Google Accounts Of US Military, Journalists Targeted By Russian hackers

The Threat Group 4127 that hit the Democratic National Committee also went after 1,800 other targets with info interesting to Russian government, says SecureWorks.

A Russian attack group used the Bitly URL-shortener to disguise malicious links in order to carry out spearphishing campaigns not only against the Democratic National Committee, but also against some 1,800 Google accounts of US military and government personnel and others.

Researchers at SecureWorks Counter Threat Unit today said the spearphishing campaign, carried out in mid-2015 by Threat Group 4127 (TG-4127), mostly targeted people inside Russia and former Soviet states, but it also targeted individuals who were publicly critical of the Russian Federation or who had information valuable to the Russian Federation.
SecureWorks tracks them as Threat Group 4127 (TG-4127), but "components of their operations have been reported under the names APT28, Sofacy, Sednit, Fancy Bear, and Pawn Storm" by other security companies. SecureWorks assesses with "moderate confidence" that TG-4127 operates from the Russian Federation and gathers intelligence on behalf of the Russian government.
The group registered the domain "accoounts-google.com" to host a spoofed Google login page, and used the Bitly URL-shortener to cloak that location within the spearphishing messages. In all, some 1,881 Google account users were phished. Some were only sent one message, while others were sent several; the attackers used a total of 4,396 phishing URLs.
Betweeen March 2015 and September 2015, 59% of the malicious URLs were accessed, "suggesting that the recipients at least opened the phishing page," and were possibly compromised.
SecureWorks believes that TG-4127's information-gathering efforts primarily focus on individuals and organizations inside Russia and former Soviet states However, certain groups in the US and Western Europe are also targeted.
The researchers break TG-4127's Western targets into two main groups: those who are publicly critical of Russia, including journalists, activists, NGOs, and authors; and those who have information that is useful to the Russian government, like current and former US military personnel, government personnel, and people in the defense supply chain.
The group also targeted a considerable number of authors who write about being military spouses or family members -- 22% of the targeted authors and journalists fell into that category, compared to 53% who were experts on either Russia or Ukraine. SecureWorks theorized that the attackers might be looking for information on "broader military issues in the US or gain operational insight into the military activity of the target's spouse."
Of the current and former military and government personnel targeted (excluding the "military spouses"), 64% were American personnel, according to SecureWorks' report.
The cybersecurity industry was also in the bullseye. Other targets included a security consultant for NATO and the director of federal sales for the security arm of a multinational technology company. It is not clear how many organizations were actually compromised through this campaign.

Earlier, some other cyber security agencies investigated the situation and gave their vision on the sorces and origins of the attack.

US.: Agencies can start to spy on your Social Media activities right from the Airport

Hey! Welcome to the United States. May we have your Twitter handle, please?

That's exactly what you'll likely be asked by the U.S. Customs and Border Protection at the airport prior to entering U.S. soil.

Yes, your Twitter handle may soon be part of the US Visa process as U.S. Customs and Border Protection has entered a new proposal into the federal register, suggesting a new field in which foreign visitors can declare their online presence.

This new proposal submitted by the US Department of Homeland Security (DHS) to the Federal Register on Thursday would update the required entry forms with a question asking travelers to "Please enter information associated with your online presence -- Provider/Platform -- Social media identifier."

This information would not be mandatory, but of course, foreign travelers who decline to reveal their online presence may subject for additional scrutiny.

What's the idea behind Knowing the visitors' Online Presence?

According to DHS, the social media snooping would add a new level of scrutiny to potential foreign visitors, who are already photographed, fingerprinted, and in-person interviewed, alongside numerous database checks.

"Collecting social media data will enhance the existing investigative process and provide DHS greater clarity and visibility to possible nefarious activity and connections by providing an additional tool set which analysts and investigators may use to better analyse and investigate the case," reads the proposal.

The new field would be added to the Electronic System for Travel Authorisation (ESTA) and Form I-94 that is used as a record to notify United States authorities in advance of their arrival to and departure from the country.

US Customs and Border Protection is seeking comments on the new proposal until August 22. So, the public has 60 days to write to the agency's Washington, D.C. office before the proposal is formally considered.

Tracking - Biggest Privacy Concern in the Digital World

The United States is not the only nation that wants to track foreign visitors. Many countries have their own way through which they track visitors.

The Canadian spy agency tracks foreign travelers even days after they left the terminal, by capturing their device identification from the free Wi-Fi hotspots at a major Canadian airport, according to documents revealed by Edward Snowden.

However, tracking is illegal. Just recently, a Singapore-based InMobi mobile advertising company that tracked the locations of hundreds of Millions of users without their consent agreed to pay $950,000 in penalties to settle charges of violating federal law.

At last, just answer me…

Will any potential bad actor or terrorist, if asked, reveal their online presence?

Also, if this technique will actually prevent terrorists from entering the country, then what about the potential terrorists who already live in the US or are U.S. citizens?

Hacker sells 655K records of healthcare clients on Dark Web

A hacker claims to be selling 655,000 alleged patient healthcare records on the dark web, containing information such as social security numbers, addresses, and insurance details.
The news was first reported by Deep Dot Web Saturday. A hacker who goes by the name ‘thedarkoverlord’ gave Deep Dot Web images of purported records. Identifiable information from the records was redacted “so the target company can remain anonymous for now,” the hacker told Deep Dot Web.

The databases are said to be from three different healthcare organizations and are being sold for between around $100,000 and $395,000, Deep Dot Web reports. One database originated in Farmington, Missouri, and contains 48,000 patient records, according to the report, while another from the Central/Midwest U.S contains 210,000 patient records. A third database from Georgia, U.S., has records on 397,000 patients.
In an encrypted conversation, the hacker told Deep Dot Web that the records were accessed using an exploit for Remote Desktop Protocol (RDP) that gives remote access to devices. A one-off copy of each database is reportedly being sold on TheRealDeal, a shadowy dark web marketplace that provides anonymity to buyers and sellers.
The dark web, or darknet, refers to private networks built from connections between trusted peers using unconventional protocols. Dark Web is just one part of what is known as deep web – a vast network which is not indexed by search engines such as Google and Bing.
While the authenticity of the healthcare data dump is unclear, website Motherboard received a sample of just under 30 records from the alleged Georgia hack. Motherboard reports that most of the phone numbers went through to the correct person or family home. One person also confirmed the rest of their details, although the physical address was out of date, it added.
Alleged social security numbers, full names, physical addresses, dates of birth and insurance information are included in the dump.
Healthcare is an increasingly attractive target for cybercriminals. In February a Los Angeles hospital paid nearly $17,000 in Bitcoin to hackers who disabled its computer network.
"The healthcare industry has been especially targeted as of late, and what we see on the Dark Web is just what is being openly sold,” said Gadi Evron, CEO and co-founder of network security company Cymmetria, in a statement emailed to FoxNews.com. “The healthcare industry is taking the situation very seriously, but there is no doubt that hackers sense the potential gains and are now targeting them more than before.”
Last month a hacker was reportedly looking to sell a package containing account records for 167 million LinkedIn users on the dark web.

"OurMine" hackers got access to Google CEO's twitter

There is a new group of hackers in town. After acquiring the Twitter login credentials of Mark Zuckerberg the new group of hackers known as ‘OurMine’ has managed to gain access to Google’s CEO Sundar Pichai. 

Everyone started to talk about them at the beginning of this month. The collective of hackers known as OurMine has been pursuing high profile targets. The list of successful attacks is growing, the hackers even managed to steal the login information of Twitter’s ex-CEO Dick Costolo. Who are they?

It’s obviously hard to track a group of people that uses the internet to commit crimes. Services like Proxy tunnels, Virtual Private Networks, and Virtual Private Servers enables people to mask their identities and minimize their online presence. OurMine has used several IP addresses from Saudi Arabia, and the hackers have been actively trying to gain notoriety and fame since the beginning of this year.

Although the group has an official website where they claim to offer security auditing services, a few inconsistencies about the hackers true nature remains. Recall that White-Hat hackers are the ones who work side by side with companies or individuals to aid them in the task of achieving the ‘Security of Operations’. Hackers in this spectrum like to find bugs and collect legitimate bounties on their discoveries. However, OurMine doesn’t fall entirely in this category.

Crackers (or black-hat hackers) like to benefit one way or another from the malicious attacks they perform. OurMine has shown that they belong in this category. The group has performed attacks on Minecraft game servers and public organizations like WikiLeaks. Apparently, the first public mention of the collective was back in July of 2015, when they allegedly carried out a Denial of Service Attack against several financial institutions.

The group gained some notoriety when they performed another DDoS attack, this time against WikiLeaks, this led to some criticisms, especially from the ‘hacker community’. The timing of this attack was bad, Anonymous was collaborating with WikiLeaks in an operation about Cyber Espionage in the United States.

Attacking YouTubers Channel is another of the activities attributed to OurMine, Markiplier, a YouTuber gamer with more than 14 million subscribers saw how his channel got hijacked by the crackers. This attack was replayed on to other Youtube Channels.

The group started to target famous people to gain further popularity and notoriety:

As always, we encourage our readers to exert caution. Basic security measures like never reusing passwords across websites, never installing suspicious software on your computer, and to keep large stashes of cryptocurrencies on secure cold wallets.

Ghost Squad Hackers Leak Data of US Military Personnel

Ghost Squad Hackers have dumped the data of US military personnel, according to a Facebook post published today.

The data is on a website on the Dark Web but has been added to PasteBin after a few hours as well.

Group leaks data for around 3,400 servicemen

Dump #1 contains 433 records. For each record, with very few exceptions, there's data included such as a person's name, phone number, address lines, city, state, ZIP code, country (all US), email address, age, gender, and income level.

Dump #2 contains 232 records. For each record, there's an email address, first name, last name, address, city, state, ZIP code and phone number.

Dump #3 contains 2750 records. For each record, the data dump may include a full name, email address, date of birth, address lines, credit card number, credit card expiration date, credit card CVV, credit card type, and two fields marked APO and AE. APO may stand for Automatic Payment Order.

Softpedia found the names of some persons in two or all three dumps, so some duplicates appear to exist.

Group says leak is part of #OpSilence

"The final release for #OpSilence Army database leaked, your empire ran by banks will fall US GOV," the group wrote on Facebook. "You must view these leaks in Tor Browser we are not jeopardizing our freedom."

OpSilence is a hacktivist campaign launched by Ghost Squad Hackers at the start of June. When announced, the group told Softpedia that OpSilence was a campaign against mainstream media sites because they failed to report the true crimes happening in Palestine and Syria.

Previously, Ghost Squad Hackers have also been at the core of OpIcarus, a campaign of DDoS attacks against banks in several countries.

The hackers are associated with the Anonymous movement but have recently started to promote their own name via OpSilence.

Group Squad Hackers loses its leader

Softpedia could not verify the validity of the group's claims, but if the data belongs to US military servicemen, the US doesn't take kindly to these types of leaks.

One of the most infamous such incidents occurred last summer when the US killed Junaid Hussein in a drone strike. Hussein was the former leader of the TeaMp0isoN hacking crew, but at the time of his death he joined the Islamic State's Hacking Division called the Cyber Caliphate.

Maybe this is the reason why approximately one hour before Ghost Squad Hackers leaked the data, its official leader, a hacker known as Gh0s7, announced on Twitter he was leaving the group. Softpedia has reached to Gh0s7 for comment regarding his involvement in the data leak and his reasons for leaving Ghost Squad Hackers.

Acer online store breached, 34,000 credit cards stolen

Intruders gained access to Acer customer data via a third-party payment processing system

If you live in the U.S. or Canada and purchased an Acer device from the company within the last year from its online store, then your credit card information is likely in the hands of cyber thugs.
According to a sample breach notification letter sent to the California Attorney General’s office, Acer said, “We recently identified a security issue involving the information of certain customers who used our ecommerce site between May 12, 2015 and April 28, 2016, which resulted in unauthorized access by a third party.”

Mark Groveunder, Acer’s vice president of customer service, warned affected customers that the data stolen included names, addresses, credit card numbers as well the associated expiration date and three-digit CVV security code.
The Taiwanese company said 34,000 customers across the U.S., Canada and Puerto Rico were affected.

The company hired “outside cybersecurity experts” to investigate the breach, but at this time it does believe password or login credentials were stolen.
Softpedia noted that Acer runs its store on the Magento Enterprise platform, but the security issue came from one of its third-party payment processing systems. The company “took steps to remediate the issue, and later notified the credit card payment processor.” It also offered to fully cooperate with federal law enforcement.
Hacking a company via a third party is nothing new. Javvad Malik, security advocate at AlienVault, told IBTimes, “Attackers will choose the path of least resistance to get into a company—and if it is well-secured, then this path will usually be through a third party that has legitimate access. Having an appropriate supplier security assurance framework in place that sets the requirements for a third party and also the ongoing controls is essential.”
Acer is not offering free credit monitoring or identity protection services, but it advised affected customers of their right to file a police report, contact their State Attorney General’s office or the Federal Trade Commission.

The letter also contained a “resource guide” about how to place a fraud alert for identity theft or a security freeze on credit files.

Google hacker donates money to charity

Google hacker Tavis Ormandy and security firm Bromium have handed Amnesty International US$30,000 (£20,443, AU$40,242) in bug bounty cash awarded after the former broke the latter's security controls.
Ormandy donated his US$15,000 (£$10,214, A$20,104) winnings under Bromium's hacking challenge, in which researchers were invited to brew malware capable of defeating its end point portection.

Ormandy (of Google Project Zero) defeated and escaped the company's sandbox, exposing an avenue for potential remote compromise.
Bromium donated a further US$15,000 to Amnesty International.
The charity known for its work in human rights, child poverty, and freedom thanked the hacker for his donation.
Bromium co-founder Simon Crosby hoped the charity model would catch on the industry, but described it as "a bit like a visit to the proctologist".

bromium have made first donation to @amnesty for the host escape I reported, matching donation on way soon! Awesome! pic.twitter.com/W6qU9azCDY

— Tavis Ormandy (@taviso) June 20, 2016

"We think it’s important to hold security vendors accountable: Ditch marketing BS in favor of defensible design and rigorous evaluation," Crosby says.
"And though we were surprised when Tavis Ormandy of Google claimed he had identified two bugs that let him escape micro-VM isolation, I was quietly rather pleased.
"... as an acknowledgement of his sheer professionalism and as testament to his awesome white-hattery, I have personally matched the Bromium award with a donation in Tavis’s honour."
Ormandy worked with the company over a week to validate and help patch the sandbox escapes.
Bromium will now work to set up a formal bug bounty.

Who is Guccifer 2.0? Is Russia involved in DNC hack?

 

First things first. The story begins...

June 14th.
A cyber security firm Cowdstrike announced that Russian pro-government hackers organized a cyber-attack on US Democratic national committee. President of Crowdstrike Shawn Henry and the co-founder  Dmitri Alperovitch in an interview to Washington Post reported their findings. Later that day an official report appeared on the company's site, defining hacktivists as Cozy Bear and Fancy Bear, they were supposedly linked with Russian secret sevices FSB and GRU.

Interesting details appear...

June 15th.

A hacker with a nick-name Guccifer 2.0 in his twitter and on his site announced that it was HE who hacked DNC servers and not the Russian hacker groups. As a proof of his "achievement" he posted a huge document containing compromising information on Donald Trump.

And here comes the first reaction...

Many cyber security companies started their own investigations to reveal the truth - who hacked US DNC? Who told the truth - Crowdstrike or Guccifer 2.0?

June 16th.

So first came a report on official site of cyber security firm SecureWorks Counter Threat Unit. 

They proved that Russian hackers APT28 were definitely involved in the cyber attack. Moreover they must have had hidden access to google accounts of DNC and other US government institutions' personal. 

June 17th.

Then a second firm confirmed the information about Russian hackers - Threat Connect. On their official site they uploaded their investigation materials. They suppose that hackers APT28 aka Fancy Bear conducted the attack and hacker Guccifer 2.0 worked for them or even was one of them but he insisted that he worked alone to conceal the Russian involvement.

Another company Ars Technica conducted an investigation too. They agree that it is highly probable that Guccifer 2.0 can be Russia-related.

June 18th.

And as it often happens, one of the media sources Bloomberg decided to contribute to the overall fuss and confusion and posted an article based on an "anonymous competent source" claiming that the Russian hackers not only hacked DNC but perpetrated the WHOLE US POLITICAL SYSTEM and can corrupt it.

The "lone hacker" responds...

June 20th

On his official site hacker Guccifer 2.0 announces his intention to further reveal confidential data now on Hillary Clinton. The world community waits...

The reaction continues. Cyber experts hurry to express their opinions...

June 20th

Michael Buratowski -an expert from a firm  Fidelis Cyber Security posted a report on his company's official blog page. He proved the information given by Crodstrike in the beginning. He said Russian government-related hackers APT28 aka Fancy Bear and APT29 aka Cozy Bear hacked DNC.

Marshall Heilman - an expert from a Fire Eye affiliated firm Mandiant told Washington Post the same thing: Russian hackers APT28 and APT29 are responsible.

June 21th

Dave Aitel- CEO in a cyber security firm Immunity Inc. in an interview for Washington Free Beacon expressed serious doubts as to the Guccifer 2.0 announcement. According to D.Aitel, a lone hacker simply couldn't conduct such an outrageous cyber attack on US government. He thinks it is definitely work of Russian pro-government hackers - one of the steps in a bigger plan to corrupt US political system and crash the US government.

Guccifer 2.0 keeps his word...

June 21th

On his official site hacker Guccifer 2.0 posts a big number of documents (MS Word and MS Exel files generally) as he promised a day before. He proves he really has the leaked data. thus he provokes bigger concerns in cyber expert circles. At the same time doubts still remain as to wether or not he is related to Russian Kremlin...

Last but not least. Some new developments...

June 21th

Mother Board - A magazine that specializes on cyber security high-tech and electronics contacted hacker Guccifer 2.0 and took an interview. We can read the full transcript of it and see the report made by Mother Board specialists. they actually tried to check on the hacker's language skills in Romanian (as he claims to be a Romanian like notorious Guccifer) and Russian. They couldn't prove wether he speaks Russian or not. Mother Board didn't get much useful technical information either. The hacker said in most general words how he managed to breach the DNC security...

So this interesting interview sheds no light on Guccifer 2.0's personality.

Thus we observe a whole horde of IT experts claiming Russian hackers hacked DNC. Only few of them attribute Guccifer 2.0 to the Russians though. But it can be implied that he is Russia-related when specialists say he couldn't do it alone without serious (possibly secret services') support.

Game world disaster. DDoS attack on Blizzard servers.

On the 20^th of June a hacker AppleJ4ack (known to be affiliated with Lizard Squad group) tweeted about his intention to attack battle.net – Blizzard Entertainment’s gaming network.

Hai there @BlizzardCS
Don't mind me, just doing some preparations.
Take care of my packets, Thanks😘

— AppleJ4ck (@AppleJ4ckxoxo) June 20, 2016

Later that day massive problems with users’ authentication started. Thousands of players around the world had difficulties loging in their accounts in Diablo, World of Warcraft, Overwatch and other popular games by Blizzard.

Later Blizzard’s technical support reported minor malfunctions in their authentication services that led to temporary block of user’s accounts. For the same reason multiplayer mode was unavailable either. Players kept being kicked out of the online matches.

The issues were resolved soon afterwards but users outside the US. Still report having problems.

It’s not the first raid of the Lizard Squad group against video games produces. Therewas a notorious hack of PS4 and Xbox before.

Hacker Spied on Canadian Political Party's Meetings

The Quebec Liberal Party (PLQ), a federalist provincial political party in Canada, has fixed a security issue in their video conferencing software that allowed an unknown hacker to spy on their meetings and even access the video camera feeds when he wanted.

Fortunately, the man who gained access to this system had no malicious intent and appropriately disclosed the issues to the PLQ staff so that they could secure their system.

PLQ video conferencing system used default admin password

The unnamed white hat told Canadian journalists that the PLQ's software contained a security flaw and also used the factory default password, according to the Le Journal de Montreal.

The hacker said he accessed the party's video feeds during PLQ meetings. He explained he logged into the video conferencing software multiple times and observed PLQ meetings on different occasions.

The white hat wanted to remain anonymous and asked a reporter of Le Journal de Montreal to report on the issues on his behalf. To validate his intrusion claims, the hacker told the reporter about some of the topics discussed in the meetings.

Additionally, the hacker was also able to start the video feed from PLQ's cameras on demand and have a look at the party's HQ whenever he wished. The hacker provided screenshots to prove his claims.

PLQ acknowledges hack, fixes issues

PQL officials confirmed the breach but said that no sensitive, nation-level issues were ever discussed in these meetings. It appears the hacker spied on meetings between PLQ's Quebec and Montreal branches.

After spending a few days investigating the issue, PLQ officials have told the reporter that they fixed the illegal access bug and changed the video conferencing software's default password.

PLQ officials did not say if the hacker used the default password or the security bug to access their network.

The Kremlin’s Hidden Cyber Hand

The Islamic State’s hacking army doesn’t actually work for ISIS—It’s part of the secret Russian online espionage effort against the West

 

For two years the so-called Cyber Caliphate has been the online weapon brandished by the Islamic State against its enemies. Its hacking offensive, including aggressive use of social media, made front-page news around the world, heralding a new front in that murderous group’s worldwide jihad against “infidels.”

Pledging support to ISIS, the Cyber Caliphate hacked and defaced U.S. Government websites and social media feeds, including those of Central Command, the Pentagon’s Middle East headquarters. Numerous smaller cyber-attacks followed. They also hacked into Department of Defense databases and posted the personal information of 1,400 American military affiliates online.

The Cyber Caliphate has attacked targets in many countries, including allegedly accessing top secret emails belonging to senior British government officials. The most public of their attacks was the April 2015 hijacking of several feeds belonging to the French channel TV5Monde, which included defacing its website with the slogan “Je suis ISIS.” This assault, seen by millions of people worldwide, gave the group the notoriety it craved.

The American-led coalition against ISIS has taken the Cyber Caliphate threat seriously, devoting significant intelligence resources to tracking and studying the group. Western fears increased this April with the announcement that disparate ISIS hackers were merging, creating a new United Cyber Caliphate, designed to be a major expansion of the existing Cyber Caliphate. Drawing together jihadist hackers from many countries, this would constitute a major online threat.

In response, the Pentagon in late February announced the unleashing of real cyber-war against ISIS, including attacks by U.S. Cyber Command against the Islamic state’s communications, in an effort to disrupt their activities both kinetic and online. Neither are the Pentagon’s efforts to shut down the Islamic State’s online antics limited to the Internet. In August 2015, a drone-strike at Raqqa, ISIS’s Syrian stronghold, killed Junaid Hussain, a 21-year-old British jihadist of Pakistani origin who was the group’s best-known hacker.

However, there have long been whispers that the Cyber Caliphate is not what it claims to be. French intelligence examined the group closely after the TV5Monde attack and concluded that the hackers involved actually had nothing to do with the Islamic State. Rather, they were affiliates of a hacking collective known to be affiliated with the Kremlin, in particular APT 28, a notorious group that’s a secret arm of Moscow, according to Western security experts.  In other words, the Cyber Caliphate is a Russian intelligence operation working through what spies term a cut-out.

 

U.S. secret agencies, including the National Security Agency, which controls American cyber-espionage and works closely with CYBERCOM, came to similar conclusions. “APT 28 is Russian intelligence, it’s that simple,” explained an NSA expert to me recently. Hence the mid-2015 State Department security report that, while assessing the jihadist hackers as a formidable threat, nevertheless concluded, “Although Cyber Caliphate declares to support [the Islamic State], there are no indications—technical or otherwise—that the groups are tied.”

This has become the consensus view among Western intelligence services that have closely examined ISIS hacking efforts. From the newsmagazine Der Spiegel we now learn that German spy services too have concluded that the Cyber Caliphate is really a secret Russian operation. German intelligence assesses that the Kremlin has some 4,000 hackers on the payroll of its security agencies, including the General Staff’s Main Intelligence Directorate or GRU, the Foreign Intelligence Service or SVR, and the Federal Security Service or FSB. Together, this is a formidable offensive cyber force that operates through fronts and cut-outs to attack Western interests.

In other words, the Cyber Caliphate is a Russian false-flag operation. Although that loaded term has been hijacked by tinfoil-hat wearers and fringe websites, including lunatics who think horrific school shootings didn’t actually happen, it’s a perfectly legitimate espionage method of venerable vintage. Spy agencies routinely pose as third parties for operational purposes such as agent recruitment and covert action. The nastier intelligence services will even masquerade as terrorists to further their agenda.

Nobody is more adept at this dodgy practice than the Russians, who have been using false-flags in their spy work for more than a century. Indeed, for the Kremlin, this commonplace practice constitutes a key element of what they term provocation (provokatsiya in Russian), meaning the use of spies and their agents to cause secret political effects that are helpful to Moscow and hurtful to Moscow’s enemies.

The idea that Vladimir Putin authorized his intelligence agencies to go to cyber war against the West under an ISIS cloak is anything but shocking to anybody informed about longstanding Russian espionage tradecraft, what they tellingly refer to as konspiratsiya (yes, “conspiracy”). The only innovation here is the online aspect. Everything else reflects a century of “lessons learned” in Kremlin spy work. These are the sorts of clandestine things Putin was trained in and actually did as a KGB officer. And “there are no ‘former’ intelligence officers,” as the Russian president has stated.

This has implications far beyond the Islamic State. News this week that Russian-affiliated hackers have pillaged Washington, DC, including raiding the Democratic National Committee and Hillary Clinton’s campaign, ought not surprise. Among the items pilfered from the DNC include opposition research on Donald Trump, the presumptive Republican presidential nominee.

Now we learn that these Kremlin hacking efforts extend far beyond the DNC. Targets in recent Russian cyber-attacks include numerous think-tanks, law firms, lobbyists, and consultants. There were also almost 4,000 Google accounts targeted in a “spear-phishing” campaign to steal personal and privileged information. It’s clear that this coordinated offensive aimed at the heart of our nation’s capital stole a great deal of inside knowledge about America’s political elite that would be of high value to any foreign intelligence service.

Inside information about how American politics actually works—including secret deals between politicians, lobbyists, lawyers, and consultants—would definitely be something Putin would want to know as his government seeks to understand and influence our political elite, including whoever is elected our next president.

America has neglected counterintelligence for so long that we have allowed Russian intelligence into the heart of not just our security services but of our democracy itself. Aided by top secret information stolen by their guest Edward Snowden from NSA about how U.S. cybersecurity works, Kremlin spies are now feasting on whatever they like in Washington.

I previously explained in this column how Hillary Clinton’s email shenanigans helped our enemies, including Russia, while harming our national security. Now it’s evident that our political system has been penetrated top-to-bottom by Russian spies. Whoever moves into the White House in January will face digging out from a security debacle of unprecedented proportions, with the Kremlin holding the upper hand across the board.

Hacker Guccifer 2.0 Takes Credit for DNC Cyber Attack

This week's hacking of the Democratic National Committee (DNC) computer network "just became a big deal," according to whistleblower Edward Snowden: on Thursday, a lone actor took responsibility for the cyber attack previously blamed on Russia and published a series of documents allegedly extracted from DNC servers.
A hacker calling themselves "Guccifer 2.0"—after Guccifer, the currently jailed Romanian hacker who claims to have accessed Hillary Clinton's email server during her tenure as secretary of state—emailed documents to Gawker and the Smoking Gun that appear to be opposition research (pdf) on Republican frontrunner Donald Trump as well as lists of million-dollar-plus donations and donor contact information.

The hacker also published the documents on their blog.
Gawker reported that it "has not yet been able to verify that the Trump file was produced by the DNC, but we have been able to independently verify that the financial documents were produced by people or groups affiliated with the Democratic Party."
After stating that the attack was "easy, very easy" to accomplish, the hacker wrote in their email to the Smoking Gun that "Guccifer may have been the first one who penetrated Hillary Clinton's and other Democrats' mail servers. But he certainly wasn't the last. No wonder any other hacker could easily get access to the DNC's servers."
Guccifer 2.0 went on to claim that they accessed "many thousands" of documents from DNC servers, and that they gave WikiLeaks "all the rest."
The release of donor information appears to refute the claims of the DNC and its cyber security firm, CrowdStrike, which earlier this week said that no donor or financial documents had been breached.
"DNC chairwoman Debbie Wasserman Schultz said no financial documents were compromised," the hacker wrote on their blog. "Nonsense! Just look through the Democratic Party lists of donors!"
In response to Guccifer 2.0's posting, the DNC doubled down on the original claim that Russia was behind the cyber attack: "Our experts are confident in their assessment that the Russian government hackers were the actors responsible for the breach detected in April, and we believe that today's release and the claims around it may be a part of a disinformation campaign by the Russians," the DNC told Wired.
Dmitri Alperovitch, chief technology officer of CrowdStrike, also suggested to the Washington Post that Guccifer 2.0's release of documents "may be part of a 'Russian disinformation' campaign."
"We are exploring the documents' authenticity and origin," Alperovitch told the newspaper. "Regardless, these claims do nothing to lessen our findings relating to the Russian government's involvement."
"Some small signs do point to Russian involvement," Wired noted. "The PDFs posted by Gawker and the Smoking Gun contain error messages on several URLs that include Cyrillic characters and translate from Russian to 'error, invalid hyperlinks.'"
"Finding the perpetrator of a sophisticated hacker intrusion can be messy," as Wired observed. "Getting to the bottom of a vicious data breach at the center of a no-holds-barred presidential campaign is a full-on trainwreck."
Regardless of whether or not Russia is indeed behind the incursion, Edward Snowden pointed to the significance of the DNC hack on Twitter:

Significance is more than docs. Hacktivists, possibly state-sponsored, now demonstrating intent -- and capability -- to influence elections.
— Edward Snowden (@Snowden) June 16, 2016