Jump to content

Fancy Bear: Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
PrimeBOT (talk | contribs)
Bots
2,006,691 edits
m →‎Democratic National Committee (2016): remove UTM parameters (Google analytics) from URLs - BRFA
Line 78: Line 78:


===Democratic National Committee (2016)===
===Democratic National Committee (2016)===
Fancy Bear carried out spear phishing attacks on email addresses associated with the [[Democratic National Committee]] in the first quarter of 2016.<ref name=NYT>{{cite news|last1=Sanger|first1=David E.|last2=Corasaniti|first2=Nick|title=D.N.C. Says Russian Hackers Penetrated Its Files, Including Dossier on Donald Trump|url=https://www.nytimes.com/2016/06/15/us/politics/russian-hackers-dnc-trump.html|accessdate=26 October 2016|publisher=New York Times|date=14 June 2016}}</ref> On March 10, phishing emails that were mainly directed at old email addresses of 2008 Democratic campaign staffers began to arrive. One of these accounts may have yielded up to date contact lists. The next day, phishing attacks expanded to the non-public email addresses of high level Democratic Party officials. Hillaryclinton.com addresses were attacked, but required two factor authentication for access. The attack redirected towards Gmail accounts on March 19th. Podesta's Gmail account was breached the same day, with 50,000 emails stolen. The phishing attacks intensified in April,<ref>{{cite news|last1=Satter|first1=Raphael|last2=Donn|first2=Jeff|last3=Day|first3=Chad|title=Inside story: How Russians hacked the Democrats’ emails|url=https://www.apnews.com/dea73efc01594839957c3c9a6c962b8a/Inside-story:-How-Russians-hacked-the-Democrats%27-emails|accessdate=10 November 2017|agency=AP|date=4 November 2017}}</ref> although the hackers seemed to become suddenly inactive for the day on April 15, which in Russia was a holiday in honor of the military's electronic warfare services.<ref name=Economist>{{cite news|title=Bear on bear|url=https://www.economist.com/news/united-states/21707574-whats-worse-being-attacked-russian-hacker-being-attacked-two-bear-bear|accessdate=14 December 2016|work=The Economist|date=22 September 2016}}</ref>The malware used in the attack sent stolen data to the same servers that were used for the group's 2015 attack on the [[Bundestag|German parliament]].<ref name="Esq"/>
Fancy Bear carried out spear phishing attacks on email addresses associated with the [[Democratic National Committee]] in the first quarter of 2016.<ref name=NYT>{{cite news|last1=Sanger|first1=David E.|last2=Corasaniti|first2=Nick|title=D.N.C. Says Russian Hackers Penetrated Its Files, Including Dossier on Donald Trump|url=https://www.nytimes.com/2016/06/15/us/politics/russian-hackers-dnc-trump.html|accessdate=26 October 2016|publisher=New York Times|date=14 June 2016}}</ref> After the initial accidental exposure of these phishing attacks, Secureworks discovered a database containing 19,000 malicious links collected by Fancy Bear.<ref>{{Cite news|url=http://www.chicagotribune.com/news/nationworld/ct-russian-hacking-20171102-story.html|title=Digital hit list shows Russian hacking went well beyond U.S. elections|last=Myers|first=Raphael Satter, Jeff Donn and Justin|work=chicagotribune.com|access-date=2017-11-16|language=en-US}}</ref> On March 10, phishing emails that were mainly directed at old email addresses of 2008 Democratic campaign staffers began to arrive. One of these accounts may have yielded up to date contact lists. The next day, phishing attacks expanded to the non-public email addresses of high level Democratic Party officials. Hillaryclinton.com addresses were attacked, but required two factor authentication for access. The attack redirected towards Gmail accounts on March 19th. Podesta's Gmail account was breached the same day, with 50,000 emails stolen. The phishing attacks intensified in April,<ref>{{cite news|last1=Satter|first1=Raphael|last2=Donn|first2=Jeff|last3=Day|first3=Chad|title=Inside story: How Russians hacked the Democrats’ emails|url=https://www.apnews.com/dea73efc01594839957c3c9a6c962b8a/Inside-story:-How-Russians-hacked-the-Democrats%27-emails|accessdate=10 November 2017|agency=AP|date=4 November 2017}}</ref> although the hackers seemed to become suddenly inactive for the day on April 15, which in Russia was a holiday in honor of the military's electronic warfare services.<ref name=Economist>{{cite news|title=Bear on bear|url=https://www.economist.com/news/united-states/21707574-whats-worse-being-attacked-russian-hacker-being-attacked-two-bear-bear|accessdate=14 December 2016|work=The Economist|date=22 September 2016}}</ref>The malware used in the attack sent stolen data to the same servers that were used for the group's 2015 attack on the [[Bundestag|German parliament]].<ref name="Esq"/>


On June 14, CrowdStrike released a report publicizing the DNC hack and identifying Fancy Bear as the culprits. An online persona, [[Guccifer 2.0]], then appeared, claiming sole credit for the breach.<ref name="Alperovitch">{{cite web|last1=Alperovitch|first1=Dmitri|title=Bears in the Midst: Intrusion into the Democratic National Committee »|url=https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/|publisher=CrowdStrike|date=June 15, 2016}}</ref>
On June 14, CrowdStrike released a report publicizing the DNC hack and identifying Fancy Bear as the culprits. An online persona, [[Guccifer 2.0]], then appeared, claiming sole credit for the breach.<ref name="Alperovitch">{{cite web|last1=Alperovitch|first1=Dmitri|title=Bears in the Midst: Intrusion into the Democratic National Committee »|url=https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/|publisher=CrowdStrike|date=June 15, 2016}}</ref>

Revision as of 15:45, 16 November 2017

Fancy Bear
Прикольный медведь
Formationc. 2004–2007[1]
TypeAdvanced persistent threat
PurposeCyberespionage, cyberwarfare
Region
Russia
MethodsZero-days, spearphishing, malware
Official language
Russian
Parent organization
probably GRU[1]
AffiliationsCozy Bear
Formerly called
APT28
Pawn Storm
Sofacy Group
Sednit
STRONTIUM
Tsar Team
Threat Group-4127
Grizzly Steppe (when combined with Cozy Bear)

Fancy Bear (also known as APT28, Pawn Storm, Sofacy Group, Sednit and STRONTIUM) is a cyber espionage group. Cybersecurity firm CrowdStrike has said with a medium level of confidence that it is associated with the Russian military intelligence agency GRU.[2] Security firms SecureWorks,[3] ThreatConnect,[4] and Fireeye's Mandiant[5] have also said the group is sponsored by the Russian government.

The name "Fancy Bear" does not originate from the hacker group itself, but was derived from a coding system that security researcher Dmitri Alperovitch uses for identifying hackers.[6]

Likely operating since the mid-2000s, Fancy Bear's methods are consistent with the capabilities of nation-state actors. The threat group is known to target government, military, and security organizations, especially Transcaucasian and NATO-aligned states. Fancy Bear is thought to be responsible for cyber attacks on the German parliament, the French television station TV5Monde, the White House, NATO, the Democratic National Committee, Organization for Security and Co-operation in Europe and the campaign of French presidential candidate Emmanuel Macron.[7]

The group serves the political interests of the Russian government, which includes helping foreign candidates that are favored by it to win elections (such as when they leaked Hillary Clinton's emails to help gain traction for Donald Trump during the United States 2016 Elections).[8]

Fancy Bear's behavior has been classified as an advanced persistent threat.[5] They employ zero-day vulnerabilities and use spear phishing and malware to compromise targets.

Discovery and security reports

Trend Micro designated the actors behind the Sofacy malware as Operation Pawn Storm on October 22, 2014.[9] The name was due to the group's use of "two or more connected tools/tactics to attack a specific target similar to the chess strategy,"[10] known as pawn storm.

Network security firm FireEye released a detailed report on Fancy Bear in October 2014. The report designated the group as "Advanced Persistent Threat 28" (APT28) and described how the hacking group used zero-day exploits of the Microsoft Windows operating system and Adobe Flash.[11] The report found operational details indicating that the source is a "government sponsor based in Moscow". Evidence collected by FireEye suggested that Fancy Bear's malware was compiled primarily in a Russian-language build environment and occurred mainly during work hours in Moscow's time zone.[12] FireEye director of threat intelligence Laura Galante referred to the group's activities as "state espionage"[13] and said that targets also include "media or influencers."[14][15]

The name "Fancy Bear" is derived from the coding system that Dmitri Alperovitch uses for hacker groups. "Bear" indicates that the hackers are from Russia. Fancy refers to "Sofacy", a word in the malware that reminded the analyst who found it of Iggy Azalea's song "Fancy".[1]

Attacks

Fancy Bear's targets have included Eastern European governments and militaries, the country of Georgia and the Caucasus, Ukraine,[16] security-related organizations such as NATO, as well as US defense contractors Academi (formerly known as Blackwater), Science Applications International Corporation (SAIC),[17] Boeing, Lockheed Martin, and Raytheon.[16] Fancy Bear has also attacked citizens of the Russian Federation that are political enemies of the Kremlin, including former oil tycoon Mikhail Khodorkovsky, and Maria Alekhina of the band Pussy Riot.[16] An AP analysis of 4,700 Gmail accounts that had been attacked by Fancy Bear concluded that no country other than Russia would be interested in hacking so many very different targets that seemed to have nothing else in common other than their being of interest to the Russian government.[16]

Fancy Bear also seems to try to influence political events in order for friends or allies of the Russian government to gain power.

In 2011-2012, Fancy Bear's first-stage malware was the "Sofacy" or SOURFACE implant. During 2013, Fancy Bear added more tools and backdoors, including CHOPSTICK, CORESHELL, JHUHUGIT, and ADVSTORESHELL.[18]

German attack (2014)

Fancy Bear is thought to have been responsible for a six-month-long cyber-attack on the German parliament that began in December 2014.[19]

The group is also suspected to be behind a spear phishing attack in August 2016 on members of the Bundestag and multiple political parties such as Linken-faction leader Sahra Wagenknecht, Junge Union and the CDU of Saarland.[20][21][22][23] Authorities fear that sensitive information could be gathered by hackers to later manipulate the public ahead of elections such as Germany's next federal election due in September 2017.[20]

French television hack (April 2015)

On April 8, 2015, French television network TV5Monde was the victim of a cyber-attack by a hacker group calling itself "CyberCaliphate" and claiming to have ties to the terrorist organization Islamic State of Iraq and the Levant (ISIL). French investigators later discounted the theory that militant Islamists were behind the cyber-attack, instead suspecting the involvement of Fancy Bear.[24]

Hackers breached the network's internal systems, possibly aided by passwords openly broadcast by TV5,[25] overriding the broadcast programming of the company's 12 channels for over three hours.[26] Service was only partially restored in the early hours of the following morning and normal broadcasting services were disrupted late into April 9.[26] Various computerised internal administrative and support systems including e-mail were also still shut down or otherwise inaccessible due to the attack.[27][26] The hackers also hijacked TV5Monde's Facebook and Twitter pages to post the personal information of relatives of French soldiers participating in actions against ISIS, along with messages critical of President François Hollande, arguing that the January 2015 terrorist attacks were "gifts" for his "unforgivable mistake" of partaking in conflicts that "[serve] no purpose".[28][26]

The director-general of TV5Monde, Yves Bigot, later said that the attack nearly destroyed the company; if it had taken longer to restore broadcasting, satellite distribution channels would have been likely to cancel their contracts. The attack was designed to be destructive, both of equipment and of the company itself, rather than for propaganda or espionage, as had been the case for most other cyber-attacks. The attack was carefully planned; the first known penetration of the network was on January 23, 2015.[29] The attackers then carried out reconnaissance of TV5Monde to understand the way in which it broadcast its signals, and constructed bespoke malicious software to corrupt and destroy the Internet-connected hardware that controlled the TV station's operations, such as the encoder systems. They used seven different points of entry, not all part of TV5Monde or even in France—one was a company based in the Netherlands that supplied the remote controlled cameras used in TV5's studios.[29] Between February 16 and March 25 the attackers collected data on TV5 internal platforms, including its IT Internal Wiki, and verified that login credentials were still valid.[29] During the attack, the hackers ran a series of commands extracted from TACACS logs to erase the firmware from switches and routers.[29]

Although the attack purported to be from IS, France's cyber-agency told Bigot to say only that the messages claimed to be from IS. He was later told that evidence had been found that the attackers were the APT 28 group of Russian hackers. No reason was found for the targeting of TV5Monde, and the source of the order to attack, and funding for it, is not known. It has been speculated that it was probably an attempt to test forms of cyber-weaponry. The cost was estimated at €5m ($5.6m; £4.5m) in the first year, followed by recurring annual cost of over €3m (£3.4m; £2.7m) for new protection. The company's way of working had to change, with authentication of email, checking of flash drives before insertion, and so on, at significant detriment to efficiency for a news media company that must move information.[30]

Root9B report (May 2015)

Security firm Root9B released a report on Fancy Bear in May 2015 announcing its discovery of a targeted spear phishing attack aimed at financial institutions. The report listed international banking institutions that were targeted, including the United Bank for Africa, Bank of America, TD Bank, and UAE Bank. According to the Root9B, preparations for the attacks started in June 2014 and the malware used "bore specific signatures that have historically been unique to only one organization, Sofacy."[31] Security journalist Brian Krebs questioned the accuracy of Root9B's claims, postulating that the attacks had actually originated from Nigerian phishers.[32]

EFF spoof, White House and NATO attack (August 2015)

In August 2015, Fancy Bear used a zero-day exploit of Java, spoofing the Electronic Frontier Foundation and launching attacks on the White House and NATO. The hackers used a spear phishing attack, directing emails to the false url electronicfrontierfoundation.org.[33][34]

World Anti-Doping Agency (August 2016)

In August 2016, the World Anti-Doping Agency reported the receipt of phishing emails sent to users of its database claiming to be official WADA communications requesting their login details. After reviewing the two domains provided by WADA, it was found that the websites' registration and hosting information were consistent with the Russian hacking group Fancy Bear.[35][36] According to WADA, some of the data the hackers released had been forged.[37]

Due to evidence of widespread doping by Russian athletes, WADA recommended that Russian athletes be barred from participating in the 2016 Rio Olympics and Paralympics. Analysts said they believed the hack was in part an act of retaliation against whistleblowing Russian athlete Yuliya Stepanova, whose personal information was released in the breach.[38] In August 2016, WADA revealed that their systems had been breached, explaining that hackers from Fancy Bear had used an International Olympic Committee (IOC)-created account to gain access to their Anti-doping Administration and Management System (ADAMS) database.[39] The hackers then used the website fancybear.net to leak what they said were the Olympic drug testing files of several athletes who had received therapeutic use exemptions, including gymnast Simone Biles, tennis players Venus and Serena Williams and basketball player Elena Delle Donne.[40] The hackers honed in on athletes who had been granted exemptions by WADA for various reasons. Subsequent leaks included athletes from many other countries.[39]

Dutch Safety Board and Bellingcat

Eliot Higgins and other journalists associated with Bellingcat, a group researching the shoot down of Malaysia Airlines Flight 17 over Ukraine, were targeted by numerous spearphishing emails. The messages were fake Gmail security notices with Bit.ly and TinyCC shortened URLs. According to ThreatConnect, some of the phishing emails had originated from servers that Fancy Bear had used in previous attacks elsewhere. Bellingcat is best known for having accused Russia of being culpable for the shoot down of MH17, and is frequently derided in the Russian media.[41][42]

The group targeted the Dutch Safety Board, the body conducting the official investigation into the crash, before and after the release of the board's final report. They set up fake SFTP and VPN servers to mimic the board's own servers, likely for the purpose of spearphishing usernames and passwords.[43] A spokeswoman for the DSB said the attacks were not successful.[44]

Democratic National Committee (2016)

Fancy Bear carried out spear phishing attacks on email addresses associated with the Democratic National Committee in the first quarter of 2016.[45] After the initial accidental exposure of these phishing attacks, Secureworks discovered a database containing 19,000 malicious links collected by Fancy Bear.[46] On March 10, phishing emails that were mainly directed at old email addresses of 2008 Democratic campaign staffers began to arrive. One of these accounts may have yielded up to date contact lists. The next day, phishing attacks expanded to the non-public email addresses of high level Democratic Party officials. Hillaryclinton.com addresses were attacked, but required two factor authentication for access. The attack redirected towards Gmail accounts on March 19th. Podesta's Gmail account was breached the same day, with 50,000 emails stolen. The phishing attacks intensified in April,[47] although the hackers seemed to become suddenly inactive for the day on April 15, which in Russia was a holiday in honor of the military's electronic warfare services.[48]The malware used in the attack sent stolen data to the same servers that were used for the group's 2015 attack on the German parliament.[1]

On June 14, CrowdStrike released a report publicizing the DNC hack and identifying Fancy Bear as the culprits. An online persona, Guccifer 2.0, then appeared, claiming sole credit for the breach.[49]

Another sophisticated hacking group attributed to the Russian Federation, nicknamed Cozy Bear, was also present in the DNC's servers at the same time. However the two groups each appeared to be unaware of the other, as each independently stole the same passwords and otherwise duplicated their efforts. Cozy Bear appears to be a different agency, one more interested in traditional long-term espionage.[48] A CrowdStrike forensic team determined that while Cozy Bear had been on the DNC's network for over a year, Fancy Bear had only been there a few weeks.[1]

Ukrainian artillery

An infected version of an app to control the D-30 Howitzer was allegedly distributed to the Ukrainian artillery
See also: Russian military intervention in Ukraine (2014–present)

According to CrowdStrike from 2014 to 2016, the group used Android malware to target the Ukrainian Army's Rocket Forces and Artillery. They distributed an infected version of an Android app whose original purpose was to control targeting data for the D-30 Howitzer artillery. The app, used by Ukrainian officers, was loaded with the X-Agent spyware and posted online on military forums. CrowdStrike initially claimed that more than 80% of Ukrainian D-30 Howitzers were destroyed in the war, the highest percentage loss of any artillery pieces in the army (a percentage that had never been previously reported and would mean the loss of nearly the entire arsenal of the biggest artillery piece of the Ukrainian Armed Forces[50]).[51] According to the Ukrainian army CrowdStrike's numbers were incorrect and that losses in artillery weapons "were way below those reported" and that these losses "have nothing to do with the stated cause".[52] CrowdStrike has since revised this report after the International Institute for Strategic Studies (IISS) disavowed its original report, claiming that the malware hacks resulted in losses of 15-20% rather than their original figure of 80%.[53]

Windows zero-day (October 2016)

On October 31, 2016, Google's Threat Analysis Group revealed a zero-day vulnerability in most Microsoft Windows versions that is the subject of active malware attacks. On November 1, 2016, Microsoft Executive Vice President of the Windows and Devices Group Terry Myerson posted to Microsoft's Threat Research & Response Blog, acknowledging the vulnerability and explaining that a "low-volume spear-phishing campaign" targeting specific users had utilized "two zero-day vulnerabilities in Adobe Flash and the down-level Windows kernel." Microsoft pointed to Fancy Bear as the threat actor, referring to the group by their in-house code name STRONTIUM.[54]

Dutch ministries (February 2017)

In February 2017, the General Intelligence and Security Service (AIVD) of the Netherlands revealed that Fancy Bear and Cozy Bear had made several attempts to hack into Dutch ministries, including the Ministry of General Affairs, over the previous six months. Rob Bertholee, head of the AIVD, said on EenVandaag that the hackers were Russian and had tried to gain access to secret government documents.[55]

In a briefing to parliament, Dutch Minister of the Interior and Kingdom Relations Ronald Plasterk announced that votes for the Dutch general election in March 2017 would be counted by hand.[56]

IAAF hack (February 2017)

The officials of International Association of Athletics Federations (IAAF) stated in April 2017 that its servers had been hacked by the "Fancy Bear" group. The attack was detected by cybersecurity firm Context Information Security which identified that an unauthorised remote access to IAAF's servers had taken place on February 21. IAAF stated that the hackers had accessed the Therapeutic Use Exemption applications, needed to use medications prohibited by WADA.[57][58]

German and French elections (2016–2017)

See also: French presidential election, 2017 and German federal election, 2017

Researchers from Trend Micro in 2017 released a report outlining attempts by Fancy Bear to target groups related to the election campaigns of Emmanuel Macron and Angela Merkel. According to the report, they targeted the Macron campaign with phishing and attempting to install malware on their site. French government cybersecurity agency ANSSI confirmed these attacks took place, but could not confirm APT28's responsibility.[59] The APT group did not target Marine Le Pen, further showing Russia's involvement in the French Elections, since Putin has expressed his interest and hopes in Marine Le Pen's victory for both political and financial gains.[60]

The report says they then targeted the German Konrad Adenauer Foundation and Friedrich Ebert Foundation, groups that are associated with Angela Merkel's Christian Democratic Union and opposition Social Democratic Party, respectively. Fancy Bear set up fake email servers in late 2016 to send phishing emails with links to malware.[61]

Characteristics and techniques

Diagram showing Grizzly Steppe's (Fancy Bear and Cozy Bear) process of employing spear phishing

Fancy Bear employs advanced methods consistent with the capabilities of nation-state actors.[62] They use spear phishing emails, malware drop websites disguised as news sources, and zero-day vulnerabilities. One cybersecurity research group noted their use of no less than six different zero-day exploits in 2015, a considerable technical feat that would require large numbers of programmers seeking out previously unknown vulnerabilities in top of the line commercial software. This is a sign that Fancy Bear is a state-run program and not a gang or a lone hacker.[63][64]

One of Fancy Bear's preferred targets is web-based email services. A typical compromise will consist of web-based email users receiving an email urgently requesting that they change their passwords to avoid being hacked. The email will contain a link to a spoof website that is designed to mimic a real webmail interface, users will attempt to login and their credentials will be stolen. The URL is often obscured as a shortened bit.ly link[65] in order to get past spam filters. Fancy Bear sends these phishing emails primarily on Mondays and Fridays. They also send emails purportedly containing links to news items, but instead linking to malware drop sites that install toolkits onto the target's computer.[63] Fancy Bear also registers domains that resemble legitimate websites, then create a spoof of the site to steal credentials from their victims.[49] Fancy Bear has been known to relay its command traffic through proxy networks of victims that it has previously compromised.[66]

Software that Fancy Bear has used includes ADVSTORESHELL, CHOPSTICK, JHUHUGIT, and XTunnel. Fancy Bear utilises a number of implants, including Foozer, WinIDS, X-Agent, X-Tunnel, Sofacy, and DownRange droppers.[49] Based on compile times, FireEye concluded that Fancy Bear has consistently updated their malware since 2007.[66] To avert detection, Fancy Bear returns to the environment to switch their implants, changes its command and control channels, and modifies its persistent methods.[62] The threat group implements counter-analysis techniques to obfuscate their code. They add junk data to encoded strings, making decoding difficult without the junk removal algorithm.[66] Fancy Bear takes measures to prevent forensic analysis of its hacks, resetting the timestamps on files and periodically clearing the event logs.[49]

Fancy Bear has been known to tailor implants for target environments, for instance reconfiguring them to use local email servers.[66] In August 2015, Kaspersky Lab detected and blocked a version of the ADVSTORESHELL implant that had been used to target defense contractors. An hour and a half following the block, Fancy Bear actors had compiled and delivered a new backdoor for the implant.[18]

Fancy Bear sometimes creates online personas to sow disinformation, deflect blame, and create plausible deniability for their activities.[67]

Guccifer 2.0

Main article: Guccifer 2.0

An online persona that first appeared and claimed responsibility for the DNC hacks the same day the story broke that Fancy Bear was responsible.[68] Guccifer 2.0 claims to be a Romanian hacker, but when interviewed by Motherboard magazine, they were asked questions in Romanian and appeared to be unable to speak the language.[69] Some documents they have released appear to be forgeries cobbled together from material from previous hacks and publicly available information, then salted with disinformation.[69]

Fancy Bears' Hack Team

An online group owns a website which leaks documents taken in Fancy Bear's WADA attack. It claims they are "an international hack team" who "stand for fair play and clean sport". WADA said some of the documents leaked under this name were forgeries, and that data has been changed.[70]

Anonymous Poland

A Twitter account named "Anonymous Poland" (@anpoland) claimed responsibility for the attack on the World Anti-Doping Agency[71] and released data stolen from the Court of Arbitration for Sport, a secondary target.[72][73] ThreatConnect supports the view that Anonymous Poland is a sockpuppet of Fancy Bear, noting the change from a historical focus on internal politics. A screen capture video uploaded by Anonymous Poland shows an account with Polish language settings, but their browser history showed that they had made searches in Google.ru (Russia) and Google.com (US), but not in Google.pl (Poland).[72]

See also

Notes

1.^ According to cybersecurity firm FireEye, Fancy Bear uses a suite of tools that has been frequently updated since 2007 or perhaps even 2004.[63] Trend Micro said they can trace the activities of Pawn Storm back to 2004.[74]

References

  1. ^ a b c d Ward, Vicky (October 24, 2016). "The Man Leading America's Fight Against Russian Hackers Is Putin's Worst Nightmare". Esquire.
  2. ^ Stone, Jeff (June 15, 2016). "Meet Fancy Bear and Cozy Bear, Russian groups blamed for DNC hack". Christian Science Monitor.
  3. ^ Threat Group-4127 Targets Hillary Clinton Presidential Campaign (Report). SecureWorks. 16 June 2016. and is gathering intelligence on behalf of the Russian government.
  4. ^ "Russian Cyber Operations on Steroids". ThreatConnect. 19 August 2016. Russian FANCY BEAR tactics
  5. ^ a b "APT28: A Window into Russia's Cyber Espionage Operations?". Fireeye. 27 October 2016. We assess that APT28 is most likely sponsored by the Russian government
  6. ^ "The Man Leading America's Fight Against Russian Hackers Is Putin's Worst Nightmare". Esquire. 2016-10-24. Retrieved 2017-05-07.
  7. ^ https://www.theguardian.com/world/2017/may/08/macron-hackers-linked-to-russian-affiliated-group-behind-us-attack
  8. ^ Hacquebord, Feike. "How Cyber Propaganda Influenced Politics in 2016". TrendMicro. Retrieved 21 May 2017.
  9. ^ Gogolinski, Jim. "Operation Pawn Storm: The Red in SEDNIT". Trend Micro.
  10. ^ "Operation Pawn Storm: Using Decoys to Evade Detection" (PDF). Trend Micro. 2014.
  11. ^ Menn, Joseph (April 18, 2015). "Russian cyber attackers used two unknown flaws: security company". Reuters.
  12. ^ Kumar, Mohit (October 30, 2014). "APT28 — State Sponsored Russian Hacker Group". The Hacker News.
  13. ^ Mamiit, Aaron (October 30, 2014). "Meet APT28, Russian-backed malware for gathering intelligence from governments, militaries: Report". Tech Times.
  14. ^ "APT28: A Window into Russia's Cyber Espionage Operations?". FireEye. October 27, 2014.
  15. ^ Weissman, Cale Guthrie (June 11, 2015). "France: Russian hackers posed as ISIS to hack a French TV broadcaster". Business Insider.
  16. ^ a b c d Satter, Raphael; Donn, Jeff; Myers, Justin (2 November 2017). "Digital hitlist shows Russian hacking went well beyond U.S. elections". Chicago Tribune. AP. Retrieved 10 November 2017.
  17. ^ Yadron, Danny (October 28, 2014). "Hacking Trail Leads to Russia, Experts Say". Wall Street Journal.
  18. ^ a b Kaspersky Lab's Global Research & Analysis Team (December 4, 2015). "Sofacy APT hits high profile targets with updated toolset - Securelist". Securelist.
  19. ^ "Russian Hackers Suspected In Cyberattack On German Parliament". London South East. Alliance News. June 19, 2015.
  20. ^ a b "Hackers lurking, parliamentarians told". Deutsche Welle. Retrieved 21 September 2016.
  21. ^ "Hackerangriff auf deutsche Parteien". Süddeutsche Zeitung. Retrieved 21 September 2016.
  22. ^ Holland, Martin. "Angeblich versuchter Hackerangriff auf Bundestag und Parteien". Heise. Retrieved 21 September 2016.
  23. ^ ""Wir haben Fingerabdrücke"". Frankfurter Allgemeine. Retrieved 21 September 2016.
  24. ^ "France probes Russian lead in TV5Monde hacking: sources". Reuters. June 10, 2015. Retrieved 9 July 2015.
  25. ^ Hacked French network exposed its own passwords during TV interview - arstechnica
  26. ^ a b c d "Isil hackers seize control of France's TV5Monde network in 'unprecedented' attack". Daily Telegraph. April 9, 2015. Retrieved April 10, 2015.
  27. ^ "French media groups to hold emergency meeting after Isis cyber-attack". The Guardian. April 9, 2015. Retrieved April 10, 2015.
  28. ^ "French TV network TV5Monde 'hacked by cyber caliphate in unprecedented attack' that revealed personal details of French soldiers". The Independent. April 9, 2015. Retrieved April 9, 2015.
  29. ^ a b c d Suiche, Matt (June 10, 2017). "Lessons from TV5Monde 2015 Hack". Comae Technologies. Archived from the original on June 13, 2017.
  30. ^ Gordon Corera (10 October 2016). "How France's TV5 was almost destroyed by 'Russian hackers'". BBC News.
  31. ^ Walker, Danielle (May 13, 2015). "APT28 orchestrated attacks against global banking sector, firm finds". SC Magazine.
  32. ^ "Security Firm Redefines APT: African Phishing Threat". Krebs on Security. May 20, 2015.
  33. ^ Doctorow, Cory (August 28, 2015). "Spear phishers with suspected ties to Russian government spoof fake EFF domain, attack White House". Boing Boing.
  34. ^ Quintin, Cooper (August 27, 2015). "New Spear Phishing Campaign Pretends to be EFF". EFF.
  35. ^ Hyacinth Mascarenhas (August 23, 2016). "Russian hackers 'Fancy Bear' likely breached Olympic drug-testing agency and DNC, experts say". International Business Times. Retrieved September 13, 2016.
  36. ^ "What we know about Fancy Bears hack team". BBC News. Retrieved 17 September 2016.
  37. ^ Gallagher, Sean (6 October 2016). "Researchers find fake data in Olympic anti-doping, Guccifer 2.0 Clinton dumps". Ars Technica. Retrieved 26 October 2016.
  38. ^ Thielman, Sam (August 22, 2016). "Same Russian hackers likely breached Olympic drug-testing agency and DNC". The Guardian. The Guardian. Retrieved December 11, 2016.
  39. ^ a b Meyer, Josh (September 14, 2016). "Russian hackers post alleged medical files of Simone Biles, Serena Williams". NBC News.
  40. ^ "American Athletes Caught Doping". Fancybear.net. September 13, 2016.
  41. ^ Nakashima, Ellen (28 September 2016). "Russian hackers harassed journalists who were investigating Malaysia Airlines plane crash". Washington Post. Retrieved 26 October 2016.
  42. ^ ThreatConnect. "ThreatConnect reviews activity targeting Bellingcat, a key contributor in the MH17 investigation". ThreatConnect. Retrieved 26 October 2016.
  43. ^ Feike Hacquebord (22 October 2015). "Pawn Storm Targets MH17 Investigation Team". Trend Micro.
  44. ^ "Russia 'tried to hack MH17 inquiry system'". AFP. 23 October 2015.
  45. ^ Sanger, David E.; Corasaniti, Nick (14 June 2016). "D.N.C. Says Russian Hackers Penetrated Its Files, Including Dossier on Donald Trump". New York Times. Retrieved 26 October 2016.
  46. ^ Myers, Raphael Satter, Jeff Donn and Justin. "Digital hit list shows Russian hacking went well beyond U.S. elections". chicagotribune.com. Retrieved 2017-11-16.{{cite news}}: CS1 maint: multiple names: authors list (link)
  47. ^ Satter, Raphael; Donn, Jeff; Day, Chad (4 November 2017). "Inside story: How Russians hacked the Democrats' emails". AP. Retrieved 10 November 2017.
  48. ^ a b "Bear on bear". The Economist. 22 September 2016. Retrieved 14 December 2016.
  49. ^ a b c d Alperovitch, Dmitri (June 15, 2016). "Bears in the Midst: Intrusion into the Democratic National Committee »". CrowdStrike.
  50. ^ "Ukraine's military denies Russian hack attack". Yahoo! News. 6 January 2017.
  51. ^ Meyers, Adam (22 December 2016). "Danger Close: Fancy Bear Tracking of Ukrainian Field Artillery Units". CrowdStrike.
  52. ^ "Defense ministry denies reports of alleged artillery losses because of Russian hackers' break into software". Interfax-Ukraine. January 6, 2017.
  53. ^ Kuzmenko, Oleksiy; Cobus, Pete. "Cyber Firm Rewrites Part of Disputed Russian Hacking Report". VOA. Retrieved 26 March 2017.
  54. ^ Gallagher, Sean (1 November 2016). "Windows zero-day exploited by same group behind DNC hack". Ars Technica. Retrieved 2 November 2016.
  55. ^ Modderkolk, Huib (February 4, 2017). "Russen faalden bij hackpogingen ambtenaren op Nederlandse ministeries". De Volkskrant (in Dutch).
  56. ^ Cluskey, Peter (February 3, 2017). "Dutch opt for manual count after reports of Russian hacking". The Irish Times.
  57. ^ Rogers, James (April 3, 2017). "International athletics body IAAF hacked, warns that athletes' data may be compromised". Fox News.
  58. ^ "IAAF Says It Has Been Hacked, Athlete Medical Info Accessed". Associated Press. Voice of America. April 3, 2017.
  59. ^ Eric Auchard (24 April 2017). "Macron campaign was target of cyber attacks by spy-linked group". Reuters. Retrieved 27 April 2017.
  60. ^ "Putin awaits return on Le Pen investment". May 4, 2017. Archived from the original on May 5, 2017. {{cite web}}: Unknown parameter |dead-url= ignored (|url-status= suggested) (help)
  61. ^ "Russia-linked Hackers Target German Political Foundations". Handelsblatt. 26 April 2017.
  62. ^ a b Robinson, Teri (14 June 2016). "Russian hackers access Trump files in DNC hack". SC Magazine US.
  63. ^ a b c Thielman, Sam; Ackerman, Spencer (29 July 2016). "Cozy Bear and Fancy Bear: did Russians hack Democratic party and if so, why?". The Guardian. ISSN 0261-3077. Retrieved 2016-12-12.
  64. ^ Cluley, Graham. "New ESET research paper puts Sednit under the microscope". We Live Security. Retrieved 26 October 2016.
  65. ^ Frenkel, Sheera (October 15, 2016). "Meet Fancy Bear, The Russian Group Hacking The US Election". BuzzFeed.
  66. ^ a b c d "APT28: A Window Into Russia's Cyber Espionage Operations?" (PDF). FireEye. 2014.
  67. ^ "Hacktivists vs Faketivists: Fancy Bears in Disguise". ThreatConnect. 13 December 2016.
  68. ^ Koebler, Jason (15 June 2016). "'Guccifer 2.0' Claims Responsibility for DNC Hack, Releases Docs to Prove it". Motherboard. Retrieved 3 November 2016.
  69. ^ a b Franceschi-Bicchierai, Lorenzo. "'Guccifer 2.0' Is Bullshitting Us About His Alleged Clinton Foundation Hack". Motherboard. Retrieved 3 November 2016.
  70. ^ BBC (5 October 2016). "Fancy Bears doping data 'may have been changed' says Wada". BBC. Retrieved 3 November 2016.
  71. ^ Nance, Malcolm (2016). The Plot to Hack America: How Putin's Cyberspies and WikiLeaks Tried to Steal the 2016 Election. Skyhorse Publishing. ISBN 978-1-5107-2333-7.
  72. ^ a b Cimpanu, Catalin (23 August 2016). "Russia Behind World Anti-Doping Agency & International Sports Court Hacks". Softpedia.
  73. ^ "World Anti-Doping Agency Site Hacked; Thousands of Accounts Leaked". HackRead. 12 August 2016.
  74. ^ Feike Hacquebord (2017). Two Years of Pawn Storm — Examining an Increasingly Relevant Threat (PDF) (Report). Trend Micro.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Fancy_Bear&oldid=810647792"