Russia’s Latest Hack Shows How Useful ‘Criminal Groups’ Are to the Kremlin

The Russian criminals who orchestrated the SolarWinds hack have gained access to a USAID online-marketing account, enabling the group to send official-looking emails to a new swath of potential victims, Microsoft said Friday. Russian officials quickly denied involvement — but analysts say that just illustrates how the Kremlin uses ostensibly private groups to create deniability, a problem likely to continue. 

The group, Nobelium, gained access to USAID’s account with Constant Contact, an online marketing company, wrote Tom Burt, Microsoft’s vice president for customer security & trust, in a blog post. Impersonating USAID senders, the group was able to send malware-linked email to some 3,000 email addresses in 150 organizations. 

“Nobelium, originating from Russia, is the same actor behind the attacks on SolarWinds customers in 2020. These attacks appear to be a continuation of multiple efforts by Nobelium to target government agencies involved in foreign policy as part of intelligence gathering efforts,” Burt wrote. 

The White House has attributed the SolarWinds hack to the Russian government—specifically the SVR, a foreign intelligence service descended from the KGB—and levied sanctions in response. But the Kremlin has denied any involvement. It did so again on Friday in response to the USAID hack. 

The use of criminal groups as a cover for state-backed hacks has long been a hallmark of Russian intelligence and influence operations. Since 2016, it’s only gotten worse, Russian independent investigative journalist Andrei Soldatov told Defense One. 

The reasons for that are self-fulfilling, said Soldatov. Russia boasts a number of highly skilled computer scientists and coders who run software companies. But the market for Russian software internationally is very thin, in large part because potential customers assume that such companies have to work with the Russian government, which would mean potentially using software developed in partnership with an adversarial nation.. The clearest example is Kaspersky, which was once a shining example of Russian success in tech. It was forced to shut down its Washington, D.C., office in 2017 because it could no longer work with the U.S. government. Private companies followed the government’s lead and spurned the company. 

For Russian software makers, Soldatov said, their government has become the best, and even the only, source of revenue.

So how do groups like Nobelium, or DarkSide, the Russian criminal group behind the Colonial Pipeline hack, arise? Says Soldatov, the members of such “criminal groups” very often have day jobs in Russian software companies. The Russian government subcontracts with individuals to hack Western targets. Often that subcontract is joined by a more conventional contract for the company for more benign products or services. 

“You might have a company which is famous for writing software for defense, really good at DDoS prevention, right? That means they’re probably good at it,” said Soldatov. So Russian intelligence agencies can approach someone at that company and say “Look, there's a really good contract for you. Maybe you can help us with something? But it's kind of secret, off the books.” 

In this way, the Russian government has become the only market for Russian coders. It’s part of the reason Russian coders who aren’t formally part of the military get caught up in Russian hacking campaigns and find themselves sanctioned or indicted by the U.S. Justice Department. And Russian coders, he said, aren’t afraid of being extradited to the United States. They’re much more afraid of the Russian government. 

Countries may complain to the Russian government about the actions of such criminal groups, through the three-year-old National Coordination Center for Computer Incidents. But since it’s run by the Russian FSB, it’s something like complaining to the local wolf about someone stealing your sheep. No one takes it seriously, said Soldatov.

U.S. lawmakers have been casting about for ways to deter these officially unofficial hackers.

“Tolerating criminal activity within your borders should be a punishable offense. And my guess is not a sparrow falls in Russia that Putin doesn't know about,” Sen. Angus King, I-Maine, said during a Defense One-NextGov event on Thursday. 

King urged passage of the Cyber Diplomacy Act currently before the Senate. The bill would lead to the “creation of a bureau in the Department of State, headed by an ambassadorial-level person...confirmed by the Senate, whose responsibility is to represent the United States and work toward the establishment of international norms and standards.” He said this would allow the U.S. government to better work with other governments to dish out penalties for hacking behavior. 

“If somebody's a cyber criminal in Russia, I want them to not be able to visit Monte Carlo or Paris as well as Miami and New York,” he said.