Are The Russians Really Attacking Us?

It seems that hardly a week goes by without some new cyber-attack being attributed to Fancy Bear, Cozy Bear, Grizzly Steppe, or some other cute-sounding Russian hacker collective.  One the one hand, we have the DHS, FBI, and US-CERT attributing these attacks to the Russians.  There are others, including those working in the cybersecurity profession, that are suggesting that the attackers are not agents of the Russian government, but merely opportunistic cyber-crime groups who are stealing data merely for it’s resale value on the Dark Web.  Politically, the supporters of Hillary Clinton’s campaign generally support the theory of Russian intervention, at least in the last Presidential election.  President Trump, and his supporters, would claim this is all “fake news.”  So what is the truth about Russian attacks against the US, it’s NATO allies, the Ukraine, and other former Soviet-block nations?

The more I dug into this question, the more it looked like the Russians are indeed attempting to influence political affairs, not just in the US but all over the world. They are exploiting the networked world we live in, by leveraging their considerable skills in deploying cyber operations against the west.

A while ago I read the book The Sword and the Shield: The Mitrokhin Archive and the Secret History of the KGB.  I recommend it to anyone who is interested in Russian espionage tactics, and how they apply to the activity we see coming from Russia today.  In the days of the old KGB, their clandestine operations focused on gathering political, military, and signals intelligence about their perceived enemies, stealing scientific and technological information, running “illegals” (spies) in foreign countries, and something called “active measures.”  Active measures were, operations carried out against targets in the press, radio, and television mass media, and focused on recruiting journalists and attempting to insert stories in the western press that showed the Soviet Union in a favorable light, or were designed to influence public opinion.  Often active measures were employed in an attempt to influence elections and put candidates in power who were pro-Soviet.  Sounds a little familiar, doesn’t it.

In the Internet connected world, active measures are easier than ever.  The Russians can use the popular social media platforms, focusing on using Facebook, Twitter, and Wikileaks to advance their agenda.  They also specialize in breaching emails accounts and networks using phishing attacks and social engineering.  Sometimes the contents of these email breaches are later published on Wikileaks.

The main debate about whether this activity is sponsored by the Russian Government, or whether it is the actions of independent cybercrime groups hinges on the concept of “attribution.”  The methods used by cyber-attackers are designed to obscure the source of the attacks through the use of VPNs and the TOR network.  Pinpointing the actual source IP address, and through it the geographic location of the attacker, if often impossible.

Most countries have some sort of military or intelligence service based cyber-command group.  Part of the problem with attributing exploits to the Russian government is that until recently, they tended to work with independent contractors who are also part of the Russian cyber-crime underground.  This has given Russia plausible deniability.  Recently though, it looks like this activity has come directly from the Russian intelligence services.

The companies and agencies that analyze these attacks are left parsing the code and looking for signatures and similarities in the code.  These signatures allow them to make informed guesses about the source or attribution of these exploits.  How these conclusions are derived is the source of the attribution debate.

In the next post, we will continue this investigation, and take a look at the active measures currently used by the Russian Government.

More information:


About the Author:

Cybersecurity analyst, pen-tester, trainer, and speaker. Owner of the WyzCo Group Inc. In addition to consulting on security products and services, Bob also conducts security audits, compliance audits, vulnerability assessments and penetration tests. Bob also teaches Cybersecurity Awareness Training classes. Bob works as an instruction for CompTIA’s non-profit IT-Ready Program in the Twin Cities. IT-Ready is a tuition free 8-week program designed to teach students of all ages the fundamentals of IT support to prepare them for an entry level position in Information Technology Support. Graduates of the classes take the exams to become CompTIA A+ certified. Bob is a frequent speaker at conferences such as the Minnesota Bloggers Conference, Secure360 Security Conference2016, 2017, 2018, 2019, the (ISC)2 World Congress 2016, and the ISSA International Conference 2017, and many local community organizations, including Chambers of Commerce, SCORE, and several school districts. Bob has been blogging on cybersecurity since 2006 at
  Related Posts


Add a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.