Cyberwarfare by Russia includes denial of service attacks, hacker attacks, dissemination of disinformation and propaganda, participation of state-sponsored teams in political blogs, internet surveillance using SORM technology, persecution of cyber-dissidents and other active measures. According to investigative journalist Andrei Soldatov, some of these activities have been coordinated by the Russian signals intelligence, which is part of the FSB and was formerly a part of the 16th KGB department.
An analysis by the Defense Intelligence Agency in 2017 outlines Russia's view of "Information Confrontation" or IPb (informatsionnoye protivoborstvo)
as "strategically decisive and critically important to control its
domestic populace and influence adversary states", delineating the term
'Information Confrontation' into two categories of
"Informational-Technical" and "Informational-Psychological" Effects. The
former encompasses network operations relating to defense, attack, and
exploitation with the latter relating to "attempts to change people's
behavior or beliefs in favor of Russian governmental objectives."
Online presence
Sergei would send an officer to a branch of New York Public Library where he could get access to the Internet without anyone knowing his identity. The officer would post the propaganda on various websites and send it in emails to US publications and broadcasters. Some propaganda would be disguised as educational or scientific reports. ... The studies had been generated at the Center by Russian experts. The reports would be 100% accurateTretyakov did not specify the targeted web sites, but made clear they selected the sites which are most convenient for distributing the specific disinformation. According to him, during his work in New York City in the end of the 1990s, one of the most frequent disinformation subjects was the War in Chechnya.
According to a publication in Russian computer weekly Computerra, "just because it became known that anonymous editors are editing articles in English Wikipedia in the interests of UK and US intelligence and security services, it is also likely that Russian security services are involved in editing Russian Wikipedia, but this is not even interesting to prove it — because everyone knows that security bodies have a special place in structure of our [Russian] state"
Cyberattacks
It has been claimed that Russian security services organized a number of denial of service attacks as a part of their cyber-warfare against other countries, such as the 2007 cyberattacks on Estonia and the 2008 cyberattacks on Russia, South Ossetia, Georgia, and Azerbaijan. One identified young Russian hacker said that he was paid by Russian state security services to lead hacking attacks on NATO computers. He was studying computer sciences at the Department of the Defense of Information. His tuition was paid for by the FSB.Estonia
In April 2007, following a diplomatic row with Russia over a Soviet war memorial, Estonia was targeted by a series of cyberattacks on financial, media, and government websites which were taken down by an enormous volume of spam being transmitted by botnets in what is called a distributed denial-of-service attack. Online banking was made inaccessible, government employees were suddenly unable to communicate via e-mail, and media outlets could not distribute news. The attacks reportedly came from Russian IP addresses, online instructions were in Russian, and Estonian officials traced the systems controlling the cyberattacks back to Russia. However, some experts held doubts that the attacks were carried out by the Russian government itself. A year after the attack NATO founded the Cooperative Cyber Defence Centre of Excellence in Tallinn as a direct consequence of the attacks.France
In 2015, the Paris-based French broadcasting service TV5Monde was attacked by hackers who used malicious software to attack and destroy the network's systems and take all twelve of its channels off the air. The attack was initially claimed by a group calling themselves the "Cyber Caliphate" however a more in-depth investigation by French authorities revealed the attack on the network had links to APT28, a GRU-affiliated hacker group. In May 2017, on the eve of the French presidential election, more than 20,000 e-mails belonging to the campaign of Emmanuel Macron were dumped on an anonymous file-sharing website, shortly after the campaign announced they had been hacked. Word of the leak spread rapidly through the Internet, facilitated by bots and spam accounts. An analysis by Flashpoint, an American cybersecurity firm, determined with "moderate confidence" that APT28 was the group behind the hacking and subsequent leak.Georgia
On 20 July 2008, the website of the Georgian president, Mikheil Saakashvili, was rendered inoperable for twenty-four hours by a series of denial of service attacks. Shortly after, the website of the National Bank of Georgia and the parliament were attacked by hackers who plastered images of Mikheil Saakashvili and former Nazi leader Adolf Hitler. During the war, many Georgian government servers were attacked and brought down, reportedly hindering communication and the dissemination of crucial information. According to technical experts, this is the first recorded instance in history of cyberattacks coinciding with an armed conflict.An independent US-based research institute US Cyber Consequences Unit report stated the attacks had "little or no direct involvement from the Russian government or military". According to the institute's conclusions, some several attacks originated from the PCs of multiple users located in Russia, Ukraine and Latvia. These users were willingly participating in cyberwarfare, being supporters of Russia during the 2008 South Ossetia war, while some other attacks also used botnets.
Germany
In 2015, a high-ranking security official stated that it was "highly plausible" that a cybertheft of files from the German Parliamentary Committee investigating the NSA spying scandal, later published by WikiLeaks, was conducted by Russian hackers. In late 2016, Bruno Kahl, president of the Bundesnachrichtendienst warned of data breaches and misinformation-campaigns steered by Russia. According to Kahl, there are insights that cyberattacks occur with no other purpose than to create political uncertainty. Süddeutsche Zeitung reported in February 2017 that a year-long probe by German intelligence "found no concrete proof of [Russian] disinformation campaigns targeting the government". Hans-Georg Maaßen, head of the country's Federal Office for the Protection of the Constitution, noted "growing evidence of attempts to influence the [next] federal election" in September 2017 and "increasingly aggressive cyber espionage" against political entities in Germany. The New York Times reported on September 21, 2017, three days before the German federal election, that there was little to suggest any Russian interference in the election.Kyrgyzstan
Beginning in mid-January 2009, Kyrgyzstan's two main ISPs came under a large-scale DDoS attack, shutting down websites and e-mail within the country, effectively taking the nation offline. The attacks came at a time when the country's president, Kurmanbek Bakiyev, was being pressured by both domestic actors and Russia to close a U.S. air base in Kyrgyzstan. The Wall Street Journal reported the attacks had been carried out by a Russian "cyber-militia".Ukraine
In March 2014, a Russian cyber weapon called Snake or "Ouroboros" was reported to have created havoc on Ukrainian government systems. The Snake tool kit began spreading into Ukrainian computer systems in 2010. It performed Computer Network Exploitation (CNE), as well as highly sophisticated Computer Network Attacks (CNA).From 2014 to 2016, according to CrowdStrike, the Russian APT Fancy Bear used Android malware to target the Ukrainian Army's Rocket Forces and Artillery. They distributed an infected version of an Android app whose original purpose was to control targeting data for the D-30 Howitzer artillery. The app, used by Ukrainian officers, was loaded with the X-Agent spyware and posted online on military forums. CrowdStrike claims the attack was successful, with more than 80% of Ukrainian D-30 Howitzers destroyed, the highest percentage loss of any artillery pieces in the army (a percentage that had never been previously reported and would mean the loss of nearly the entire arsenal of the biggest artillery piece of the Ukrainian Armed Forces.). According to the Ukrainian army, this number is incorrect and that losses in artillery weapons "were way below those reported" and that that these losses "have nothing to do with the stated cause".
The U.S. government concluded after a study that a cyber attack caused a power outage in Ukraine which left more than 200,000 people temporarily without power. The Russian hacking group Sandworm or the Russian government were possibly behind the malware attack on the Ukrainian power grid as well as a mining company and a large railway operator in December 2015.
2014 Ukrainian presidential election
Pro-Russian hackers launched a series of cyberattacks over several days to disrupt the May 2014 Ukrainian presidential election, releasing hacked emails, attempting to alter vote tallies, and delaying the final result with distributed denial-of-service (DDOS) attacks. Malware that would have displayed a graphic declaring far-right candidate Dmytro Yarosh the electoral winner was removed from Ukraine's Central Election Commission less than an hour before polls closed. Despite this, Channel One Russia "reported that Mr. Yarosh had won and broadcast the fake graphic, citing the election commission's website, even though it had never appeared there." According to Peter Ordeshook: "These faked results were geared for a specific audience in order to feed the Russian narrative that has claimed from the start that ultra-nationalists and Nazis were behind the revolution in Ukraine."United Kingdom "Brexit" referendum
In the run up to the referendum on the United Kingdom exiting the European Union ("Brexit"), Prime Minister David Cameron suggested that Russia "might be happy" with a positive Brexit vote, while the Remain campaign accused the Kremlin of secretly backing a positive Brexit vote. In December 2016, Ben Bradshaw MP claimed in Parliament that Russia had interfered in the Brexit referendum campaign. In February 2017, Bradshaw called on the British intelligence service, Government Communications Headquarters, currently under Boris Johnson as Foreign Secretary, to reveal the information it had on Russian interference. In April 2017, the House of Commons Public Administration and Constitutional Affairs Select Committee issued a report stating, in regard to the June 2016 collapse of the government's voter registration website less than two hours prior to the originally scheduled registration deadline (which was then extended), that "the crash had indications of being a DDOS 'attack.'" The report also stated that there was "no direct evidence" supporting "these allegations about foreign interference." A Cabinet Office spokeswoman responded to the report: "We have been very clear about the cause of the website outage in June 2016. It was due to a spike in users just before the registration deadline. There is no evidence to suggest malign intervention."In June 2017, it was reported by The Guardian that "Leave" campaigner Nigel Farage was a "person of interest" in the United States Federal Bureau of Investigation into Russian interference in the United States 2016 Presidential election. In October 2017, Members of Parliament in the Culture, Media and Sport Committee demanded that Facebook, Twitter, Google and other social media corporations, to disclose all adverts and details of payments by Russia in the Brexit campaign.
United States
Putin's Asymmetric Assault on Democracy in Russia and Europe: Implications for U.S. National Security
In April 2015, CNN reported that "Russian hackers" had "penetrated sensitive parts of the White House" computers in "recent months." It was said that the FBI, the Secret Service, and other U.S. intelligence agencies categorized the attacks as "among the most sophisticated attacks ever launched against U.S. government systems."
In 2015, CNN reported that Russian hackers, likely working for the Russian government, are suspected in the State Department hack. Federal law enforcement, intelligence and congressional officials briefed on the investigation say the hack of the State Department email system is the "worst ever" cyberattack intrusion against a federal agency.
In February 2016, senior Kremlin advisor and top Russian cyber official Andrey Krutskikh told the Russian national security conference in Moscow that Russia was working on new strategies for the "information arena" that was equivalent to testing a nuclear bomb and would "allow us to talk to the Americans as equals".
In 2016, the release of hacked emails belonging to the Democratic National Committee, John Podesta, and Colin Powell, among others, through DCLeaks and WikiLeaks was said by private sector analysts and US intelligence services to have been of Russian origin. Also, in December 2016, Republicans and Democrats on the Senate Committee on Armed Services called for "a special select committee to investigate Russian attempts to influence the presidential election".
In 2018, the United States Computer Emergency Response Team released an alert warning that the Russian government was executing "a multi-stage intrusion campaign by Russian government cyber actors who targeted small commercial facilities’ networks where they staged malware, conducted spear phishing, and gained remote access into energy sector networks." It further noted that "[a]fter obtaining access, the Russian government cyber actors conducted network reconnaissance, moved laterally, and collected information pertaining to Industrial Control Systems." The hacks targeted at least a dozen U.S. power plants, in addition to water processing, aviation, and government facilities.
False alarms
On December 30, 2016, Burlington Electric Department, a Vermont utility company, announced that a code associated with the Russian hacking operation dubbed Grizzly Steppe had been found in their computers. Officials from the Department of Homeland Security, FBI and the Office of the Director of National Intelligence warned executives of the financial, utility and transportation industries about the malware code. The first report by The Washington Post left the impression that the grid had been penetrated, but the hacked computer was not attached to the grid. A later version attached this disclaimer to the top of its report correcting that impression: "Editor's Note: An earlier version of this story incorrectly said that Russian hackers had penetrated the U.S. electric grid. Authorities say there is no indication of that so far. The computer at Burlington Electric that was hacked was not attached to the grid."In popular culture
Alleged FSB activities on the Internet have been described in the short story "Anastasya" by Russian writer Grigory Svirsky, who was interested in the moral aspects of their work. He wrote:"It seems that offending, betraying, or even "murdering" people in the virtual space is easy. This is like killing an enemy in a video game: one does not see a disfigured body or the eyes of the person who is dying right in front of you. However, the human soul lives by its own basic laws that force it to pay the price for the virtual crime in his real life".
