Russian government cyber spies ‘hid behind Iranian hacker group’
October 22, 2019 Leave a comment
Russian hackers hijacked an Iranian cyber espionage group and used its infrastructure to launch attacks, hoping that their victims would blame Iran, according to British and American intelligence officials. The information, released on Monday, concerns a Russian cyber espionage group termed “Turla” by European cyber security experts.
Turla is believed to operate under the command of Russia’s Federal Security Service (FSB), and has been linked to at least 30 attacks on industry and government facilities since 2017. Since February of 2018, Turla is believed to have successfully carried out cyber espionage operations in 20 different countries. Most of the group’s targets are located in the Middle East, but it has also been connected to cyber espionage operations in the United States and the United Kingdom.
On Monday, officials from Britain’s Government Communications Headquarters (GCHQ) and America’s National Security Agency (NSA) said Turla had hijacked the attack infrastructure of an Iranian cyber espionage group. The group has been named by cyber security researchers as Advanced Persistent Threat (APT) 34, and is thought to carry out operations under the direction of the Iranian government.
The officials said there was no evidence that APT34 was aware that some of its operations had been taken over by Turla. Instead, Russian hackers stealthily hijacked APT34’s command-and-control systems and used its resources —including computers, servers and malicious codes— to attack targets without APT34’s knowledge. They also accessed the computer systems of APT34’s prior targets. In doing so, Turla hackers masqueraded as APT34 operatives, thus resorting to a practice that is commonly referred to as ‘fourth party collection’, according to British and American officials.
The purpose of Monday’s announcement was to raise awareness about state-sponsored computer hacking among industry and government leaders, said the officials. They also wanted to demonstrate the complexity of cyber attack attribution in today’s computer security landscape. However, “we want to send a clear message that even when cyber actors seek to mask their identity, our capabilities will ultimately identify them”, said Paul Chichester, a senior GCHQ official.
► Author: Joseph Fitsanakis | Date: 22 October 2019 | Permalink
The Russian government is preparing to swap a number of imprisoned spies with at least two member states of the North Atlantic Treaty Organization (NATO), according to reports. The Estonia-based news agency BNS, which is the largest news agency in the Baltics, 
A teenager who killed himself with an improvised explosive device in the lobby of a regional office of Russia’s domestic intelligence agency appears to have identified himself as an “anarchist-communist” on social media. At 8:52 am local time on Wednesday, the 17-year-old entered the regional office of Russia’s Federal Security Service (FSB) in the city of Archangelsk, located 800 miles north of Moscow. On CCTV footage released by the Russian security services, he is seen reaching into his backpack and taking out an object, which soon 
A female Russian national who worked for the United States Secret Service in Moscow was quietly dismissed in 2017, amidst concerns that she was spying for Russia. British newspaper The Guardian, which 
The United States has for the first time imposed economic sanctions on a number of Russian companies, which it says helped the Kremlin spy on targets in North America and Western Europe. On Monday, the US Department of the Treasury said it would apply severe economic restrictions on a number of Russian firms that work closely with the Kremlin. One of the companies was 
A Russian former diplomatic employee and an Argentine police officer are among six people arrested following the discovery of nearly 1000 pounds of cocaine inside the Russian diplomatic compound in Buenos Aires. The arrests took place last Thursday and were announced in Argentina by the country’s Security Minister Patricia Bullrich. She told reporters that the arrests came after a 14-month investigation in Argentina, Russia and Germany. She added that the investigation unveiled “one of the most complex and extravagant drug-dealing operations” in Argentina’s history.
Authorities in Russia have announced the arrest of a Norwegian citizen, whom they accuse of receiving classified information relating to Russia’s Armed Forces. The detainee has been named as Frode Berg, 62, from Kirkenes, a small town in Norway’s far north, located 100 miles from the Russian city of Murmansk. According to articles in the Russian press, Berg is a 24-year veteran of the Office of the Norwegian Border Commissioner, an obscure government agency that operates under Norway’s Ministry of Justice and Public Security. Among other tasks, the Office of the Norwegian Border Commissioner is responsible for enforcing and monitoring bilateral compliance with the Soviet (now Russian)-Norwegian Border Agreement of 1949. Berg, who worked closely with Norway’s National Police Directorate as part of his job, retired from the Office in 2014.
Authorities in Poland have charged three high-level military intelligence officials with acting in the interests of Russia. The three include two former directors of Polish military intelligence and are facing sentences of up to 10 years in prison. The news broke on December 6, when Polish authorities announced the arrest of Piotr Pytel, who was director of Poland’s Military Counterintelligence Service (SKW) from 2014 to 2015. It soon emerged that two more arrests had taken place, that of Pytel’s predecessor, Janusz Nosek, and Krzysztof Dusza, Pytel’s chief of staff during his tenure as SKW director.
A member of a prolific Russian hacker group reportedly stated in court that he was hired by the Russian government to break into the computer systems of the Democratic Party in the United States. The hacker, Konstantin Kozlovsky, operated online as a member of Lurk, a notorious hacker group whose members are believed to have stolen in excess of $45 million from hundreds of companies since 2011. Most of the group’s members were apprehended in a 
The former director of Poland’s military counterintelligence agency has been questioned by the country’s military police, over allegedly illegal cooperation with Russian intelligence. From 2006 to 2012, General Piotr Pytel was head of Poland’s Military Counterintelligence Service (MCS), which is responsible for domestic security and for ensuring the war-readiness of Poland’s armed forces. According to government prosecutors, General Pytel struck an illegal agreement with the Russian Federal Security Service, the FSB, in 2010. The alleged agreement concerned the return to Poland of troops who had been sent to serve in Afghanistan with the International Security Assistance Force (ISAF). Several hundred Polish troops participated in ISAF, a NATO-led security mission in Afghanistan, established by the United Nations Security Council in 2001.
Two senior officers in the Russian intelligence services were charged with treason after they were found to have helped the United States catch two notorious Russian hackers, according to reports in the Russian media. Sergey Mikhailov was a career officer in the Federal Security Service —a descendant of the domestic section of the Soviet-era KGB— which is often referred to as Russia’s equivalent of the United States Federal Bureau of Investigation. Mikhailov had risen through the ranks of the FSB to eventually head the agency’s Center for Information Security. Known in Russia as CIB, the Center is tasked with investigating electronic crime in the Russian Federation.
Russian intelligence services say they have foiled a large-scale bomb plot, after raiding an explosives laboratory belonging to the Islamic State and arresting four suspects. The four men were allegedly planning to target the Moscow Metro transit system and a busy shopping center in the Russian capital. In a statement released to the media this morning, the Russian Federal Security Service (FSB) did not specify the intended targets of the plotters. But it said it had arrested four people during an early morning raid at an explosives laboratory located in the Moscow suburbs. The FSB said that its officers 
Russian authorities say they prevented a large-scale cyber attack by “a foreign intelligence service”, which had been designed to destabilize the country’s financial system and subvert its economy. In an official 
Russia, Lithuania and Norway exchange prisoners in rare three-way spy-swap
November 18, 2019 by Joseph Fitsanakis 1 Comment
A major part of the process that led to last week’s spy swap was the decision of the Lithuanian parliament to approve altering the country’s criminal code. The new code allows the president of Lithuania to pardon foreign nationals who have been convicted of espionage, if doing so promotes Lithuania’s national interest. The new amendment also outlines the process by which the government can swap pardoned foreign spies with its own spies —or alleged spies— who may have been convicted of espionage abroad. On Friday, Lithuanian President Gitanas Nausėda announced he had pardoned two Russian nationals who had been convicted of espionage against Lithuania, in accordance with the new criminal code. The president’s move was approved by the country’s multi-agency State Defense Council during a secret meeting.
Shortly after President Nausėda’s announcement, Sergei Naryshkin, Director of Russia’s Foreign Intelligence Service (SVR) said that Moscow would immediately proceed with “reciprocal steps”. The Kremlin soon released from prison two Lithuanian nationals, Yevgeny Mataitis and Aristidas Tamosaitis. Tamosaitis was serving a 12-year prison sentence, allegedly for carrying out espionage for the Lithuanian Defense Ministry in 2015. Mataitis, a dual Lithuanian-Russian citizen, was serving 13 years in prison, allegedly for supplying Lithuanian intelligence with classified documents belonging to the Russian government.
The two Lithuanians were exchanged for two Russians, Nikolai Filipchenko and Sergei Moisejenko. Filipchenko is believed to be an officer in the Russian Federal Security Service (FSB), who was arrested by Lithuanian counterintelligence agents in 2015. He had been given a 10-year prison sentence for trying to recruit double agents inside Lithuania, allegedly in order to install listening bugs inside the office of the then-Lithuanian President Dalia Grybauskaite. Moisejenko was serving a 10½ year sentence for conducting espionage and for illegally possessing firearms. Lithuania alleges that Moisejenko had been tasked by Moscow with spying on the armed forces of Lithuania and NATO. Along with the two Lithuanians, Russia freed Frode Berg (pictured), a Norwegian citizen who was serving a prison sentence in Russia, allegedly for acting as a courier for the Norwegian Intelligence Service.
On Saturday, Darius Jauniškis, Director of Lithuania’s State Security Department, told reporters in Vilnius that the spy swap had taken place in a remote part of the Russian-Lithuanian border. He gave no further information about the details exchange, or about who was present at the site during the spy-swap.
► Author: Joseph Fitsanakis | Date: 18 November 2019 | Research credit: E.G. | Permalink
Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with Aristidas Tamosaitis, espionage, Frode Berg, FSB, imprisoned spy swaps, Lithuania, News, Nikolai Filipchenko, Norway, Russia, Sergei Moisejenko, State Security Department (Lithuania), SVR (Russia), Yevgeny Mataitis