From Russia

Mother Russia’s Prodigal Sons

By Fritz Lamour

FSB Colonel Sergei Mikhailov/Crimerussia

On December 5th, 2016, Colonel Sergei Mikhailov attended a meeting inside​ the Lubyanka headquarters of the FSB​; the KGB’s successor agency. Mikhailov was head of the​ FSB’s cyber investigations department​.

The start of the meeting was nondescript. But at some point, to the shock of many FSB officers present, an arrest unit stormed the occasion and threw a sack over an unsuspecting Mikhailov’s head, then dragged the arrested officer off of the premises. Detained earlier was a close Mikhailov associate, Ruslan Stoyanov; then the ​head of Kapersky’s cybercrime investigations​.

Later that month, two other men were jailed-- one then a current FSB officer, Dimitry Douchaev and the other a former,Georgy ​Fomchenkov​.

One year since, all four are charged with treason and are being​ detained in Moscow’s Lefortovo Prison; in cells that measure nine square feet and have no running water.

Ruslan Stoyanov in ​Lefortovo Prison/YouTube

Over the year, the official story involving the four has vacillated. But the sensational nature of Mikhailov’s arrest and the fact that the four are charged with treason is not in dispute.

According to Sergei Markov—a member of the Public Chamber in the Russian parliament and

an adviser to the Kremlin, “FSB Colonel Sergei Mikhailov, who was responsible for cyberwars and cyberattacks… was arrested by the FSB; yes, with a bag over his head.”

Attempts were initially made to ​tie Mikhailov to a group of hackers in Ukraine and Thailand called ​Shaltay Boltay. ​ Reports even surfaced claiming that $12 million had been exhumed from Mikhailov’s country home. Speculation concerning his biography began to swirl even.

But according to a report by a respected Russian news outlet, the Bell, the actual story is filled with much more complexity and intrigue.

The Bears Attack

July 2015 -a hacker group nicknamed Cozybear entered the Democratic National Committee servers. ​"Cozy Bear" employed the "Sea Daddy" implant and a "​Power Shell​" backdoor to accomplish success. It’s presumed the group was spying on communications, stealing ​opposition research​, and reading all ​email​ and chats. The tools employed by Cozy Bear possessed all the trademark signs of the FSB. Around March of 2016, Russia’s military intelligence agency GRU unleashed it’s own hacker group nicknamed Fancybear on both the DNC servers and the Clinton campaign. "Fancy Bear" employed ​X Agent​ malware which enabled distant ​command execution​, ​transmissions of files and ​keylogging​, as well as the "X-Tunnel" malware.

According to a Mikhailov acquaintance, the two agencies compete for funding and FSB Colonel Sergei Mikhailov felt the FSB carried out cyber tasks more professionally than its counterpart.

“The GRU breaks into servers in a brazen, clumsy, and brutish manner and it interfered with his own work”, the acquaintance mentioned. More to the point “the GRU’s hackers didn’t even try to cover their tracks”.

On March 19th, 2016, Clinton advisor John Podesta received an email supposedly from Google.

It stated hackers had attempted to infiltrate his Gmail account and requested that he change his email password. A Podesta aide, Sarah Latham, forwarded the email to IT campaign staffer Charles Delevan.

“This is a legitimate email. John needs to change his password immediately, and ensure that two-factor authentication is turned on his account,” replied Delevan.

Latham then forwarded Delevan’s email to special assistant Milia Fisher.

“The gmail one is REAL Milia, can you change,” she wrote, “does [Podesta] have the 2 step verification or do we need to do with him on the phone? Don't want to lock him out of his inbox!”

Delevan later told the NY Times he accidentally gave Latham the impression that that the email was legitimate when he typed ‘legitimate’ instead of ‘illegitimate’. As stated by Delevan to the Times, he still hasn’t forgiven himself for the typo.

The Gru Backstory FancyBear’s first strike against the Clinton campaign was launched before Noon on March 09, 2016. 29 phishing emails went out --all addressed to people that had worked on Clinton’s 2008 campaign-- and all bounced back. Except for one.

The victim’s identity isn’t revealed. Reporting suggests a female 2008 Clinton campaigner who rejoined Clinton’s 2016 campaign had her email hacked and contacts exposed.

On March 19th, a link was generated for John Podesta at 11:28 am. A documents dump by Wikileaks shows it hit his inbox six minutes later. It was clicked on twice.

Nonetheless, FancyBear’s hacking efforts continued on unabated. Three separate attacks went out on March ​22nd, 23rd and 25th, targeting communications director Jennifer Palmieri

and Clinton confidante Huma Abedin.

Around this time, the FBI caught wind due to the torrent of phishing emails. Also, a cybersecurity company called Secureworks played a role in the hack’s detection. FancyBear made a critical error. A ​ setting in the Bitly link-shortening service had been fumbled. The

blunder exposed their target.

The Weaponization

By April, other elements of the GRU’s plan were begun. On April 19th, a Romanian web hosting company called THCServers.com received a $37 bitcoin payment to create DCleaks.com.

Around this time, both the Clinton and Trump campaign began to realize that there was a matter afoot. On April 20th, a DNC Consultant Alexandra Chalupa received a warning from Yahoo that stated her account was under threat by state-sponsored Hackers. She circulated screen grabs among friends.

Also on April 26th, a meeting took place at a london hotel between George Papadapolous, a Trump campaign foreign policy adviser and a​ professor with close known ties to the Kremlin.

According to recently unsealed documents, the meeting was in regards to compromising information the Kremlin had on Clinton.

“They have dirt on her,” Papadopoulos was then told. “They have thousands of emails.”

On Friday June 10, staffers filled the DNC’s main conference room for a mandatory meeting.

According to two people there at the time, DNC chief operating officer Lindsey Reynolds told the crowd,“What I am about to tell you cannot leave this room.”

Everyone needed to turn in their laptops immediately; there would be no last-minute emails; no downloading documents and no exceptions. Reynolds insisted on total secrecy.

“Don’t even talk to your dog about it.”

Reynolds didn’t return AP messages seeking comment.

Days later, cybersecurity firm, Crowdstrike, was brought in to clean out the DNC’s computers.

On Tuesday, June 14, the Democrats made public the hack.

The following day, around noon, ​William Bastone, the editor-in-chief of investigative news site The Smoking Gun, received an email marked “CONFIDENTIAL.”

A FancyBear conjured hacking personality greeted, ‘Hi, this is Guccifer 2.0 ​and this is me who hacked Democratic National Committee.”

Newly arrived to the scene, Guccifer 2.0 began chatting up journalists on Twitter, and releasing portions of emails, and directing traffic to DCLeaks.com. ​According to an AP count, Guccifer

2.0, WikiLeaks and DCLeaks ultimately published more than 150,000 emails stolen from more than a dozen Democrats

Around this time, Clinton campaign staffers began to dread the hack and its turmoil. ​“It felt like

your friend had just been robbed, but it wasn’t just one friend, it was all your friends at the same time by the same criminal,” said Jesse Ferguson, a former Clinton spokesperson.

Staffers began looking over their shoulders in fear that they were being spied on.

The October 7th Bombs

October 7, 2016, an Access Hollywood tape was released in which Donald Trump was heard making sexually derogatory comments. That same day, U.S. Intelligence agencies, by then aware of the FSB and GRU activities, released a public finding on the cyber attacks.

By that afternoon, ​WikiLeaks​ began to publicly dump emails fromPodesta's Gmail account.

Throughout October, WikiLeaks released daily installments.

Crowdstrike’s June2015 report Months before Wikileak’s Podesta dump, the cybersecurity firm, Crowdstrike, released a report on their findings, which is still on their site.

In it, Crowdstrike identifies two sophisticated adversaries on the network – both COZY BEAR and FANCY BEAR. As stated, ‘We have identified no collaboration between the two actors, or even an awareness of one by the other.’ Elsewhere, ‘Not only do they have overlapping areas of responsibility, but also rarely share intelligence and even occasionally steal sources from each other and compromise operations’.

The U.S. Response

By late September, the U.S. intelligence community began to publicize Russia’s cyber meddling in the 2016 U.S elections. Before departing office, the Obama administration responded to the attacks by sanctioning Russia. 35 diplomats were forced to return to Russia and mentioned in Obama’s executive order was the involvement of the FSB, GRU and individuals and companies.

Noticeably, the administration’s rebuke of the GRU was far more severe than it’s response to the FSB. Personal sanctions were levied against GRU head, Igor Korobov and three GRU deputies.

Igor Korobov Chief of the GRU/russiandefensepolicy.org

Igor Olegovich Kostyukov/russiandefensepolicy.org

Vladimir Stepanovich Alexseyev/russiandefensepolicy.org

No public picture of Sergey Aleksandrovich Gizunov, Deputy Chief of the GRU exists.

How U.S and Russian Intelligence were so positive after the fact Kimberly Zenz is an IDefence Intelligence analyst. Described as a cybersecurity expert, her career has been built around Russian cyber investigations. In the early 2000’s she lived in Russia and was romantically linked to a Russian Cybersecuity expert, Dimitry Levashov, who once had been a principle at Indrik, a cybersecurity firm. His partner at the time was Ruslan Stoyanov, who, as previously mentioned, is being charged with treason.

Kimberly Zenz/Linkedin

According to a Mikhailov foe, Zenz features prominently in a chain of links between FSB Colonel Sergei Mikhailov and U.S Intelligence. Her accuser, Pavel Vrublevsky, himself, figures prominently in Russia’s scheme to disrupt the U.S. Elections .

Pavel Vrublevsky/Linkedin

According to Russian press, Mikhailov was able to confirm for U.S. intelligence that attacks on US voter database systems in August of 2016 were associated with King Servers. Owned by Vladimir Fomenko, King servers are actually located in the Netherlands and rented from a Dutch company owned by none other than Pavel Vrublevsky.

Vrublevsky is alleged to be the mastermind behind numerous spam network. He is also the owner of Chronopay, a Russian online payments system. A dispute between Chronopay and its competitors brought the FSB’s Mikhailov into a running feud with Vrublevsky.

Pavel Vrublevsky under arrest/crimerussia

In 2011, Vrublevsky was sentenced to three years behind bars on charges of organizing a hacker attack on a rival payment system. Mikhailov was the primary witness against Vrublevsky.

Before his imprisonment, Vrublevsky instructed a former Foreign Intelligence Service (SVR) employee Dmitry Burykh , to collect kompromat on Mikhailov.

Burykh says he found that Mikhailov gave classified information to Stoyanov, who would then pass the information to his former partner at Indrik, Dmitry Levashov, who would then pass information to his girlfriend, Kimberly Zenz, who then passed information to her IDefence superior, Rick Howard, who would then pass information to former U.S deputy secretary of defense, WIlliam Lynn.

Zenz has denied the accusations, telling Reuters, “I don’t work for the CIA, I never gave them intelligence and I have never been an agent for any government”.

No public picture of Dmitri Leveshov exists.

Rick Howard/Getty Images

William J Lynn/Getty Images\

In its response to Russia’s cyber attacks, the Obama administration mentioned the FSB assisted the GRU. But the administration’s mild treatment of the former suggests insider knowledge of events. As remarked by a former U.S Intelligence officer, to have such certainty is likely because of human intelligence.

In fact, when a question was posed to Crowdstrike owner, Dmitry Alperovich, ‘how were they able to definitively conclude that the FSB and GRU attacks had been independent of one another?’ Alperovich chose not to respond.

An associate of the defendants states Mikhailov passed information to Crowdstrike through an intermediary. The source claims that Mikhailov did so on as many as 10 separate occasions — with Stoyanov, his trusted friend, often acting as an intermediary.

Acquaintances of both Mikhailov and Stoyonav paint a picture of two idealistic men. Friends on a crusade to right the bad things they saw happening, trying to stop them. Now the friends sit in cells nine square feet, without running water; prodigal to a country.