Covert Ties Between the Kremlin and Russian Hacker Groups May be Deepening

Kremlin’s ties to Russian cyber gangs sow US concerns

Cory Bennett, The Hill, October 11, 2015

The relationship between Moscow and Russian cyber gangs may be tightening, spurred by international sanctions and disputes with the United States over military action in Ukraine and Syria, experts and federal lawmakers warn. 

Moscow has long been known to source its technology, world-class hacking talent and even some intelligence information from local cyber crime rings, or “the Silicon Valley of Eastern Europe,” said Tom Kellermann, chief cybersecurity officer at security research firm Trend Micro.

In exchange, officials turn a blind eye to the rampant underground economy these cyber crime syndicates have constructed, fueled largely by mammoth data breaches at major U.S. retailers and banks.

“That symbiotic relationship has been going on for at least 10 years, if not longer,” said Jonathan Wrolstad, a cyber threat analyst with FireEye, a security firm that follows two of Russia’s more prominent intelligence hacking groups.

Lawmakers tracking hacking threats agreed. 

In Russia, “there are private actors, there are government actors, and there are some that have almost a contractual relationship with the government,” said Rep. Adam Schiff (D-Calif.), the top Democrat on the House Intelligence Committee. 

The quid pro quo has been mutually beneficial. 

Often times, “when someone is identified as being technically proficient in the Russian underground,” a pending criminal case against them “suddenly disappears and those people are never heard from again,” said Dmitri Alperovitch, co-founder security firm CrowdStrike, which monitors critical infrastructure attacks

That hacker is now working for Russian intelligence services, he argues. 

“We know that’s going on,” Alperovitch added.

Moscow is also cherry picking software tools from these cyber gangs, such as Internet hosting services and cleverly designed malware, said Wrolstad.

The result is some of the most sophisticated hacking teams in the world. Of the 2,000 hacking teams FireEye tracks, only two are Russian. The rest are Chinese. Yet those two groups surpass all the Chinese groups in terms of talent, Wrolstad said.

These teams write the “best pieces of malware,” he explained, some of which are “almost impossible for an organization to detect.”


A recent FireEye report explained how one hacking group covers up and coordinates its digital assaults through a complex method involving fake Twitter accounts and encrypted data buried in seemingly innocuous photos. The tactic, researchers said, displayed an unmatched “discipline and consistency.“

Intelligence community briefings back up this sentiment, lawmakers told The Hill this week.

“The Russians are … more effective and more dangerous when it come to hacking,” said Rep. Jim Langevin D-R.I.), who co-chairs the Congressional Cybersecurity Caucus, comparing them to Chinese hackers. “They’re very good and they’re quiet about it.”

Russian spies even source their information from the robust underground digital market, Kellermann said. 

When Eastern European cyber crime syndicates plunder sensitive data from companies, they put that information up for sale. If they crack into a device, they will sell that access. 

For instance, Russia-linked hackers attempted to infiltrate then-Secretary of State Hillary Clinton’s private email account in 2011. The fake email messages posed as speeding ticket notifications and asked Clinton to click on an attachment that would have given the digital intruders access to her account, a so-called “phishing” attack. 

While there’s no evidence the fraudulent emails were any more than the basic spam all Americans receive, the access to Clinton’s email would have fetched considerable money on the black market had the tactic had been successful. 

What’s harder to suss out is how much the Kremlin directs these outside groups, “without formally putting them on pay,” Alperovitch said.

“There’s a very grey, fuzzy line,” Kellermann agreed.

But according to Kellermann, the fuzzy line has grown more distinct as Russia clashes with the U.S. and international community over its actions in Ukraine and Syria. He argued that Russian cyber criminals have tightened cooperation with Moscow, fueled by patriotic fervor.

Criminal hackers “that used to hunt banks eight hours a day are now operating two hours a day turning their guns on NATO and government targets,” Kellermann said.

These groups, he added, are “willingly operating as cyber militias.” 

Other cyber experts cautioned that they have not noticed a demonstrable change in links between the Kremlin and cyber underworld.

“It’s very opaque, it’s very hard to tell,” Alperovitch said. “It’s always been pretty close.” 

Wrolstad added, “In crisis situations the cyber criminals may feel pressure to help the government.”

But what the cyber community agrees on is that rising tensions between the Kremlin and the White House have coincided with a demonstrable rise in Russian cyberattacks against the U.S. and its allies.

A slate of international sanctions slapped on the Russian economy over its military actions in Ukraine are closely linked with this increase, they concurred. 

“The volume of attacks from Russia has escalated dramatically in the last year,” said Alperovitch. 

The hacks have peppered a variety of national security targets, including government agencies, think tanks and companies in the security community, as well as some financial and energy firms, he added.

Kellermann said he has seen cyber criminals rushing to join these efforts over the last two months, as Russia prepared to launch controversial airstrikes in civil war-torn Syria.

Russian President Vladimir Putin claims the strikes are meant to take out Islamic State in Iraq and Syria (ISIS) forces. But U.S. officials believe Russia is simply going after the moderate rebels trying to oust Syrian President Bashar Al-Assad, who President Obama has called on to step aside.

Other cyber specialists said they hadn’t noticed a perceptible rise.

“It’s kind of hard for us to distinguish, given we’re already at a high level,” said Nick Rossmann, a senior program manager of threat intelligence at FireEye.

National security-focused lawmakers agreed, telling The Hill this week they hadn’t received briefings on the matter. But the volume of cyberattacks is already so high, it could be hard to discern, they cautioned. 

“It’s a constant threat so I’m not sure I would necessarily refer to it as an uptick,” said Senate Intelligence Committee Chairman Richard Burr (R-N.C.). “But [Russia] continues to attack U.S. systems literally daily.”

Given the strife in Syria, it would make sense for Moscow to want more intelligence on U.S. military plans overseas, said Schiff, the California Democrat.

“It wouldn’t surprise me if there were a greater focus on Russian intelligence gathering in the United States of our intentions, our response,” Schiff said.


“They’re choosing a collision course with the United States in a number of arenas,” he added. “As they do so, I’m sure they prioritize the United States as a target of their intelligence gathering.