 2021.
- Hart, Kim (14 August 2008). "Longtime Battle Lines Are Recast In Russia and Georgia's Cyberwar". The Washington Post. Archived from the original on 13 March 2018. Retrieved 12 March 2018.
- Markoff, John (13 August 2008). "Before the Gunfire, Cyberattacks". The New York Times. Archived from the original on 30 March 2019. Retrieved 12 March 2018.
- Siobhan Gorman (18 August 2009). "Hackers Stole IDs for Attacks". WSJ. Archived from the original on 10 August 2017. Retrieved 3 August 2017.
- "Georgian cyber attacks launched by Russian crime gangs". The Register. Archived from the original on 10 August 2017. Retrieved 10 August 2017.
- "Russia behind hack on German parliament, paper reports". Deutsche Welle. Archived from the original on 2 February 2017. Retrieved 30 January 2017.
- Wehner, Markus; Lohse, Eckart (11 December 2016). "Wikileaks: Sicherheitskreise: Russland hackte geheime Bundestagsakten". Faz.net. Frankfurter Allgemeine Zeitung. Archived from the original on 5 February 2017. Retrieved 30 January 2017.
- "Vor Bundestagswahl: BND warnt vor russischen Hackerangriffen". Der Spiegel. SPIEGEL ONLINE. 29 November 2016. Archived from the original on 1 February 2017. Retrieved 30 January 2017.
- "Was bedeuten die neuen Cyberangriffe für die Bundestagswahl?" (in German). 1 November 2016. Archived from the original on 2 February 2017. Retrieved 30 January 2017.
- "BND-Präsident warnt vor Cyberangriffen aus Russland". 29 November 2016. Archived from the original on 2 February 2017. Retrieved 30 January 2017.
- King, Esther (7 February 2017). "German intelligence finds no evidence of Russian meddling". Politico. Archived from the original on 21 October 2017. Retrieved 21 October 2017.
- "German authorities charge Russian hacker for 2015 Bundestag hack | ZDNet". ZDNet. Archived from the original on 29 July 2020. Retrieved 28 June 2020.
- "BfV: Russia is trying to destabilise Germany". AlJazeera. Archived from the original on 30 January 2017. Retrieved 30 January 2017.
- Schwirtz, Michael (21 September 2017). "German Election Mystery: Why No Russian Meddling?". The New York Times. Archived from the original on 21 October 2017. Retrieved 21 October 2017.
- Vasco Cotovio (24 September 2021). "Russia accused of 'Ghostwriter' cyberattacks ahead of German election". CNN. Retrieved 25 September 2021.
- Bradbury, Danny (5 February 2009). "Danny Bradbury investigates the cyberattack on Kyrgyzstan". The Guardian. Archived from the original on 13 March 2018. Retrieved 12 March 2018.
- Rhoads, Christopher (28 January 2009). "Kyrgyzstan Knocked Offline". WSJ. Archived from the original on 13 March 2018. Retrieved 12 March 2018.
- Flis, Daniel (24 April 2019). "Disinformation network on Facebook supported by Polish Deputy Minister of Digitization". vsquare.org. Archived from the original on 10 July 2019. Retrieved 2 June 2019.
- "UPDATE Atacul cibernetic care a vizat site-uri guvernamentale, printre care al Executivului și al Armatei, revendicat de hackeri ruși". www.digi24.ro (in Romanian). 29 April 2022. Retrieved 8 May 2022.
- "Site-urile marilor aeroporturi din România nu funcționează. Hackerii ruși de la Killnet revendică atacul". www.digi24.ro (in Romanian). 2 May 2022. Retrieved 8 May 2022.
- "Ce spune Marcel Ciolacu, preşedintele Camerei Deputaţilor, despre motivele invocate de hackerii Killnet: E o greşeală acolo". ZF.ro (in Romanian). Retrieved 8 May 2022.
- ^ "Inside Olympic Destroyer, the Most Deceptive Hack in History". Wired. ISSN 1059-1028. Archived from the original on 18 September 2020. Retrieved 26 August 2020.
- The Christian Science Monitor (12 March 2014). "Russia's cyber weapons hit Ukraine: How to declare war without declaring war". The Christian Science Monitor. Archived from the original on 14 March 2014. Retrieved 14 March 2014.
- Mazanec, Brain M. (2015). The Evolution of Cyber War. USA: University of Nebraska Press. pp. 221–222. ISBN 9781612347639.
- Ukraine's military denies Russian hack attack Archived 7 January 2017 at the Wayback Machine, Yahoo! News (6 January 2017)
- "Danger Close: Fancy Bear Tracking of Ukrainian Field Artillery Units". CrowdStrike. 22 December 2016. Archived from the original on 1 January 2017. Retrieved 2 January 2017.
- Defense ministry denies reports of alleged artillery losses because of Russian hackers' break into software Archived 7 January 2017 at the Wayback Machine, Interfax-Ukraine (6 January 2017)
- "Malware Found Inside Downed Ukrainian Grid Management Points to Cyberattack". Motherboard. 4 January 2016. Archived from the original on 7 January 2016. Retrieved 6 January 2016.
- "SANS Industrial Control Systems Security Blog - Potential Sample of Malware from the Ukrainian Cyber Attack Uncovered - SANS Institute". Archived from the original on 31 July 2016. Retrieved 1 August 2016.
- "First known hacker-caused power outage signals troubling escalation". Ars Technica. 2016. Archived from the original on 16 June 2017. Retrieved 14 June 2017.
- "Ukraine power grid attacks continue but BlackEnergy malware ruled out". Archived from the original on 6 January 2016. Retrieved 6 January 2016.
- "U.S. government concludes cyber attack caused Ukraine power outage". Reuters. 25 February 2016. Archived from the original on 21 April 2016. Retrieved 1 August 2016.
- "BlackEnergy malware activity spiked in runup to Ukraine power grid takedown". The Register. Archived from the original on 27 December 2016. Retrieved 26 December 2016.
- "Ukraine's power outage was a cyber attack: Ukrenergo". Reuters. 18 January 2017. Archived from the original on 26 February 2021. Retrieved 25 February 2021.
- "Ukraine reports cyber-attack on government document management system". ZDNet. Archived from the original on 25 February 2021. Retrieved 25 February 2021.
- "Ukraine says Russia hacked its document portal and planted malicious files". 24 February 2021. Archived from the original on 25 February 2021. Retrieved 25 February 2021.
- Harding, Luke. "Ukraine hit by 'massive' cyber-attack on government websites". The Guardian. Retrieved 14 January 2022.
- Lauren Feiner (23 February 2022). "Cyberattack hits Ukrainian banks and government websites". CBNC. Archived from the original on 23 February 2022. Retrieved 23 February 2022.
- ^ Clayton, Mark (17 June 2014). "Ukraine election narrowly avoided 'wanton destruction' from hackers". The Christian Science Monitor. Archived from the original on 13 October 2020. Retrieved 16 August 2017.
- Watkins, Ali (14 August 2017). "Obama team was warned in 2014 about Russian interference". Politico. Archived from the original on 6 October 2020. Retrieved 16 August 2017.
- Kramer, Andrew E.; Higgins, Andrew (16 August 2017). "In Ukraine, a Malware Expert Who Could Blow the Whistle on Russian Hacking". The New York Times. Archived from the original on 25 October 2020. Retrieved 16 August 2017.
- S Rosenberg, 'EU referendum: What does Russia gain from Brexit?' (26 June 2016) BBC News Archived 24 June 2018 at the Wayback Machine
- Highly probable' that Russia interfered in Brexit referendum, Labour MP says' (13 December 2016) Independent Archived 13 December 2016 at the Wayback Machine
- J Kanter and A Bienkov, 'Labour MPs think the government is hiding info about Russia interfering with Brexit' (23 February 2016) Business Insider
- Syal, Rajeev (12 April 2017). "Brexit: foreign states may have interfered in vote, report says". The Guardian. Archived from the original on 1 October 2017. Retrieved 21 October 2017.
- Teffer, Peter (12 April 2017). "MPs and media create Brexit hacking scare". EUobserver. Archived from the original on 21 October 2017. Retrieved 21 October 2017.
- 'Nigel Farage is 'person of interest' in FBI investigation into Trump and Russia Archived 2 June 2017 at the Wayback Machine' (2 June 2017) Guardian
- 'MPs order Facebook to hand over evidence of Russian election meddling' (24 October 2017) Telegraph Archived 16 December 2017 at the Wayback Machine
- "UK and allies expose Russian intelligence services for cyber campaign of attempted political interference". www.ncsc.gov.uk. Retrieved 7 December 2023.
- Kaplan, Fred (20 March 2016). "How the United States Learned to Cyber Sleuth: The Untold Story". POLITICO Magazine. Retrieved 16 August 2022.
- "New Evidence Links a 20-Year-Old Hack on the US Government to a Modern Attack Group". www.vice.com. 4 April 2017. Retrieved 16 August 2022.
- Loeb, Vernon (7 May 2001). "NSA Adviser Says Cyber-Assaults On Pentagon Persist With Few Clues". Washington Post. ISSN 0190-8286. Retrieved 16 August 2022.
- III, William J. Lynn (16 October 2020). "Defending a New Domain". ISSN 0015-7120. Retrieved 16 August 2022.
- Evan Perez; Shimon Prokupecz (8 April 2015). "How the U.S. thinks Russians hacked the White House". CNN. Archived from the original on 19 May 2019. Retrieved 17 December 2016.
Russian hackers behind the damaging cyber intrusion of the State Department in recent months used that perch to penetrate sensitive parts of the White House computer system, according to U.S. officials briefed on the investigation.
- Evan Perez and Shimon Prokupecz (10 March 2015). "Sources: State Dept Hack the 'worst ever'". CNN. Archived from the original on 1 February 2017. Retrieved 5 February 2017.
- Ignatius, David (18 January 2017). "Russia's radical new strategy for information warfare". The Washington Post. Archived from the original on 23 March 2017. Retrieved 22 March 2017.
- Thielman, Sam; Ackerman, Spencer (29 July 2016). "Cozy Bear and Fancy Bear: did Russians hack Democratic party and if so, why?". The Guardian. Archived from the original on 15 December 2016. Retrieved 12 December 2016.
- Ackerman, Spencer; Thielman, Sam (8 October 2016). "US officially accuses Russia of hacking DNC and interfering with election". Archived from the original on 7 October 2016. Retrieved 12 December 2016.
- Corera, Gordon (22 December 2016). "Can US election hack be traced to Russia?". BBC. Archived from the original on 22 December 2016. Retrieved 23 December 2016.
- Gallagher, Sean (12 December 2016). "Did the Russians "hack" the election? A look at the established facts". arstechnica. Archived from the original on 1 January 2017. Retrieved 23 December 2016.
- Savage, David (18 December 2016). "'How much and what damage?' Senators call for a special committee to investigate Russian hacking". Los Angeles Times. Archived from the original on 19 December 2016. Retrieved 20 December 2016.
- Nakashima, Ellen (22 December 2016). "Cybersecurity firm finds evidence that Russian military unit was behind DNC hack". The Washington Post. Archived from the original on 9 September 2017. Retrieved 22 December 2016.
- "Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors | CISA". us-cert.cisa.gov. 16 March 2018. Archived from the original on 21 October 2020. Retrieved 23 October 2020.
- Dlouhy, Jennifer; Riley, Michael (15 March 2018). "Russian Hackers Attacking U.S. Power Grid and Aviation, FBI Warns". Bloomberg. Archived from the original on 23 July 2018. Retrieved 23 July 2018.
- ^ "How Not To Prevent a Cyberwar With Russia". Wired. 18 June 2019. Archived from the original on 23 June 2019. Retrieved 4 January 2021.
- Bertrand, Natasha (17 December 2020). "Nuclear weapons agency breached amid massive cyber onslaught". POLITICO. Archived from the original on 17 December 2020. Retrieved 18 December 2020.
- Nakashima, Ellen (13 December 2020). "Russian government spies are behind a broad hacking campaign that has breached U.S. agencies and a top cyber firm". The Washington Post. Archived from the original on 13 December 2020. Retrieved 13 December 2020.
- "Hackers Tied to Russia's GRU Targeted the US Grid for Years". Wired. ISSN 1059-1028. Archived from the original on 2 March 2021. Retrieved 2 March 2021.
- Palmer, Danny. "These four new hacking groups are targeting critical infrastructure, warns security company". ZDNet. Archived from the original on 2 March 2021. Retrieved 2 March 2021.
- "Colonial Pipeline hack explained: Everything you need to know". Retrieved 16 August 2022.
- "FBI Statement on Compromise of Colonial Pipeline Networks". Federal Bureau of Investigation. Retrieved 16 August 2022.
- Gonzalez, Gloria; Lefebvre, Ben; Geller, Eric (8 May 2021). "'Jugular' of the U.S. fuel pipeline system shuts down after cyberattack". Politico. Archived from the original on 9 May 2021.
The infiltration of a major fuel pipeline is "the most significant, successful attack on energy infrastructure we know of".
- "Recovery of Colonial Pipeline ransom funds highlights traceability of cryptocurrency, experts say". Thomson Reuters Institute. 23 June 2021. Retrieved 16 August 2022.
- ^ "Лондон и Вашингтон обвинили Москву в попытках кибервмешательства в британскую политику: В четверг, 7 декабря, Великобритания и США заявили, что раскрыли попытки российского кибервмешательства в британскую политику, в частности, во время выборов 2019 года. В Лондоне вызвали посла России в министерство иностранных дел, а министерство юстиции США предъявило обвинения двум гражданам РФ, один из которых работает на ФСБ" [London and Washington accuse Moscow of trying to cyber interfere in British politics: On Thursday, December 7, the UK and the US said they had uncovered attempts by Russian cyber interference in British politics, in particular during the 2019 elections. In London, the Russian ambassador was summoned to the Ministry of Foreign Affairs, and the US Department of Justice brought charges against two citizens of the Russian Federation, one of whom works for the FSB]. Radio France Internationale (rfi.fr) (in Russian). 8 December 2023. Archived from the original on 9 October 2024. Retrieved 9 October 2024.
- ^ Pearson, James; Bing, Christopher (6 January 2023). "Exclusive: Russian hackers targeted U.S. nuclear scientists". Reuters. Archived from the original on 6 January 2023. Retrieved 9 October 2024.
- ^ Pearson, James; Bing, Christopher; Satter, Raphael (7 December 2023). "Britain, US sanction Russian hackers over years-long FSB cyberespionage campaign". Reuters. Archived from the original on 7 December 2023. Retrieved 9 October 2024.
- ^ "Russian FSB cyber actor Star Blizzard continues worldwide spear-phishing campaigns" (PDF). National Cyber Security Centre. 7 December 2023. Archived from the original (PDF) on 9 October 2024. Retrieved 9 October 2024.
- Dilanian, Ken (7 December 2023). "2 Russian intel officers charged with hacking into U.S. and British government agencies: The suspects are accused of trying to influence British politics, including an election in 2019". NBC News. Archived from the original on 8 October 2024. Retrieved 9 October 2024.
- "Великобритания ввела санкции в отношении двух россиян из-за кибератак: Посла РФ вызвали в британский МИД из-за «российского вмешательства»" [UK imposes sanctions on two Russians over cyber attacks: Russian Ambassador Summoned to UK Foreign Office Over 'Russian Interference']. «Коммерсантъ» (in Russian). 7 December 2023. Archived from the original on 9 October 2024. Retrieved 9 October 2024.
- "США ввели санкции против двух россиян за связь с хакерской группой Callisto" [US imposes sanctions on two Russians for links to Callisto hacker group]. «Коммерсантъ» (in Russian). 8 December 2023. Archived from the original on 9 October 2024. Retrieved 9 October 2024.
- ^ "Russian Hacktivists Sanctioned for Attacks on US Critical Infrastructure". www.darkreading.com. Retrieved 24 July 2024.
- Kan, Michael (3 October 2024). "Microsoft, US Seize Domains Used by Russian State-Sponsored Hackers: Russians used 'seemingly legitimate email accounts to trick victims into revealing account credentials,' the DOJ says. Targets included Defense and State Department officials". PCMag (pcmag.com). Archived from the original on 8 October 2024. Retrieved 9 October 2024.
- "Justice Department's court affidavit to seize property" (PDF). United States Department of Justice. 16 September 2024. Archived from the original (PDF) on 4 October 2024. Retrieved 9 October 2024.
- KLEPPER, DAVID (3 October 2024). "The US and Microsoft disrupt a Russian hacking group targeting American officials and nonprofits". Associated Press. Archived from the original on 9 October 2024. Retrieved 9 October 2024.
- Sganga, Nicole (3 October 2024). "U.S. and Microsoft seize dozens of domains tied to Russian hacking group". CBS News. Archived from the original on 9 October 2024. Retrieved 9 October 2024.
- Lyngaas, Sean (3 October 2024). "Justice Department and Microsoft disrupt Russian hacking operations aimed at US officials and civil society". CNN. Archived from the original on 9 October 2024. Retrieved 9 October 2024.
- Manson, Katrina (3 October 2024). "US Takes Down Websites Used by Hackers Linked to Russian Intelligence Agents". Bloomberg News. Archived from the original on 3 October 2024. Retrieved 9 October 2024.
- ^ Бовсуновская, Карина (Bovsunovskaya, Karina) (4 October 2024). "Российские хакеры пытались атаковать правительственные учреждения США" [Russian hackers tried to attack US government agencies]. УНІАН (unian.net) (in Russian). Archived from the original on 9 October 2024. Retrieved 9 October 2024.
{{cite news}}
: CS1 maint: multiple names: authors list (link) - Ljunggren, David; Sanders, Chris (3 October 2024). "US says it disrupted Russian efforts to hack government agencies". Reuters. Archived from the original on 9 October 2024. Retrieved 9 October 2024.
- "Runrunes es víctima de ataques cibernéticos tras reportaje sobre las FAES" (in Spanish). Tal Cual. 27 May 2019. Archived from the original on 27 May 2019. Retrieved 27 May 2019.
- Eilperen, Juliet &, Entous, Adam (30 December 2016). "Russian operation hacked a Vermont utility, showing risk to U.S. electrical grid security, officials say". The Washington Post. Archived from the original on 5 January 2017. Retrieved 31 December 2016.
{{cite news}}
: CS1 maint: multiple names: authors list (link) - Eilperin, Juliet; Entous, Adam (31 December 2016). "Russian operation hacked a Vermont utility, showing risk to U.S. electrical grid security, officials say". The Washington Post. Archived from the original on 7 January 2018. Retrieved 16 January 2018.
Further reading
- Bowen, A.S. (4 January 2021) "Russian Cyber Units". Congressional Research Service.
- Ackerman, S. and Thielman, S. (8 October 2016) "US Officially Accuses Russia of Hacking DNC and Interfering with Election". The Guardian.
- Halpern, Sue, "The Drums of Cyberwar" (review of Andy Greenberg, Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin's Most Dangerous Hackers, Doubleday, 2019, 348 pp.), The New York Review of Books, vol. LXVI, no. 20 (19 December 2019), pp. 14, 16, 20.
Cyberwarfare by country | |
---|---|