Malcolm Nance - The Plot to Hack America

According to F-Secure’s analysis of PinchDuke, the first samples were found in November 2008 on Turkish websites hosting Chechen materials. One of the sites was labeled as a “Chechan [sic] Information Center;” the other site contained a section on Chechnya. 17

Venomous Bear 18was identified by Crowdstrike (and nicknamed Uroburous (Snake), Epic Turla, SnakeNet, Waterbug, and Red October) first in 2008. 19

This group is best known for the notorious cyberattack on U.S. Central Command in 2008. This attack was called “Worst Breach of U.S. Military Computers in History.” Though the Pentagon says no data was lost because the transmission of data was interrupted, it transformed how the military would use thumb drives as well as its defensive posture.

The attack was likely due to an infected USB flash drive inserted into a U.S. military laptop. In order to engage the rest of its programming, the malware had to communicate to a C2 server. When it tried to do so, NSA’s Advanced Network Operations (ANO) team detected the malware. As a result, DOD issued a worldwide ban on thumb drives. Another result of this breach by Agent.btz was the creation of the U.S. Cyber Command. DOD also responded with the launch of “Operation Buckshot Yankee” 20which aimed to both clean all infected machines and protect the “digital beachhead” as Deputy Defense Secretary William Lynn III called it. The breach was so severe that NSA’s famous Tailored Access Operations (TAO), the elite cyber attack squad team, worked to counter the threat. 21

Like the other APTs, this group uses spear-phishing to trick the target into opening a pdf attachment with malware or into clicking a link to a waterhole site. Like the APT28 and APT29 attacks, the Venomous Bear attacks used attachments to emails that were carefully targeted and worded to get the target to open either the attached PDF that then activated “Trojan.Winpbot” and “Trojan.Turla” according to a Symantec report examining the group’s attack.22 The “Trojan.Turla” is used to exfiltrate data.

According to CrowdStrike’s Global Threat Report, Venomous Bear has been targeting government agencies, NGOs, energy firms, tech firms, and educational organizations. 23

Russia views the Baltic States, the countries that border it on the Western frontier, as nations that should be in their sphere of political and economic influence rather than oriented toward Western Europe. The nations of Lithuania, Estonia, Latvia felt left behind to suffer for more than five decades under Soviet domination. When they got the chance, they quickly aligned themselves with America and the rest of Europe, and joined NATO. The pain of this was especially sharp in Estonia.

Estonia sits just to the Southwest of St. Petersburg on the Baltic and Russia has long considered it along with Lithuania, Latvia as rogue satellites. Reclaiming them would give Putin a bridge to its enclave of Kaliningrad, a small province of Russia north of Poland that is separated by the Baltic States. A Russian-dominated Baltic region would also push NATO back to the Polish frontier. Many believed that the 1940 seizure of Estonia and its “liberation” by the Soviet Union in 1944 was part of Russia’s tsarist desire to control the satellite states in its backyard. As many as 320,000 Estonians are ethnic Russians, and 40 percent of the population is considered “foreign.” The Russian populations of Estonia came during the Soviet occupation or were born there. Upon independence, the Estonians decided that Russians and other non-Estonian peoples would be considered émigrés and not nationals. Putin’s Russia took a dim view to the treatment of their ethnic brothers that would turn dark in 2007.

The Estonian break with Russia would come to a head when the government attempted to remove a bronze military monument to Russian soldiers lost in World War II. This dark grey statue of a young, chisel-chinned, highly-decorated Russian soldier, rifle slung over his back, helmet in hand, head lowered out of respect to the dead ,once stood in the center of the Estonian capital of Tallinn. It was a beautiful piece of art work, but ever since the Soviets reoccupied in 1944, the monument stood as a hated symbol of their Communist and post-communist hegemony. After independence in 1991 Estonia sought ways to remove the monument without antagonizing the local Russian population.

In 2007 Estonia was one of the most wired countries in the world. Its 1.3 million inhabitants fully integrated the internet into their daily lives using computers, tablets, and smartphones which made them the highest per-capita users of online technology in Europe and the Middle East regions. Estonia wired itself for global access to make it favorable to European markets. Marketing campaigns touted Estonia’s global interconnectedness, its small but growing economy, and its 2004 acceptance into NATO.

When the protests broke out, the Bronze statue was vandalized. Blood red paint was routinely thrown on it. The new imperial Russia was not amused. The opposition to the monument culminated in a series of riots that led to a greater, even more monumental event in the history of European political warfare. Estonia was attacked, but not one bullet was fired and not one person was injured. The CYBER BEARS were tasked to punish the nation as a whole. They did so by sending an entire European nation back to the pre-internet age. 24

On April 26, 2007 a massive, covert barrage of cyberattacks struck the computers of Estonia. A series of “Denial-of-Service” attacks blocked up the servers that distributed web traffic and completely shut down all internet access to the nation. The sites targeted included the Estonian president, the Parliament, the ministries, three news outlets, political party sites and two banks. 25In order to stop the attack, countermeasures blocked all international traffic, which allowed the site traffic to return to normal levels.

Estonia conducted an investigation and later charged a 20-year-old Estonian, Dmitri Galushkevich for his role in the DoS attacks. He stated that his attack was inspired as a protest against removing the Bronze Soldier. He pleaded guilty. As he had no previous criminal record he was fined €110 and released. 26Despite his admission of starting the first DoS hack, many firms have concluded that cyber militias working under the direction of the Russian government quickly jumped onto the initial DoS attack and expanded it to the extent that it shut down the country’s internet.

Since 1988 when the people of Ossetia, an enclave in Southern Georgia asked for more autonomous authority, the independent central government asserted its control in a tug of war with Russia. Georgia had declared its independence from the Soviet Union in 1991 and shortly after South Ossetia declared its independence from Georgia. Ossetians had been seeking to increase their autonomy for years, but under the new Georgian President Zvaid Garmskhurdia it was clear Georgia was not going to give up this territory as it sought independence for itself. Ossetia had been an oblast, or province, under the Soviet system since 1923. 27After Garmskhurdia was deposed in December 1991, Eduard Shevardadze became the new Georgian leader and by mid–1992 a ceasefire agreement accompanied another agreement to leave Georgia in substantial control over South Ossetia. 28

However, the South Ossetians are supported largely by Russia, and this tension boiled up over Georgian control in 2004 and again in 2008. In August 2008, Russia and Georgia clashed in South Ossetia and Abkhazia after years of tensions. When Georgian troops sought to enter South Ossetia they were outmaneuvered and outflanked by the Russian-backed forces. In five days, the combined Ossetian and Russian forces defeated the Georgian forces. 29