Ukrainian hacking group’s haul shows Russian plans to destabilize Kiev…maybe. MRecently a cache of 2,337 e-mails from the office of a high-ranking advisor to Russian president Vladimir Putin was dumped on the Internet after purportedly being obtained by a Ukrainian hacking group calling itself CyberHunta. The cache shows that the Putin government communicated with separatist forces in Eastern Ukraine, receiving lists of casualties and expense reports while even apparently approving government members of the self-proclaimed Donetsk People’s Republic. And if one particular document is to be believed, the Putin government was formulating plans to destabilize the Ukrainian government as early as next month in order to force an end to the standoff over the region, known as Donbass.
Based on reporting by the Associated Press’s Howard Amos and analysis by the Atlantic Council’s Digital Forensic Research Lab, at least some of the e-mails—dumped in a 1-gigabyte Outlook .PST mailbox file—are genuine. Amos showed e-mails in the cache to a Russian journalist, Svetlana Babaeva, who identified e-mails she had sent to Surkov’s office. E-mail addresses and phone numbers in some of the e-mails were also confirmed. And among the documents in the trove of e-mails is a scan of Surkov’s passport (above), as well as those of his wife and children.
A Kremlin spokesperson denied the legitimacy of the e-mails, saying that Surkov did not have an e-mail address. However, the account appears to have been used by Surkov’s assistants, and the dump contains e-mails with reports from Surkov’s assistants. The breach, if ultimately proven genuine, would appear to be the first major publicized hack of a Russian political figure. And in that instance, perhaps this could be a response to the hacking of US political figures attributed to Russia.
The e-mails appear to show that Vladislav Surkov, a former deputy prime minister and currently a personal advisor to Putin, directly worked to undermine the political stability of Ukraine. Surkov, generally credited as the architect of Russia’s current political system and known by some as the “Grey Cardinal” of the Kremlin, is known to be in charge of managing relations with the Donetsk separatists. He also supervises things with South Ossetia and Abkhazia—two breakaway regions of Georgia recognized and aided by Russia.
Most of the e-mails are routine. However, a separate leak by the hackers includes a report that outlines a plan for undermining the stability of the Ukrainian government entitled “The plan of priority measures to destabilize the socio-political situation in Ukraine:
In view of the critical situation on the settlement of the issue in the Donbass region in Ukraine…it is necessary to create favorable conditions for controllable political forces to enter the new parliament…
As a result of fundamental changes in the Ukrainian political situation, it is possible to achieve the return of the Donbass to Ukraine on Russian terms…The achievement of set goals provides as soon as possible provides measures for the political destabilization of Ukraine. The consequence [would be] early parliamentary and presidential elections. The most favorable period for…the set of measures is in November 2016 to March of 2017.
The e-mails contain other evidence of collaboration with separatists, such as drafts of documents later published by the Donetsk separatists. Those drafts include an open letter allegedly written by a Donetsk resident begging for Ukraine to end attacks. There is also a PDF of a document listing proposed ministers for the Donetsk People’s Republic government with some written markup and expenses for operating the Donetsk press center.
The timing of the release of the documents may suggest that the “Ukrainian hacker group” may in fact have acted with the aid or at the direction of the CIA. That could be part of the “secret” cyber-response reportedly being developed in response to purported Russian hacking of the Democratic National Committee, the e-mails of the Clinton presidential campaign chair John Podesta, of state election officials’ systems, and of other political organizations. The hack may also be part of an influence campaign in support of the Ukrainian government, though it’s unlikely Ukraine’s own intelligence organization was involved. Ukrainian National Security Service officials said on Wednesday that they believed the e-mails were real, but the organization also said it was possible that the files may have been tampered with. However, Ukrainian hackers have already racked up an impressive record with other hacks of Russian government servers.
Regardless of their provenance, the documents would be a natural fit for Wikileaks since this raw dump of e-mails with attachments looks similar to the Podesta e-mails. Wikileaks previously published e-mails from Syrian political figures—a collection of over two million e-mails dated from 2006 to 2012. However, the Daily Dot’s Dell Cameron and Patrick Howell O’Neill reported that those e-mails (obtained originally by Syrian anti-government “hactivists”) were published minus a set of e-mails detailing the movement of billions of dollars from Syria’s central bank to a Russian bank. Wikileaks denied suppressing the documents.
Source:https://arstechnica.com/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
