Russian Info, Cyber and Disinformation (Jan-June 2017).

[OUTLAW 09]

Based on Keyhole.co analysis @TEN_GOP pushed between midnight today and 0400 today a total of 52 tweets with the high volume being between 0000 and 0200.

If one factors in Russian time this would have been a working morning there at 0700 to 0800.....and virtually no tweets by 0400.....which would have been 1000 in Berlin and 1100 in Moscow.....

So the account pushes out the Russian influence tweets in the very early morning hours in the US so they can be picked up and retweeted by "Followers" of @TEN_GOP....when they are up and running in normal US time.....so one account can in fact span the entire US twitter landscape.......time wise for the entire US....

AND all of the account "Followers" never seem to notice the Russian influence operation using them as "retweeters"......

Many of these so called "retweeters" push as many as 35 to 50 retweets per day.....creating a lot of twitter trending volume....

[OUTLAW 09]

Why So Many Top Hackers Hail from Russia

Conventional wisdom says one reason so many hackers seem to hail from Russia and parts of the former Soviet Union is that these countries have traditionally placed a much greater emphasis than educational institutions in the West on teaching information technology in middle and high schools, and yet they lack a Silicon Valley-like pipeline to help talented IT experts#channel their skills into high-paying jobs. This post explores#the first part of that assumption by examining a breadth of open-source data.
The supply side of that conventional wisdom seems to be supported by an analysis of educational data from both the U.S. and Russia, which indicates there are several stark and important differences between how American students are taught and tested on IT subjects versus their counterparts in Eastern Europe.

http://www.krebsonsecurity.com/

[OUTLAW 09]

Battling disinformation will require the efforts of governments, tech firms, and individual citizens:
http://www.atlanticcouncil.org/blogs...formation-now#

[OUTLAW 09]

DFR Lab
✔
@DFRLab
One month later, we measured the impact of banning certain websites in Ukraine.

https://medium.com/dfrlab/vk-vanishi...-fc7b2882f769#

[OUTLAW 09]

Russian use of their state owned propaganda media outlet Russia Today is picking up the pace of info warfare attacks on Germany.....

Playing to the German Left fear of war.....AND accusing a highly respected German TV evening news program of pushing war propaganda and they claimed they sent a complaint to the German Agency overseeing correct reporting...


HOW strange for a Russian propaganda outlet to complain about not seeing "fair and balanced reporting"...when RT pushes constant propaganda and fake news and even copies one photo to another totally different news article.....to enhance the propaganda article....

[OUTLAW 09]

David Crawford, @correctiv_org: "False information which is repeated over & over again gets believable."

THAT is exactly what the US alt right ie white nationalist social media accounts and blogsites claiming to be news sites do....AND does Fox News

So where is there a difference between US propaganda proTrump sites and Russian propaganda aimed at assisting these sites with pre-canned narratives that are either true propaganda and or disinformation....

[OUTLAW 09]

German SPD leader Schulz indicates opposition to "blind arms race" [ie Merkel's commitment to NATO's 2% defence spending target] will be a SPD election theme.

THEN Russia Today jumps in immediately with a headline bashing Germany using the title "Arms race".....

Russia Today plays both the Left and Right in their "reporting and comments"...

Whatever it takes to side track an existing government.....

BUT WAIT...Russia is in "an arms race and especially in their violation of INF" and their repeated refusals to destroy thousands of tanks and IFVs which they agreed to under OSCE agreements...

[OUTLAW 09]

Today an unusually high number of sudden malware and actually hacking against Ukrainian companies and banks....

Ukrenergo (United Energy Systems of UA) was attacked by hackers too. Natl Bank: cyber defense is working well
https://lb.ua/economics/2017/06/27/3...ake_ryad.html#

Reports that KyivEnergo had to turn off computers. Not DDOS against website, but inner services.

Unknown virus attacks Ukrainian banks and state postal service

Could be some "WannaCry" type BUT that is strange as most Ukrainian companies did well against Wannacry.

Could actually be a very strong DDoS attack in progress....not malware....

[OUTLAW 09]

Today an unusually high number of sudden malware and actually hacking against Ukrainian companies and banks....

Ukrenergo (United Energy Systems of UA) was attacked by hackers too. Natl Bank: cyber defense is working well
https://lb.ua/economics/2017/06/27/3...ake_ryad.html#

Reports that KyivEnergo had to turn off computers. Not DDOS against website, but inner services.

Unknown virus attacks Ukrainian banks and state postal service

Could be some "WannaCry" type BUT that is strange as most Ukrainian companies did well against Wannacry.

Could actually be a very strong DDoS attack in progress....not malware....

Seems to be a equal opportunity hacking attack.....

And in Russia: Rosneft computer servers underwent "powerful" hacker attack

NOW more attacks being reported....

Power companies across Ukraine say under cyberattacks. Nat'l power co Ukrenergo, as well as Kyivenergo, Zaporizhzhyaoblenergo, Dniproenergo.

BLUF......attacks of this nature against Ukrainian power companies and or their power grids has been always conducted by Russians.....

IN THIS case the "alleged" attacks on Roseneft are probably the attempt by Russia to deflect any accusations towards them by saying see we got attacked to....

BUT this is potentially important as the US under Obama it has been reported set into motion the emplacement of "hacking bombs" in critical areas to deter Russian hacking and as a form of "pay back for hacking the US".....THIS could in fact if the story is actually correct...be one of the "bombs" going off.....as a warning for Russian attacks on Ukrainian power plants and grids....

Rosneft says its servers came under massive hacker attack.

http://app.tvrain.ru/L2en/rVTVQdmNjE

It is being reported by a solid US reporter from Moscow.....

[OUTLAW 09]

NOT confirmed....

Reportedly it is again some cryptoworm/"WannaCry" mod using Windows' SMB vulnerability

If true then check my previous postings as this particular Wannacry using a Windows SMB fault is in fact a stolen NSA tool...on the malware thread.....

Zaporizhzhya and Dnipro regions electric grids under cyber attack too, media reports.

Several private & state-owned Ukrainian banks also hit by cyberattacks, Natl Bank says; some banking ops interrupted
https://bank.gov.ua/control/uk/publi...&cat_id=80928#

Attacks are still ongoing....

Ransom ware attack reportedly used against TRK Luks (majority held by Lviv mayor Sadoviy), includes 24 Kanal too.
http://24tv.ua/na_mediaholding_trk_l...ataku_n834976#

[OUTLAW 09]

Have not seen any reporting by any other country having a similar ongoing attack...so it is strictly focused on Ukraine....

Nova Poshta" post company, DTEK energy company, "24 channel" media company, EpicenterK household stuff markets under attack

Those companies are indicating 504 Gateway Errors which does not seem to be an issue of a ransomware attack....which is geared towards singular pc's and servers.....

MORE hit companies are coming in still.....
At least 2 biggest gas station networks: WOG, KLO

Ministry of Infrastructure of Ukraine is under the #CyberAttack

Ukrainian biggest comm. companies "Kyivstar", "Ukrtelecom", "Lifecell" computers are also infected

[OUTLAW 09]

"Nova Poshta", the postal company, reports that is attacked by a virus "Petya.A".


IF confirmed then it is a ransomware attack and a hacking attack....actually a trojan with ransomware....

Trojan.Ransom.Petya.A
TR/Crypt.Xpack.yesw
Trojan.GenericKD.3120765

[OUTLAW 09]

Kremlin pushing an exaggerated version of the reported 'massive cyber-attack' on Ukraine.

BTW this twitter account while looking as if it is a solid Ukrainian support account...it is a proven and confirmed Russian troller working out of St. Petersberg...Russia

[OUTLAW 09]

This is an ongoing, widespread and targeted hacking attack coupled with a ransomware attack designed to cripple the entire Ukraine economy and critical infrastructure....

My company is tracking it hard and heavy and providing assistance to Ukrainian companies in recovering.....

Have identified four main servers supporting this attack and they sit deep in Russian...we are attempting to take them off line as of now.....

First two are offline and no longer supporting the attack....

[OUTLAW 09]

Kyiv Metro payment system also reportedly affected in #Ukraine cyberattacks.

What appears to be a massive country wide cyber attack hitting Ukraine just now. Like cyber warfare we all been imagining for years

If Russia were planning an invasion of Ukraine they would probably launch a massive cyberattack and a distracting assassination first.

Assassination killing occurred this morning against a COL a Commander in the UAF SOF Military Intelligence just returned from the UAF front lines...

[OUTLAW 09]

Some power companies being hit again......


THIRD attack server is now offline and two more are identified this time deeper inside Russia....


What Russia has hit in cyberattack in Ukraine SO FAR:
Government Ministry
Power grid
Banks
Media
Postal
Airport
Cell/internet providers

Cyber attack hit fuel companies.
Two of them, WOG and KLO informed their systems stopped to work, no services

Payments by banking cards aren't accepted

FOURTH Russian attack server is now down...one more identified

This is a true Russian cyber attack now and just now a practice run.....Estonian IT security companies are now in the fray to support Ukraine IT infrastructure ..ransonware is relatively easy to handle ....

Two Polish IT security companies are also mixing into the fray now.....Latvian one as joined in as well...this is developing into an eastern European defensive effort to assist Ukraine...

AND Trump still believes there is no such thing as Russian cyber attacks....he needs to get in his AF1 and come to Ukraine to seen for himself the effects of a Russian cyber attack....

[OUTLAW 09]

Group-IB says cyberattack with Petya virus is hitting Ukraine and Russia. Companies in Russia include Rosneft, Bashneft, Mars and Nivea.

Not convinced as of yet that Russia was specifically targeted.as is Ukraine...this is normal bleed over when a general backbone attack as large as this one is occurs....kind of a secondary follow on effect is occuring in Russia.....

There were rumors on the global net yesterday from a hacking guru indicating a possible global SAP attack but a lot of Ukrainian companies are not on SAP.

[OUTLAW 09]

In the middle of the major hacking attack this comes from Russian Roseneft......notice they do not seem to be bothered by the attack.....

Rosneft @RosneftEN
A massive hacker attack has hit the servers of the Company. We hope it has no relation to the ongoing court procedures.

[OUTLAW 09]

The Independent
✔
@Independent
An unprecedented cyber attack just took out every major bank, government and airport computer in Ukraine
http://ind.pn/2sd9gYF

[OUTLAW 09]

Will not be posting much longer as I and about 14 other IT security companies are in deep support to two major Ukrainian IT companies and it is literally an "all hands on deck event" right now....

This attack is massive in scale and something I have never seen in my lifetime of defending computer networks......

So for those that do not believe there is such as thing as a crippling attack and for those that fluff off the Russian hacking attack on the US election.....

You need to come to Europe and see it first hand....it is real and it is a cyber war right now....