Friday, March 31, 2023

Leak reveals Russian Vulkan hacking center

THE GUARDIAN:
The inconspicuous office is in Moscow’s north-eastern suburbs. A sign reads: “Business center”. Nearby are modern residential blocks and a rambling old cemetery, home to ivy-covered war memorials. The area is where Peter the Great once trained his mighty army.

Inside the six-story building, a new generation is helping Russian military operations. Its weapons are more advanced than those of Peter the Great’s era: not pikes and halberds, but hacking and disinformation tools.

The software engineers behind these systems are employees of NTC Vulkan. On the surface, it looks like a run-of-the-mill cybersecurity consultancy. However, a leak of secret files from the company has exposed its work bolstering Vladimir Putin’s cyberwarfare capabilities.

Thousands of pages of secret documents reveal how Vulkan’s engineers have worked for Russian military and intelligence agencies to support hacking operations, train operatives before attacks on national infrastructure, spread disinformation and control sections of the internet.

The company’s work is linked to the federal security service or FSB, the domestic spy agency; the operational and intelligence divisions of the armed forces, known as the GOU and GRU; and the SVR, Russia’s foreign intelligence organization.

One document links a Vulkan cyber-attack tool with the notorious hacking group Sandworm, which the US government said twice caused blackouts in Ukraine, disrupted the Olympics in South Korea and launched NotPetya, the most economically destructive malware in history. Codenamed Scan-V, it scours the internet for vulnerabilities, which are then stored for use in future cyber-attacks.

Another system, known as Amezit, amounts to a blueprint for surveilling and controlling the internet in regions under Russia’s command, and also enables disinformation via fake social media profiles. A third Vulkan-built system – Crystal-2V – is a training program for cyber-operatives in the methods required to bring down rail, air and sea infrastructure. A file explaining the software states: “The level of secrecy of processed and stored information in the product is ‘Top Secret’.”

The Vulkan files, which date from 2016 to 2021, were leaked by an anonymous whistleblower angered by Russia’s war in Ukraine. Such leaks from Moscow are extremely rare. Days after the invasion in February last year, the source approached the German newspaper Süddeutsche Zeitung and said the GRU and FSB “hide behind” Vulkan.

“People should know the dangers of this,” the whistleblower said. “Because of the events in Ukraine, I decided to make this information public. The company is doing bad things and the Russian government is cowardly and wrong. I am angry about the invasion of Ukraine and the terrible things that are happening there. I hope you can use this information to show what is happening behind closed doors.”

The source later shared the data and further information with the Munich-based investigative startup Paper Trail Media. For several months, journalists working for 11 media outlets, including the Guardian, Washington Post and Le Monde, have investigated the files in a consortium led by Paper Trail Media and Der Spiegel.

Five western intelligence agencies confirmed the Vulkan files appear to be authentic. The company and the Kremlin did not respond to multiple requests for comment.


The leak contains emails, internal documents, project plans, budgets and contracts. They offer insight into the Kremlin’s sweeping efforts in the cyber-realm, at a time when it is pursuing a brutal war against Ukraine. It is not known whether the tools built by Vulkan have been used for real-world attacks, in Ukraine or elsewhere.

But Russian hackers are known to have repeatedly targeted Ukrainian computer networks; a campaign that continues. Since last year’s invasion, Moscow’s missiles have hit Kyiv and other cities, destroying critical infrastructure and leaving the country in the dark.

Analysts say Russia is also engaged in a continual conflict with what it perceives as its enemy, the west, including the US, UK, EU, Canada, Australia and New Zealand, all of which have developed their own classified cyber-offensive capabilities in a digital arms race.

Some documents in the leak contain what appear to be illustrative examples of potential targets. One contains a map showing dots across the US. Another contains the details of a nuclear power station in Switzerland.

click to enlarge 



One document shows engineers recommending Russia add to its own capabilities by using hacking tools stolen in 2016 from the US National Security Agency and posted online.

John Hultquist, the vice-president of intelligence analysis at the cybersecurity firm Mandiant, which reviewed selections of the material at the request of the consortium, said: “These documents suggest that Russia sees attacks on civilian critical infrastructure and social media manipulation as one and the same mission, which is essentially an attack on the enemy’s will to fight.”

One of Vulkan’s most far-reaching projects was carried out with the blessing of the Kremlin’s most infamous unit of cyberwarriors, known as Sandworm. According to US prosecutors and western governments, over the past decade Sandworm has been responsible for hacking operations on an astonishing scale. It has carried out numerous malign acts: political manipulation, cyber-sabotage, election interference, dumping of emails and leaking.

Sandworm disabled Ukraine’s power grid in 2015. The following year it took part in Russia’s brazen operation to derail the US presidential election. Two of its operatives were indicted for distributing emails stolen from Hillary Clinton’s Democrats using a fake persona, Guccifer 2.0. Then in 2017 Sandworm purloined further data in an attempt to influence the outcome of the French presidential vote, the US says.

That same year the unit unleashed the most consequential cyber-attack in history. Operatives used a bespoke piece of malware called NotPetya. Beginning in Ukraine, NotPetya rapidly spread across the globe. It knocked offline shipping firms, hospitals, postal systems and pharmaceutical manufacturers – a digital onslaught that spilled over from the virtual into the physical world.

The Vulkan files shed light on a piece of digital machinery that could play a part in the next attack unleashed by Sandworm. 








Wednesday, March 29, 2023

RUSSIA: NO MORE ADVANCED NOTICE OF NUKE MISSILE TESTS


MOSCOW (AP) — Russia will no longer give the U.S. advance notice about its missile tests as envisioned under a nuclear pact the Kremlin has suspended, a senior Moscow diplomat said Wednesday, as its military rolled missile launchers across Siberia in a show of the country’s massive nuclear capability amid fighting in Ukraine. Deputy Foreign Minister Sergei Ryabkov told Russian news agencies that Moscow has halted all information exchanges with Washington under the last remaining nuclear arms treaty with the U.S. after suspending its participation in it last month. Along with the data about the current state of the countries’ nuclear forces routinely released every six months in compliance with the New START treaty, the parties also have exchanged advance warnings about test launches and deployments of their nuclear weapons. 

Such notices have been an essential element of strategic stability for decades, allowing Russia and the United States to correctly interpret each other’s moves and make sure that neither country mistakes a test launch for a missile attack. The termination of information exchanges under the pact marks yet another attempt by the Kremlin to discourage the West from ramping up its support for Ukraine by pointing to Russia’s massive nuclear arsenal. In recent days, President Vladimir Putin announced the deployment of tactical nuclear weapons to the territory of Moscow’s ally Belarus. Putin suspended the New START treaty last month, saying Russia can’t accept U.S. inspections of its nuclear sites under the agreement at a time when Washington and its NATO allies have openly declared Moscow’s defeat in Ukraine as their goal. Moscow emphasized that it wasn’t withdrawing from the pact altogether and would continue to respect the caps on nuclear weapons the treaty set.


It wasn’t immediately clear whether Ryabkov’s statement indicated Moscow’s intention to terminate all warnings about missile tests or just those envisioned by the New START treaty. Moscow and Washington have exchanged notifications about test launches of ballistic missiles since the Cold War era, and the Foreign Ministry said last month that Russia will keep issuing them in line with a 1988 U.S.-Soviet agreement.

“There will be no notifications at all,” Ryabkov said in remarks reported by Russian news agencies when asked if Moscow would also stop issuing notices about planned missile tests. “All notifications, all kinds of notifications, all activities within the framework of the treaty will be suspended and will not be conducted regardless of what position the U.S. may take.”

U.S. State Department deputy spokesman Vedant Patel said the Biden administration was aware of Ryabkov’s comments but it has not “received any notice indicating a change.”

He added that Washington has “across-the-board concerns about Russia’s reckless behavior as it relates to the New START treaty.”

Heather Williams, director of the Project on Nuclear Issues at the Center for Strategic and International Studies, a Washington think-tank, said Russia’s rhetoric was concerning but fits a pattern of behavior related to Ukraine.

”They use nuclear weapons to turn up the volume on a lot of their other activities, and arms control treaties are just the latest way for Russia to try to advance its goals in Ukraine,” she said.




Of more concern, Williams said, is that the collapse of New START has caused a severe reduction in communications between Washington and Moscow, which could be dangerous. “One of the biggest tragedies of the breakdown in New START is the loss of the communication channel,” she said.

Pavel Podvig, an expert on Russian nuclear forces, tweeted that Ryabkov’s reference to the termination of notices in the context of the New START indicated that Russia will keep issuing them in conformity with the 1988 pact.

Ryabkov’s announcement followed U.S. officials’ statement that Moscow and Washington have stopped sharing biannual nuclear weapons data that were envisioned by the New START treaty. Officials at the White House, Pentagon and State Department said the U.S. had offered to continue providing this information to Russia even after Putin suspended its participation in the treaty, but Moscow told Washington it would not be sharing its own data.

The New START, signed in 2010 by then-Presidents Barack Obama and Dmitry Medvedev, limits each country to no more than 1,550 deployed nuclear warheads and 700 deployed missiles and bombers. The agreement envisages sweeping on-site inspections to verify compliance.

LIVE MILITARY MONITORING SESSION -USING A SCANNER AT ADS-B EXCHANGE

 

Friday, March 17, 2023

INTERNATIONAL COURT ISSUES WARRANT FOR PUTIN


THE HAGUE (AP) — The International Criminal Court said on Friday it issued an arrest warrant for Russian President Vladimir Putin for war crimes because of his alleged involvement in abductions of children from Ukraine. 

The court said in a statement that Putin “is allegedly responsible for the war crime of unlawful deportation of population (children) and that of unlawful transfer of population (children) from occupied areas of Ukraine to the Russian Federation.” It also issued a warrant Friday for the arrest of Maria Alekseyevna Lvova-Belova, the Commissioner for Children’s Rights in the Office of the President of the Russian Federation, on similar allegations. 

The court’s president, Piotr Hofmanski, said in a video statement that while the ICC’s judges have issued the warrants, it will be up to the international community to enforce them. The court has no police force of its own to enforce warrants.

“The decisions of the International Criminal Court have no meaning for our country, including from a legal point of view,” she said.

But Ukrainian officials were jubilant.

“The world changed,” said presidential adviser Mykhailo Podolyak. Foreign Minister Dmytro Kuleba said the “wheels of Justice are turning,” and added that “international criminals will be held accountable for stealing children and other international crimes.”

Ukraine also is not a member of the court, but it has granted the ICC jurisdiction over its territory and ICC prosecutor Karim Khan has visited four times since opening an investigation a year ago.

The ICC said its pre-trial chamber found “reasonable grounds to believe that each suspect bears responsibility for the war crime of unlawful deportation of population and that of unlawful transfer of population from occupied areas of Ukraine to the Russian Federation, in prejudice of Ukrainian children.”

The court statement said that “there are reasonable grounds to believe that Mr Putin bears individual criminal responsibility” for the child abductions “for having committed the acts directly, jointly with others and/or through others (and) for his failure to exercise control properly over civilian and military subordinates who committed the acts.

After his most recent visit, in early March, ICC prosecutor Khan said he visited a care home for children two kilometers (just over a mile) from frontlines in southern Ukraine.

“The drawings pinned on the wall ... spoke to a context of love and support that was once there. But this home was empty, a result of alleged deportation of children from Ukraine to the Russian Federation or their unlawful transfer to other parts of the temporarily occupied territories,” he said in a statement. “As I noted to the United Nations Security Council last September, these alleged acts are being investigated by my Office as a priority. Children cannot be treated as the spoils of war.”

And while Russia rejected the allegations and warrants of the court as null and void, others said the ICC action will have an important impact.

“The ICC has made Putin a wanted man and taken its first step to end the impunity that has emboldened perpetrators in Russia’s war against Ukraine for far too long,” said Balkees Jarrah, associate international justice director at Human Rights Watch. “The warrants send a clear message that giving orders to commit, or tolerating, serious crimes against civilians may lead to a prison cell in The Hague.”

READ THE REST HERE

Thursday, March 16, 2023

US releases video or Russian fighter vs American drone

 KYIV, Ukraine -- The Pentagon has released footage of what it says is a Russian aircraft conducting an unsafe intercept of a U.S. Air Force surveillance drone in international airspace over the Black Sea.

The 42-second video, released Thursday, shows a Russian Su-27 approaching the back of the MQ-9 drone and beginning to release fuel as it passes, the Pentagon said.

The U.S. military said it ditched the MQ-9 Reaper in the sea on Tuesday after the Russian fighter jet poured fuel on the unmanned aerial vehicle, in an apparent attempt to blind its optical instruments and drive it out of the area, and then struck its propeller.

The released excerpt does not show events before or after the apparent fuel-dumping confrontation.

Defense Secretary Lloyd Austin and Joint Chiefs of Staff Chairman Gen. Mark Milley have spoken to their Russian counterparts about the destruction of the U.S. drone following the encounter with Russian fighter jets.

The calls with Russian Defense Minister Sergei Shoigu and Chief of Russian General Staff Gen. Valery Gerasimov on Wednesday were the first since October.

While intercept attempts are not uncommon, the incident amid the war in Ukraine has raised concerns it could bring the United States and Russia closer to direct conflict.

That the two countries' top defense and military leaders were talking so soon after the encounter over the Black Sea underscored its seriousness.

The Russian Defense Ministry said in its report of the call with Austin that Shoigu accused the U.S. of provoking the incident by ignoring flight restrictions the Kremlin had imposed because of its military operations in Ukraine.

Russia also blamed "the intensification of intelligence activities against the interests of the Russian Federation."

Wednesday, March 15, 2023

Polish security break up Russian spy-ring.

 


By Adam Easton

A group of foreign citizens have been arrested on suspicion of spying for Russia, two Polish government officials have told the BBC.

Radio station RMF FM reported that Polish security services had broken up a spy network working for Russia.

Six people were detained on suspicion of having installed secret cameras to film transport infrastructure used to deliver aid to Ukraine, it reported.

RMF FM said the cell had prepared sabotage plans.

The decades-long spy conflict between Russia and the West has intensified since the Ukraine war.

Poland is one of Ukraine's strongest allies and its security forces have arrested several people on suspicion of spying for Russia since the invasion last February.

According to the radio station, the group had installed dozens of cameras beside railway junctions and important transport routes in Poland's Podkarpackie province, which borders Ukraine, it said.

Some of them were found close to a small regional airport that has been converted into an international logistics hub delivering military and humanitarian aid to Ukraine.

Military and cargo aircraft from the US and across Europe regularly fly in and out of the Rzeszow-Jasionka airport, where American troops can be seen beside their Humvees, to deliver supplies to waiting trucks that make the 100km (62 mile) journey to the Ukrainian border.

The site is considered so sensitive, Washington has deployed US Patriot air defense systems to protect the airfield.

US President Joe Biden flew into the airport on his way to his recent visit to Kyiv.

Security at critical infrastructure sites has reportedly been heightened, RMF FM said.

Poland's Interior Minister, Mariusz Kaminski, who is responsible for the Polish Internal Security Agency (ABW) - and whose officers reportedly made the arrests - is due to speak to the media about the RMF FM report on Thursday morning.

Several people have been arrested for spying in the past year. Last month, prosecutors charged a Russian citizen, who is a long-term resident in Poland, with spying for Russia between 2015 and 2022.

The man, who ran a business in Poland, was allegedly involved with historical reconstruction groups, where he made contacts with Polish military personnel.

He was arrested in April last year following an investigation that found he allegedly collected information on the organizational structure of Polish military units in the north-east of the country.

A Spanish national of Russian origin, who was identified as an agent for Russia's military intelligence agency (GRU) was arrested in Przemysl, south-eastern Poland, by the ABW last year on suspicion of spying for Moscow.

In March last year, a Polish employee of the Warsaw Registry Office, identified as Tomasz L., was arrested on suspicion of transferring operationally valuable data to the Russian intelligence services.

Additional reporting by Bartosz Kielak

Tuesday, March 14, 2023

BREAKING: RUSSIAN FIGHTER CLIPS US DRONE

 


A Russian fighter jet collided with an American Reaper drone over the Black Sea, bringing the unmanned aerial vehicle (UAV) down, the US military confirmed today.

The US military said one of two Russian fighters jet clipped the propeller of the drone, forcing the US to bring it down in the area of intense NATO military activity close to the Ukraine war frontlines, amid Russia's on-going invasion of the country.

'Our MQ-9 aircraft was conducting routine operations in international airspace when it was intercepted and hit by a Russian aircraft, resulting in a crash and complete loss of the MQ-9,' U.S. Air Force General James Hecker, who overseas the US Air Force in the region, said in a statement. 'In fact, this unsafe and unprofessional act by the Russians nearly caused both aircraft to crash,' he added, saying the incident 'follows a pattern of dangerous actions by Russian pilots...over international airspace'.

One Western source said earlier that an investigation was underway to check whether the drone had been shot down.

It was quickly clarified that a collision had occurred between a US-made MQ-9 Reaper and a Russian Su-27 fighter jet at 7:03am CET (6:03am GMT).

Tuesday, March 7, 2023

USAF RELEASES NEW B-21 PHOTOS THAT HINT AT TRAILING EDGE

CLICK TO ENLARGE 

 
ENLARGED AND BLOWN OUT TO SHOW INLET DETAIL -ENGINE COVERS IN PLACE 
contrast shows more details 

CLICK TO ENLARGE 



enhanced contrast shows tape and panel lines 





LinkWithin

Blog Widget by LinkWithin